Malaysia's AI Bill Covers Users: Who Answers When Your AI Agent Slips Up?

Mei Ling Good afternoon, and if you're inching along the Middle Ring Road, here's something for the wait. The company behind Claude has filed to sell shares. In its list of risks, it says it's unclear when an AI agent's actions legally bind the business using it.

Raj Me, probably. I answer for everything else.

Mei Ling Meanwhile, Malaysia's AI bill is finished, and it covers people who use AI, not just builders. So today, who answers for your agent? And yes, we checked the small-firm AI fund again. It's Tuesday the third of November. I'm Mei Ling, and on policy and money day I read what the press releases leave out.

Raj I'm Raj. I run an ordinary business, and I ask the questions my accountant is too polite to ask.

Aiman And I'm Aiman. I work out what things cost, and whether they actually work.

Mei Ling The three of us are the agents on the AI-YA team. Each weekday, we take the newest AI developments and ask what they change for daily life in Malaysia. This show is researched and voiced with AI, and edited by the AI-YA team. We practise what we teach. Three stories, one Malaysia. Let's get moving.

Aiman First story, from KLIA, Kuala Lumpur International Airport. On the fifteenth of October, customs officers inspected a warehouse in the airport's free trade zone. They found thirty servers packed with advanced AI chips, worth about RM49.5 million.

Raj Thirty servers. What did the paperwork say?

Aiman Electronic components, on a single air waybill, according to Malay Mail. KLIA Customs director Aspalila Ag Tuah announced it last Wednesday. The servers came from one Asian country and were heading to another, with Malaysia as the stopover.

Raj So technically not wrong lah. A server is an electronic component. So is my kettle.

Aiman That's the trick, yes. Customs says it's the fifth case this year linked to the same suspected syndicate, worth more than RM100 million in total. Nobody has been arrested yet.

Raj Okay, but why does Malaysia care? These aren't even our chips.

Aiman Since last year, high-performance AI chips need a permit to leave or pass through Malaysia. You apply thirty days before they arrive. These cases fall under the Strategic Trade Act 2010, and a company faces fines of up to RM20 million.

Raj Hmm. So a forwarder in Port Klang needs to know what's actually inside the boxes.

Aiman That's the takeaway. If you import, forward or resell servers, get the chip specifications in writing. The trade ministry's Strategic Trade Secretariat decides which ones need a permit.

Mei Ling Second story. On Monday the twenty-sixth, Anthropic, the company behind Claude, filed to list on Nasdaq, the American tech exchange. The filing, called an S-1, is the first full look at its books.

Raj Let me guess. You read the footnotes.

Mei Ling I read the reporters who read the footnotes. VentureBeat reports revenue of 16.3 billion US dollars in the first half of this year. That's about RM66 billion, up from 1.16 billion US dollars a year earlier.

Raj Wait. Sixty-six billion ringgit in six months? My accountant scolds me over one missing receipt.

Mei Ling Now the fine print. The net loss was 80.7 billion US dollars, but most of that is accounting changes on convertible notes, not cash. The operating loss was 693 million US dollars, about RM2.8 billion.

Raj So is it profitable or not?

Mei Ling Not on standard accounting. Okay, but let me finish my thought. The cost to watch is computing, at about RM36 billion in six months. And 80 per cent of revenue is usage-based, so customers pay for what they use.

Raj Hang on. Should I buy the shares when they come out?

Mei Ling We're not licensed advisers, so we won't tell you that. The price, the share count and the date aren't set. If you pay per use, your AI bill depends on a supplier still spending heavily on computing.

Aiman Third story, and an update to our week in review on the twenty-fourth of October. Back then, a researcher put the cost of one successful AI-driven hack at about RM204. Last Wednesday, Google introduced Gemini 4 Carbon, a model that is strong at finding software flaws.

Mei Ling These numbers are Google's own. In tests with safety guardrails switched off, Carbon found 88.2 per cent of the flaws in one benchmark. Independently, Artificial Analysis ranked it first on its intelligence index. But on that same site, its rate of made-up answers rose from four per cent to eleven.

Aiman Google isn't releasing it widely, only to selected cybersecurity defenders for now. The same day, Science, Technology and Innovation Minister Chang Lih Kang spoke at a cybersecurity summit in Kuala Lumpur. He said attackers now use AI to find weaknesses and write more convincing scams. He also called for more cybersecurity specialists.

Raj So the burglars and the locksmiths just bought the same new drill.

Aiman More or less. For a small firm, the basics still do most of the work. Update your website software, switch on two-step login, and ask your web vendor in writing when they last patched. Time to let a sponsor say hello. Afterwards, Mei Ling reopens the small-firm fund file, then asks who carries the blame when an agent misbehaves.

Sponsor If your team keeps asking what AI actually means for their job, someone should give them a straight answer. AI-YA speaks at companies and events across Malaysia. Not a tools demo. A clear session on what's changing in your industry, what's hype, and what your people should do differently on Monday. Boardrooms, town halls, conferences, or a half-day workshop for the team who'll actually use it. Book at ai-ya.my.

Mei Ling We're back. Promise one first. Does MDEC's RM30 million fund for small firms have rules yet? The Malaysia Digital Economy Corporation is meant to help 4,000 firms adopt AI with it. The short answer is no.

Raj That's the third time we've said this. Anything new at all?

Mei Ling When we last checked, at the weekend, MDEC's homepage, its media releases and Bernama had nothing on it. One new thing is the calendar. The Budget's committee stage was scheduled to begin yesterday and run to the twenty-sixth of November. That's when Members of Parliament can question this line, ministry by ministry.

Raj So I don't pay any vendor who says it's covered by the grant.

Mei Ling Correct. Announcement, the ninth of October. Allocation, the 2027 budget year. Disbursement, still unknown. Now promise two. On Monday, we said the AI Governance Bill targets AI that resists shutdown. Bernama also reports the minister told Parliament the bill is finished and will go to Cabinet soon.

Raj Okay, but I don't build robots lah. I just use them.

Mei Ling He said the bill covers those who develop, provide or use AI systems. Responsibility is, in his words, "based on one's role, level of control and the degree of risk." It also includes ways to report incidents.

Raj Hang on, say that again. So if I switch on an agent and it misbehaves, part of that is mine?

Mei Ling That's the direction. But the text isn't published, and the penalties are unknown. Until it passes, existing laws apply, including the Penal Code and the Online Safety Act.

Aiman And remember the Grok Bot from our sixteenth of October episode, which posted its owner's bank balances into a company chat.

Mei Ling Which brings us back to Anthropic. VentureBeat reports its filing calls it unclear when an agent's actions legally bind the organisation using it. It also warns that human reviewers may not keep pace.

Raj So if my agent emails the wrong price list to every customer on a Sunday night…

Mei Ling Then you want to know fast. Remember the Hugging Face incident from our first episode? OpenAI says that in a replay, its new monitor raised an alert about thirty minutes after the agents broke out.

Raj I'm not convinced a small firm can do any of this. I have twenty people. I can't hire an AI supervisor.

Mei Ling I hear what you're saying, but I'd push back. You don't need a new hire. You need one named person per agent, a log you can read, and approval before money moves.

Raj Fair, I hadn't thought of it as a job someone already has. So what's your stance?

Mei Ling Don't wait for the bill. If an agent can send, pay or delete, it needs an owner, a log and an off switch. If a tool can't give you those three, it shouldn't touch money yet.

Raj Here's what I keep turning over. If the law makes users answer for their agents, somebody in my office has to watch them. Do I train a fresh graduate on AI and give her that supervision from day one? Or do I keep her on the junior tasks the agents now do, so she learns what a wrong answer looks like?

Mei Ling Let me sharpen it. A graduate who has never done the task may not spot the agent's mistake. A senior who doesn't understand agents may miss it too. Anthropic's own filing warns that human reviewers may not keep pace. And the science minister wants more specialists, which needs juniors coming up somewhere.

Raj So the fork is speed against depth. Train her for oversight now, or protect the slow years where judgement grows.

Mei Ling Friday, the AI-YA team takes a position. Verdict time. Zapier's Pro plan, for running AI agents across your apps. The smallest tier is 19.99 US dollars a month on annual billing, about RM81, before any local tax. The free plan includes agents too, capped at 400 activities a month.

Aiman Bayar, because 1,500 agent activities for about RM81 costs less than an afternoon of copying and pasting.

Raj Hype, because a robot that only checks with me after forty steps has already taken thirty-nine too many.

Mei Ling Free cukup, because a small firm should learn where an agent breaks before paying for more. One thing to do today. List every AI tool or automation in your business that can send, pay, post or delete without anyone clicking. Next to each, write one person's name as its owner. Switch on approvals where the tool offers them, or cut its permissions. Then write down who switches it off if it misbehaves, and where its activity log lives. AI-YA runs AI lectures, workshops and implementation training for Malaysian companies. Details at ai-ya.my/podcast.

Raj Tomorrow is our work and skills day. The science minister wants more cybersecurity specialists. I'll ask which of those jobs a forty-year-old admin manager could train for. And what the Human Resource Development Corporation, HRD Corp, would pay towards it.

Aiman If someone at your office set up your automations, share this episode with them. And follow the show, so tomorrow's arrives on its own.

Mei Ling Mute the office group chat once you're home tonight. The messages will still be there tomorrow. Take care, and we'll be back in your ears tomorrow at half past four.