On 3 July 2026 the Securities Commission opened a consultation asking whether Malaysian listed companies should be expected to name, in board minutes and public disclosures, who actually owns AI oversight. It is a narrow proposal aimed at Bursa-listed boards, and I doubt most owner-managed SMEs have registered it at all. That would be a mistake, because the question underneath it, who in this organisation is answerable for how we use AI, is not one that only applies once you have a listing.
To be precise about what is actually on the table: this is a consultation paper open for comment until 31 July 2026, not a rule in force, and it is one of four proposal areas in the SC's broader push to strengthen the corporate governance ecosystem ahead of a revised Malaysian Code on Corporate Governance. It sits alongside, but is distinct from, the National AI Office's separate AI Governance Bill consultation, which is a horizontal law aimed at anyone building or deploying AI systems. The SC proposal is narrower and more specific: it asks whether boards should have to show, in writing, that someone owns the question of how AI is used and governed in their company.
Why "who owns this" is the part worth borrowing early
What strikes me about the SC's framing is that it does not propose new technical rules for AI at all. It proposes an accountability structure, a named person or committee, a reporting line, a paper trail showing the board actually discussed the thing rather than nodding it through. That is a governance instinct, not a technology one, and governance instincts tend to be worth adopting well before the regulator makes them compulsory, because the alternative is building the paper trail retroactively under time pressure, which is always worse.
I have sat in enough SME boardrooms, family-run and founder-led alike, where AI comes up as a line item in an ops update, mentioned, nodded at, moved past, with nobody in the room able to say afterwards who is actually responsible for it. That is not a compliance gap yet for a private company. But it is already an operational one: when nobody owns a decision, nobody notices when the decision quietly goes wrong.
At your next management or board meeting, ask the question directly: if our AI use caused a customer complaint or a bad hiring decision tomorrow, whose name goes on the incident report? If the room cannot answer in under a minute, that is the gap. Naming an owner, even informally, in minutes, costs nothing and closes it immediately.
"But nobody in my company actually knows enough to own this"
This is the objection I hear most often, and it deserves a straight answer rather than a reassuring one. Most SMEs genuinely do not have anyone with the technical depth of a Chief AI Officer, and it would be dishonest to pretend that a fifteen-person business needs to hire one before it can hold anyone accountable. But the SC's proposal, read carefully, does not actually ask for technical expertise. It asks for an owner, someone who can say what AI tools the business uses, why, what could go wrong, and what happens if it does. That is a governance role, not an engineering one, and the person best placed to hold it is often whoever already owns operations, finance, or HR, not whoever is best at prompting a chatbot.
Where the gap is genuinely technical rather than accountable, the honest options are to bring the judgement in rather than invent it internally: a fractional or advisory arrangement that sits with the board periodically, rather than a full-time hire the business cannot yet justify. What a board cannot reasonably do is leave the role unnamed because nobody feels qualified. Accountability without expertise is uncomfortable, but expertise without accountability is worse, because at least the first version means someone is asking the right questions even if they do not yet know all the answers.
Why this matters for Malaysian SMEs specifically
SME boards in Malaysia, family companies especially, often assume governance expectations arrive fully formed and apply only once a company crosses some threshold, whether that is headcount, listing status, or revenue. PDPA did not work that way in practice, and AI governance is unlikely to either. The businesses I have watched handle PDPA well were the ones that treated "who is responsible for this" as a sensible internal question long before any regulator asked it formally. The SC's board-level AI owner proposal, even confined to listed companies for now, is a useful preview of the standard that will eventually apply more broadly, and adopting the habit costs a private board nothing beyond a line in the minutes.
Not sure who actually owns AI oversight in your organisation?
The AI Readiness Assessment is a 15-minute diagnostic that maps where accountability for AI use currently sits in your business, and where the gaps are, before any regulator asks the question for you.
Explore the Assessment (RM297)If the gap is expertise rather than attention, a Fractional AI Advisor retainer can sit with your board without requiring a full-time hire.
What This Means for You
Nothing in the SC's consultation obliges a private SME to do anything, and it may not even survive the consultation process in its current form. But the underlying idea, that AI use without a named, accountable owner is a governance gap regardless of company size, is sound on its own merits. Naming that owner now, informally and in writing, is one of the cheapest governance decisions a board will ever make, and it is far easier to do before it is asked for than after.