Governing AI With The ISO42001 Standard
By: Stevie Heong, Technology Advisory Director
Most Malaysian organisations already use AI, but few govern it. Staff paste client data into free chatbots like ChatGPT, teams switch on AI plug-ins (AI assisted minute taker, for instance) without telling IT, and finance managers approve payments on video calls that may not be real. That gap between use and oversight is now a cybersecurity problem and a compliance problem. It may well be a legal one too.
We're number two in the world. Not in a good thing. A Surfshark study reported in April 2026 ranked Malaysia second in the world for deepfake fraud losses, at around US$502 million. Only the USA is ahead of us on this. Malaysia Boleh.
That being said, country is moving into governing AI. Malaysia is advancing its first comprehensive legal framework through the proposed AI Governance Bill, which completed its public consultation phase in July 2026 and to be tabled in Parliament by end 2026/start 2027. Amongst the details include:
Risk tiers. High-risk AI systems would need risk assessments, documentation, internal controls, human oversight and monitoring.
Developers and Deployers. Simply using a vendor's AI tool could still bring obligations. Vibe Coding could be governed by policies, rigorous testing and security hardening.
Incident reporting. AI incidents, possibly including near misses, would have to be reported.
Whichever way you look, we can't escape the fact that AI will be part of our life. Like how Internet is governed, AI will be too.
PKF Avant Edge had started the ISO42001 consulting and certification for several of our clients and we are learning more and more on AI governance as we progress. ISO/IEC 42001 is the first certifiable management system standard for AI. It follows a repeatable ISO structure: policies, roles, risk assessment, controls, internal audit and continual improvement. The difference is that it applies them to risks specific to AI, such as bias, explainability and data quality.
Its requirements line up closely with the proposed Bill: define your role, assess the impact on people, govern the full AI lifecycle, manage AI suppliers and keep evidence. Our long time certification body, SIRIM QAS began certifying against the standard in November 2025.
So how do we start with governing AI? We take the first five steps first.
Build an AI inventory. Include the free tools staff picked up on their own.
Tighten payment verification. Never approve a transfer on a call or video alone. Use call-backs to known numbers and dual approval. Don't even trust the CEO.
Name an owner for every AI system, and make sure the board knows who they are. Accountability promotes focus and wariness.
Map your role as a Developer, a Deployer, or both.
Run a gap assessment against ISO/IEC 42001. If you already hold ISO 27001, much of the groundwork is done. Consult with PKF Avant Edge if you need more help.
AI governance comes down to controls, accountability and evidence, which is familiar ground for accounting and compliance professionals like us. Organisations that act now will prepare for the inevitable coming of the law governing AI.