AI’s Missing Handover

The proposal concerns AI systems processing personal data in commercial transactions under Act 709. It is not final guidance, enacted law, a new legal basis or a universal AI mandate.

The draft covers controllers and processors where applicable, internal and external AI, and the lifecycle from planning to retirement. The proposal discusses supplier due diligence, cross-border processing, security incidents and compliance records.

The gap between two approved answers

A product list is a poor substitute for a working explanation. BlackTree’s proposed exercise is to choose one use case and give its reviewers the same disputed question, rather than ask each department for a separate assurance statement.

Scrutinise retention, reuse, training, subprocessors, countries, changed terms and deletion promises.

Consider a hypothetical team whose procurement file says a supplier promise was approved, while its operating record says the relevant option is still awaiting confirmation. Both teams may have completed their assigned ticket. The unresolved issue lies between the tickets: nobody has established whether the approval and the operating assumption refer to the same thing.

Put both statements side by side. Preserve their wording, the dates they were relied on and the references needed to inspect them. Ask the two owners to identify the precise disagreement and the person who can settle it. Until that happens, retain the item as unresolved rather than averaging two different answers into a green status.

Evidence should survive the handover

The draft identifies data loss prevention as one possible safeguard for personal data sent to external models or APIs.

For the proposed exercise, distinguish a requested action from a completed one. When someone reports that the disagreement has been resolved, retain the dated confirmation and the exception, if any. Then ask a colleague who did not attend the discussion to follow the record. If the colleague cannot explain why the item was closed, the handover still depends on the participants’ memory.

BlackTree’s earlier analysis of Malaysia’s enacted privacy reforms covers Data Protection Officers, breach notification and direct processor security duties.

This exercise is BlackTree editorial advice, not the regulator’s prescribed procedure or a claim that a service has passed a test. Its purpose is to expose the point at which individually plausible answers stop forming a coherent explanation.

A specific question beats a general endorsement

The appendix’s issuance date is a placeholder, not evidence of enactment.

A consultation response can describe the unresolved decision from that exercise: which two interpretations conflicted, what evidence would distinguish them and what clarification would make the decision possible. Avoid presenting a hypothetical difficulty as an observed incident. A precise question is more useful than declaring the whole proposal either sufficient or impossible.

Updated 15 October 2026: replaced overlapping checklist material with a worked handover example and clarified its editorial status. Original publication date retained.

Source: Malaysia consultation paper.