Artificial intelligence can help public services become faster, more responsive, and better informed. However, improving efficiency is only one part of the picture. When technology influences how government agencies handle information, support decisions, and interact with citizens, it also raises important questions about privacy, fairness, and responsibility. The real challenge is making sure that innovation strengthens public trust rather than undermining it.
That is the central message of Malaysia's 2025 Guidelines for Artificial Intelligence Adoption in the Public Sector, developed by Jabatan Digital Negara, the National Digital Department. The document complements the National Guidelines on AI Governance and Ethics, commonly known as AIGE, while providing practical guidance for public-sector implementation. Its approach connects an understanding of AI with ethical principles, organisational readiness, clear responsibilities, and risk management. Rather than treating AI as a technology purchase, it presents adoption as an ongoing commitment to responsible public service.
Understanding AI Beyond the Buzzwords
The guide begins with an important distinction: AI is not simply another name for ordinary software. Traditional applications generally follow explicitly programmed rules, making them suitable for predictable activities such as payroll processing or inventory management. AI approaches can learn patterns from data and use those patterns to generate predictions, recommendations, or other outputs. This makes them useful for problems involving complex information or changing circumstances, but also makes the quality of the underlying data especially important.
Several related technologies sit within this broader picture. Machine learning focuses on learning from data, while deep learning uses multiple processing layers within a more specialised machine-learning approach. Natural language processing supports interactions involving human language, including chatbots and text analysis, while computer vision deals with visual information. The guide also distinguishes task-specific AI from broader concepts such as artificial general intelligence and superintelligence, which it discusses as theoretical or conceptual forms.
For public agencies, the practical opportunities include processing documents, identifying patterns, handling routine enquiries, and supporting planning. Nevertheless, the document repeatedly stresses that AI should complement human capabilities rather than replace human judgment. Incomplete or biased data can produce unreliable results, while decisions involving empathy, cultural sensitivity, or moral considerations require meaningful human involvement. Understanding these limitations is part of using AI well, not an argument against using it.
AI Adoption Still Requires Proper Governance
A recurring message in the guide is that AI does not sit outside the rules governing public administration. Its discussion of Malaysian legislation covers areas including official information, cybersecurity, intellectual property, electronic government activities, and procurement. Among the laws referenced are the Official Secrets Act 1972, Copyright Act 1987, Computer Crimes Act 1997, and Cyber Security Act 2024. These references establish the guide's broader point: agencies must consider the responsibilities surrounding an AI system, not just its technical capabilities.
The document also places AI alongside public-sector requirements for data sharing, cloud security, application development, and ICT project management. Frameworks such as KRISA and PPrISA remain relevant because implementation involves integration, documentation, approval, and operational management. The aim is to avoid isolated projects that function technically but do not fit the agency's wider responsibilities. Proper governance therefore begins before development and continues throughout operation.
The Seven Principles of Responsible Public-Sector AI
At the heart of the guidelines are seven ethical principles. Together, they provide a foundation for protecting citizens, reducing harmful outcomes, and making AI-supported services worthy of public confidence. Each principle addresses a different concern, but they work best when considered together throughout a system's lifecycle.
1. Data Privacy and Security
Public-sector AI must protect the information entrusted to it. The guide's practical checks include collecting only necessary data, explaining its intended use, protecting it during transmission and storage, and limiting access according to responsibilities. Retention and deletion practices also matter, as do the security obligations of third-party vendors. Privacy is therefore a responsibility across the entire data lifecycle, not simply a security setting applied when a system launches.
2. Transparency
People should understand when AI is being used and what role it plays. The guide calls for clear explanations of a system's purpose, capabilities, limitations, and the factors influencing its outputs. It also recognises that transparency must operate within applicable security requirements and other rules; it does not mean disclosing protected information indiscriminately. The objective is meaningful understanding, supported by appropriate opportunities to question AI-generated decisions.
3. Accountability
Someone must remain responsible when an AI system makes an error or contributes to an undesirable outcome. The guidelines call for clearly assigned roles, documented responsibilities, oversight arrangements, and systems that can be audited and traced. Responsibility should not become unclear simply because several teams or external providers are involved. Regular reviews and feedback help agencies identify problems and ensure that corrective action actually takes place.
4. Fairness
An AI system should not disadvantage people because of biased data or discriminatory processing. The guide emphasises diverse, representative datasets, ongoing evaluation, and human oversight to identify and address unfair outcomes. It also cautions against a one-size-fits-all approach that overlooks differences in people's needs and circumstances. Fairness must be examined throughout development and operation, rather than assumed from the fact that a decision was produced by a computer.
5. Inclusiveness
A service cannot fulfil its public purpose if significant groups struggle to access or use it. Inclusiveness means considering people with disabilities, older users, marginalised communities, different language backgrounds, and varying levels of technical knowledge. The guidelines encourage multilingual interaction, accessible design, and participation by diverse groups in development and evaluation. Listening to these users helps ensure that digital improvements do not create new barriers.
6. Reliability and Robustness
Reliability means that a system performs consistently for its intended purpose. Robustness concerns its ability to cope with difficult conditions, unexpected inputs, and external threats. The guide therefore emphasises comprehensive testing, security and privacy by design, documented data-processing activities, and continuing oversight. A successful demonstration is not enough; the system must also perform dependably when exposed to real operational conditions.
7. Sustainability
Sustainability extends beyond reducing electricity consumption. The guidelines connect AI adoption with long-term environmental responsibility, social wellbeing, efficient resource use, and systems that can adapt to changing needs. They encourage attention to processing demand, energy-efficient infrastructure, and solutions suited to local circumstances. The underlying question is whether an AI initiative can continue delivering meaningful benefits without creating unnecessary environmental or organisational burdens.
Who Is Responsible for Making It Work?
The guide identifies six groups of AI actors, showing that responsibility extends beyond the IT department. Each contributes to a different part of the system's development, implementation, or use:
The responsibilities of civil servants are particularly practical. They should avoid depending entirely on AI, document situations where its recommendations are rejected, and investigate inconsistent results. The guide also calls for the ability to return quickly to human or traditional decision-making when a system fails or an incident occurs. Human oversight, in this sense, means having both the understanding and the ability to intervene.
Starting an AI Project: Begin with the Problem
The guide offers a useful starting point: focus on the problem, not the technology. Before considering models or platforms, an agency should identify the specific difficulty it wants to address and the needs of its users. It should also examine whether AI is an appropriate solution and how it would work alongside existing services. Involving stakeholders early helps keep the project grounded in operational reality.
Its project workflow follows six stages:
Going live is not the end of the journey. The lifecycle diagram on printed page 32 groups AI work into design, development, and deployment, with monitoring, maintenance, and retraining included within deployment. This makes continuing evaluation part of the implementation model itself. Agencies are expected to watch how outputs perform in practice and respond when data patterns or operating conditions change.
The Eight Foundations of Successful Adoption
A promising idea still needs the right organisational conditions. The guidelines identify eight foundations that agencies should address before expecting AI to deliver sustainable results:
Data quality deserves particular attention. The guide does not treat access to large amounts of information as sufficient on its own: data must also be credible, timely, interpretable, consistent, and usable across systems. Poor-quality information can undermine both performance and fairness. Preparing and governing data is therefore a core part of an AI initiative, rather than a minor preliminary task.
The people and financial considerations are equally important. Training should develop understanding and judgment, while change management should address how roles and workflows will be affected. Financial planning must account for data preparation, infrastructure, licensing, staff development, maintenance, support, and unexpected difficulties. A project needs resources to remain useful after launch, not just enough funding to reach it.
Different Applications Need Different Safeguards
Not every AI application creates the same potential for harm. The risk pyramid on printed page 107 presents four categories: prohibited, high-risk, limited-risk, and minimal-risk AI. The guide uses this structure to support proportionate management rather than applying identical controls to every system. Its starting point is the actual use case, operating context, and potential consequences for people.
Prohibited AI: Uses Considered Unacceptable
Within its framework, the guide identifies applications that pose unacceptable risks to individuals or society. Examples include indiscriminate collection of facial images to build databases, manipulative uses that influence people without their knowledge or consent, and discriminatory recruitment systems. These are presented as practices to prevent because of their implications for privacy, equality, and human rights. The emphasis is on avoiding unacceptable harm, not merely making harmful applications more efficient.
High-Risk AI: Significant Benefits, Serious Consequences
High-risk applications can offer substantial benefits, but errors or misuse may have serious consequences. The guide includes certain law-enforcement, predictive-policing, and healthcare applications in this category, highlighting risks such as misidentification, unfair targeting, and incorrect clinical recommendations. Its proposed safeguards include regular audits, validation against benchmarks, bias assessments, representative datasets, and strict data protection. These systems demand careful scrutiny because their consequences extend well beyond operational inconvenience.
Limited-Risk AI: Useful Support with Continuing Oversight
The guide's limited-risk examples include routine enquiry chatbots, administrative automation, and analytical tools that support rather than independently determine decisions. Their intended contexts involve relatively limited consequences for rights or safety. Nevertheless, the document still calls for quality checks, clear documentation, transparency, and trained operators who can intervene when necessary. Limited risk does not remove the need for responsible management.
Minimal-Risk AI: Clear Boundaries and Simple Controls
Minimal-risk applications include routine scheduling tools and public-service information notifications where errors are generally manageable. The guide recommends clearly defining their purpose and operational boundaries, using automated error detection, and providing straightforward feedback mechanisms. These controls help prevent unintended uses and identify recurring problems. Even relatively simple applications should have a clear purpose and a way to correct mistakes.
What the Practical Examples Show
The appendices demonstrate how these principles can appear in everyday services. One Malaysian case describes a public university using AI to check registration photographs against defined requirements. Students can attempt uploads up to five times, while photographs that cannot be validated by AI can still be processed manually at the university office. The example combines automation with a human alternative, rather than making successful AI processing the only route forward.
Another case describes a state-government chatbot designed to make public services more accessible through mobile devices and support for local dialects. Its functions include assistance with services such as bill payments and registrations. The emphasis is not simply on introducing a conversational interface, but on making that interface relevant to the community using it. This connects practical service design with the guide's wider emphasis on inclusiveness.
International examples reinforce the value of focused applications. The guide describes Italy's social-security administration using AI to classify incoming emails and route them to the appropriate offices. This addresses a specific administrative workload rather than attempting to automate an entire organisation at once. It illustrates how a clearly defined task can provide a useful starting point for improving service delivery.
Turning Ethical Principles into Self-Assessment
The guide concludes its practical framework with a self-assessment template. This gives agencies a structured way to examine their proposed or existing systems instead of relying on general statements about responsible AI. It is organised into three parts:
The questions make governance concrete. They ask about matters such as necessary data collection, access restrictions, retention, accountability, and the ability to challenge decisions. The impact assessment also asks agencies to identify circumstances requiring an immediate stop to the system, as well as issues requiring investigation and a defined resolution period. This moves the discussion from ethical intentions to operational decisions about what happens when something goes wrong.
Final Thoughts
Malaysia's public-sector AI guidelines present innovation and responsibility as connected goals. Better services depend not only on capable technology, but also on reliable data, prepared staff, clear accountability, and safeguards matched to the consequences of failure. The seven ethical principles provide the foundation, while the project workflow, readiness requirements, risk categories, and self-assessment tools help translate that foundation into practice.
The most useful starting question is therefore not, "Where can we add AI?" It is, "Which public-service problem are we trying to solve, and how can we solve it responsibly?" Keeping that question at the centre helps ensure that AI remains a means of serving people—not an objective that takes priority over them.
Comments 0