From Soft-Law AI Ethics to Risk-Based Public Sector AI Procurement: Recalibrating Malaysia’s Post-PDPA Governance Model
DOI:
https://doi.org/10.47353/lawpass.v3i4.131Keywords:
artificial intelligence, public procurement, data protection, administrative law, algorithmic accountability, risk-based regulationAbstract
Public-sector artificial intelligence (AI) is increasingly acquired through procurement rather than developed entirely in-house. This shifts a central governance question from whether public institutions endorse ethical principles to whether those principles become enforceable duties across the system life cycle. Malaysia has introduced national AI governance and ethics guidance and public-sector AI adoption guidance, while the Personal Data Protection (Amendment) Act 2024 recalibrates parts of the data-protection framework. Yet privacy compliance and high-level ethical principles alone cannot fully govern the acquisition and operation of AI used in public administration. This article asks how Malaysia can translate soft-law principles and existing legal duties into procurement controls proportionate to risk. Using doctrinal legal analysis and functional comparison with the European Union’s AI Act, the OECD AI Principles, UNESCO’s Recommendation on the Ethics of AI, Canada’s Directive on Automated Decision-Making, and the NIST AI Risk Management Framework, it develops a normative Risk-to-Contract Accountability Framework (RCAF). The framework links risk classification to six controls: pre-award disclosure; impact assessment; contractual auditability; contestability and human review; incident reporting and material-change control; and continuing monitoring, remedies, and exit. The contribution is not a claim that AI procurement has never been studied, but a Malaysia-specific legal design connecting governance principles to the contract as a practical instrument of public accountability. The article argues that procurement should allocate responsibilities before deployment, preserve the authority’s ability to scrutinise supplier claims, and prevent contractual arrangements from insulating consequential decisions from review.
References
Ada Lovelace Institute. (2021). Regulating AI in the UK: A framework for AI regulation. https://www.adalovelaceinstitute.org/report/regulating-ai-in-the-uk/
Benjamin, R. (2019). Race after technology: Abolitionist tools for the new Jim code. Polity.
Busuioc, M. (2021). Accountable artificial intelligence: Holding algorithms to account. Public Administration Review, 81(5), 825–836. https://doi.org/10.1111/puar.13293
Canada, Treasury Board of Canada Secretariat. (2019, as amended). Directive on Automated Decision-Making. https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592
Calo, R. (2015). Robotics and the lessons of cyberlaw. California Law Review, 103(3), 513–563.
Citron, D. K., & Pasquale, F. (2014). The scored society: Due process for automated predictions. Washington Law Review, 89(1), 1–33.
Culot, G., Podrecca, M., Nassimbeni, G., & Sartor, M. (2026). Artificial intelligence in public procurement: Aligning operational capacity, legitimacy, and public value. Journal of Business Logistics, 47(4), e70088. https://doi.org/10.1111/jbl.70088
European Parliament & Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Jabatan Digital Negara. (n.d.). Guidelines for the adoption of AI in the public sector. Government of Malaysia. https://www.jdn.gov.my/en/guidelines-for-the-adoption-of-ai-in-the-public-sector/
Kroll, J. A., Huey, J., Barocas, S., Felten, E. W., Reidenberg, J. R., Robinson, D. G., & Yu, H. (2017). Accountable algorithms. University of Pennsylvania Law Review, 165(3), 633–705.
Lau, D. K., Samy, G. N., Abdul Rahim, F., Selvanathan, M., Maarop, N., Krishnan, M. R., & Perumal, S. (2025). Responsible procurement of AI applications: A risk-based framework for Malaysian government agencies. https://doi.org/10.24191/mij.v6i2.9172. [Verify journal title, volume, issue, and page/article number before submission.]
Lodge, M., & Wegrich, K. (Eds.). (2014). The problem-solving capacity of the modern state: Governance challenges and administrative capacities. Oxford University Press.
Malaysia. (2010). Personal Data Protection Act 2010 (Act 709). Laws of Malaysia.
Malaysia. (2024). Personal Data Protection (Amendment) Act 2024 (Act A1727). https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-amendment-act-2024/
Maaz, Z. N., et al. (2026). Explainable artificial intelligence (XAI) model for transparent and trustworthy tender evaluation of construction projects. International Journal of Technology, 17(3), 953–972. https://doi.org/10.14716/ijtech.v17i3.8288
Mittelstadt, B. D., Allo, P., Taddeo, M., Wachter, S., & Floridi, L. (2016). The ethics of algorithms: Mapping the debate. Big Data & Society, 3(2). https://doi.org/10.1177/2053951716679679
National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1
National Institute of Standards and Technology. (2024). Artificial intelligence risk management framework: Generative artificial intelligence profile (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1
Nik Mohammad Wafiy Azmi, M. F. H. M. Z., Tarudin, M. D. A., & Shahidan, N. F. (2025). AI and public governance in Malaysia: A literature review on ethical, legal, and operational challenges. Journal of Mathematics and Computing Science, 11(1). https://doi.org/10.24191/jmcs.v11i1.8090
OECD. (2019, updated 2024). Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449). https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449
OECD. (2024). AI, data governance and privacy: Synergies and areas of international co-operation. OECD Publishing.
Pasquale, F. (2015). The black box society: The secret algorithms that control money and information. Harvard University Press.
Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D., & Barnes, P. (2020). Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, 33–44. https://doi.org/10.1145/3351095.3372873
Sciarrone, F., & Calabrese, A. (2026). Governing AI in sustainable public procurement: Towards an ESG-oriented conceptual architecture. VINE Journal of Information and Knowledge Management Systems. https://doi.org/10.1108/VJIKMS-07-2025-0309
Selbst, A. D., boyd, d., Friedler, S. A., Venkatasubramanian, S., & Vertesi, J. (2019). Fairness and abstraction in sociotechnical systems. Proceedings of the 2019 Conference on Fairness, Accountability, and Transparency, 59–68. https://doi.org/10.1145/3287560.3287598
Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
UNESCO. (2021). Recommendation on the ethics of artificial intelligence. https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence
Veale, M., & Brass, I. (2019). Administration by algorithm? Public management meets public sector machine learning. In K. Yeung & M. Lodge (Eds.), Algorithmic regulation. Oxford University Press. https://doi.org/10.1093/oso/9780198838494.003.0006
Wachter, S., Mittelstadt, B., & Russell, C. (2021). Why fairness cannot be automated: Bridging the gap between EU non-discrimination law and AI. Computer Law & Security Review, 41, 105567. https://doi.org/10.1016/j.clsr.2021.105567
Wirtz, B. W., Weyerer, J. C., & Geyer, C. (2019). Artificial intelligence and the public sector—Applications and challenges. International Journal of Public Administration, 42(7), 596–615. https://doi.org/10.1080/01900692.2018.1498103
World Economic Forum. (2022). AI procurement in a box: A guide to AI procurement for the public sector. World Economic Forum.
Yeung, K. (2018). Algorithmic regulation: A critical interrogation. Regulation & Governance, 12(4), 505–523. https://doi.org/10.1111/rego.12158
Zuboff, S. (2019). The age of surveillance capitalism: The fight for a human future at the new frontier of power. PublicAffairs.
Downloads
Published
How to Cite
License
Copyright (c) 2026 Rozaini Binti Rosli
This work is licensed under a Creative Commons Attribution 4.0 International License.
You are free to:
- Share — copy and redistribute the material in any medium or format for any purpose, even commercially.
- Adapt — remix, transform, and build upon the material for any purpose, even commercially.
The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made.
- No additional restrictions — You may not apply legal terms or technological measures that legally restrict others.
Notices:
You do not have to comply with the license for elements in the public domain or where your use is permitted by an applicable exception or limitation.
No warranties are given. The license may not grant all permissions required for your intended use. Other rights such as publicity, privacy, or moral rights may apply.
