At AI Malaysia’s Launch, Anwar Names the Sovereignty Problem

• Anwar raises AI sovereignty concerns, naming the US CLOUD Act, at the launch of Malaysia’s institutionalised national AI agency.
• The government will stay vendor-neutral on the AI tools it funds for 100,000 youths, “whether from China, America or Germany.”

AI sovereignty was the one question Malaysia’s most consequential AI launch was not meant to raise, and the Prime Minister raised it anyway.

On Tuesday, Anwar Ibrahim launched AI Malaysia, the entity that formally institutionalises the National AI Office (NAIO) under the Ministry of Digital. Established in December 2024 as a coordinating office incubated within MyDIGITAL Corporation, NAIO now gains a permanent structure and the mandate to execute the national AI agenda through 2030.

It is important to note that the newly launched AI Malaysia is distinct from the similarly named AI Malaysia (AIM) platform announced by the ASEAN Business Advisory Council Malaysia (ASEAN-BAC), a private-sector network for regional business engagement.)

Most coverage has understandably been based on the day’s giveaway: free three-month subscriptions to a leading AI application for up to 100,000 Malaysians aged 18 to 30 who complete course modules under the Rakyat Digital programme, opening on August 31 this year. But buried in the middle of Anwar’s speech was a passage that deserves more scrutiny than the subscription numbers, because it goes to the foundations of the strategy itself.

The AI sovereignty problem Anwar named himself

Addressing concerns from the security establishment, Anwar said the worries were legitimate. “How far should we establish a sovereign cloud, how do we deal with the problem of the United States’ CLOUD Act, which can penetrate all other systems, and how a distinct foreign entity should be entrusted with a role in cybersecurity, for instance,” he said, listing the questions as open ones.

The third concern is worth pausing on. As Anwar relayed them, the security establishment’s anxieties all point the same way: foreign law and foreign entities operating inside systems Malaysia considers critical.

The CLOUD Act, passed in 2018, allows US authorities to compel American technology companies to produce data in their custody regardless of where that data is physically stored. A workload running in a Johor or Cyberjaya facility operated by a US cloud provider is not, in jurisdictional terms, beyond the reach of a US court order.

That is an uncomfortable observation for a country that has staked its AI ambitions on precisely those providers. AWS, Microsoft, Google and Oracle have committed a combined US$16.9 billion to Malaysian cloud and data centre infrastructure through 2038. When NAIO was first launched in December 2024, the government announced strategic partnerships with six companies, among them Amazon, Google and Microsoft.

The agency now being institutionalised was, in other words, born with US hyperscalers as founding partners, and its patron has just placed on record that US data law reaches into their systems.

Anwar did not resolve the question. He carved it out instead, saying that everything apart from sovereign cloud and security considerations should be coordinated by the Ministry of Digital. The speech did not say where those two issues would sit, which leaves the hardest governance question in Malaysia’s AI build-out formally unassigned on the day its AI governance was formalised.

Agnostic at the application layer

What makes the sovereignty passage more striking is how relaxed the Prime Minister was about the layer above it. On the question of which AI application the 100,000 youth subscriptions would cover, Anwar handed the decision to Digital Minister Gobind Singh Deo with visible indifference to origin. “That is Gobind’s problem. He can find whichever is the leading one, whether from China, America or Germany, I don’t mind,” he said, in a passage the official verbatim marks were delivered in a joking tone.

Read generously, the two positions form a coherent posture: guard the infrastructure and data layer, where jurisdiction and compulsion live, and stay pragmatically neutral at the application layer, where switching costs are low. It would be consistent with the non-aligned line Malaysia has held throughout the US-China technology contest, courting American hyperscaler capital and Chinese manufacturing investment simultaneously.

Read less generously, the government is about to hand a foreign AI provider a cohort of 100,000 young Malaysian users, their prompts and their usage data, with selection criteria that do not yet exist and course modules that, by the minister’s own on-stage admission, are not yet written. Anwar gave the ministry two weeks to produce them.

Anwar was not blind to the corporate dimension of the sovereignty question either. He acknowledged the fear that large companies seek to dominate the world through their command of AI, and called that fear true. His answer was mastery rather than withdrawal: Malaysia could reject AI outright, he argued, and others would dominate it anyway.

There was a data point for the posture reading. Anwar recalled that at the APEC summit in South Korea late last year, he pressed the case for AI ethics as a matter for international deliberation, and that by his account the only other leader to do the same was China’s President Xi Jinping. He noted their emphases differed. It was a telling anecdote for a leader positioning his country between the two AI superpowers while committing to neither’s stack.

What institutionalisation has to answer

The point of converting a coordinating office into a permanent entity is that permanent entities can be held to account. AI Malaysia inherits a national AI action plan running to 2030, a procurement coordination mandate that Anwar himself conceded has succeeded only partially, and now a sovereignty question its principal patron has aired in public.

The test of Tuesday’s launch will not be whether 100,000 youths claim their subscriptions by Merdeka. It will be whether the new entity can say, in terms a security official and a hyperscaler can both sign, what data must remain under Malaysian jurisdiction, on whose cloud, and under whose law. The Prime Minister has now asked the question on the record. AI Malaysia exists to answer it.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.