Terms in AI, software, Malaysian law and EU regulation.

A program that relies on a language model to plan and perform a series of steps towards a goal: it might look up a record, complete a form or call an API. The agent can act only through the tools and permissions it receives, and each step it takes can be recorded.

A data platform that combines the low-cost object storage of a data lake, holding data in open file and table formats, with what a data warehouse offers: transactions, schemas, access control and SQL queries. Apache Iceberg and Delta Lake are open table formats that make this combination possible.

A dataset that is looked after like a product. Someone owns it by name, its structure is documented, its quality figures are published, its access rules are clear and its update schedule is agreed, so other teams can use it without asking how it came about.

A structured test of an AI system on a reference set of questions or documents, scored against criteria agreed in advance: is the answer correct, supported by a source, complete, and does the system decline when it cannot know? It is run before go-live and repeated after any change to the model, prompt or data.

Controls placed around a language model to keep its use inside agreed boundaries: checks on what goes in and comes out, limits on topics, masking of personal data, a permission check before any tool call and approval steps for actions with consequences.

An AI answer that sounds certain but has no support in the sources or in fact. Several measures reduce it without removing it: grounding answers in fetched sources, demanding citations, letting the system admit it has no answer, and tracking how often it happens during evaluation.

A system design where a person checks, corrects or approves what the AI produces before it has any effect. Under the EU AI Act, a high-risk AI system must allow effective oversight by people who have the competence and the authority to step in.

Software that reads incoming documents, from forms and invoices to certificates and scanned letters, works out what each one is and lifts out the data it holds. It combines text recognition, analysis of page layout and language models. Every value it extracts gets a confidence score, and values under the threshold go to a person to check.

A neural network that has learnt from very large volumes of text which word is likely to come next. With that skill it drafts, summarises, sorts and pulls information out of text in many languages, including Malay and English. It is not a reliable store of facts, though: an answer not grounded in your own sources can read well and still be wrong.

How teams keep systems built on machine learning or language models dependable once they are live. It covers version control of models, prompts and data, evaluation that runs automatically, pipelines for deployment, and continuous tracking of quality, cost and response time.

A design where the system first fetches relevant passages from approved sources, for example procedures, policy documents or case files, and the language model then answers from those passages alone. The answer can name the document and section it relies on, and the user’s access rights apply when passages are fetched.

Search by meaning instead of by exact wording. The system turns text into numeric vectors, called embeddings, and finds passages whose vectors lie near the question. It is usually paired with keyword search, since codes, names and section numbers must match exactly.

A way of working that designs and agrees the interface of a system before writing the system itself, usually as an OpenAPI or AsyncAPI specification. Partners, front ends and other systems then connect through APIs that are documented and versioned, never by reading the database directly.

A cloud environment prepared before the first workload arrives: accounts or subscriptions are structured, and identity, networks, policies, logging and the security baseline are already set up. Every later project starts sooner, and controls stay consistent from one project to the next.

A family of IEC standards, IEC 61970, IEC 61968 and IEC 62325, that captures electricity networks, their assets and market messages in a single common data model. Grid operators use it so that their planning, operational and market systems all describe the network alike.

A digital copy of a physical asset, a process or a network, kept current with data from its real counterpart. Teams use it to follow the condition of the asset, to try out a change before making it and to plan maintenance. Without live data, a 3D model is not yet a twin.

An architecture where systems announce events to a broker, facts such as “application received” or “e-Invoice validated”, and other systems pick them up when they are ready. Because systems are decoupled, one of them can be changed or go down while the others carry on.

An open standard for exchanging building information modelling (BIM) data, maintained by buildingSMART and also published as ISO 16739-1. Since version 4.3 it covers infrastructure too, such as railways, roads, bridges, ports and waterways, so asset data moves from design through construction to operation without retyping.

A cloud platform on which integrations are built and run, bringing ready-made connectors, mapping of data, orchestration and monitoring together. Examples include MuleSoft and SAP Integration Suite.

A machine-readable inventory listing every component and dependency inside a piece of software, normally in SPDX or CycloneDX format. When a new vulnerability is published, it tells you straight away whether you are affected. Under the EU Cyber Resilience Act, manufacturers must draw one up for their products.

Cloud services whose data location, day-to-day operation and governing jurisdiction remain in the hands of a chosen country or region. Definitions vary: some national schemes, France’s SecNumCloud for one, also demand explicit protection from the reach of foreign law.

A method for retiring an old system gradually. A facade is placed in front of it, functions are moved one at a time to new services behind the facade, and the old system is switched off when no traffic reaches it any longer. This avoids a single, high-risk cut-over.

A pattern for manufacturing architecture in which one central event broker carries the live state of a plant, ordered from site to area, line and machine. Every system publishes to the broker and subscribes to what it needs there, so systems no longer have to be wired to one another pair by pair.

A security model that grants no trust to a user, a device or a service merely because of its position on the network. Every request must prove its identity, be authorised and be judged on the user, the state of the device and the context, and the access granted covers only the task at hand.

Regulation (EU) 2024/1689, the EU law on artificial intelligence. It treats AI systems according to their risk: a short list of practices is banned, high-risk systems must satisfy demands on data, documentation, accuracy and human oversight, and some systems must be transparent about being AI. The bans took effect on 2 February 2025 and the transparency rules on 2 August 2026; after the 2026 amendment, the Annex III high-risk duties apply from 2 December 2027. It can reach a provider in Malaysia that places an AI system on the EU market, or whose system produces output used in the EU (Article 2(1)). Malaysia’s own National Guidelines on AI Governance and Ethics are voluntary.

Directive (EU) 2022/2557, which strengthens the physical and organisational resilience of critical entities in eleven sectors, from energy, transport and health to drinking water and digital infrastructure. Each Member State identifies its critical entities by 17 July 2026; those entities must then assess their risks and put resilience measures in place.

Regulation (EU) 2024/2847, which sets cyber security rules for hardware and software products with digital elements that are sold on the EU market. During the support period a manufacturer must deal with vulnerabilities, and from 11 September 2026 it must report those actively exploited; most other duties start on 11 December 2027. That can include products a Malaysian manufacturer exports to the EU.

An EU regulation, applicable since 12 September 2025, that sets rules for fair access to data and its use. A user of a connected product may obtain the data the product generates, customers can change cloud or data processing provider more easily, and unfair clauses on sharing data are restricted.

The term the PDPA has used since 1 April 2025 for the person responsible for personal data, replacing the earlier term “data user”. From the same date, a data processor acting for a data controller is bound by the Security Principle. Since 1 June 2025, under the Commissioner’s guidance on breach notification, the controller also binds the processor by contract to report and assist after a personal data breach.

Since 1 June 2025, section 12A of the PDPA requires a data controller to appoint a DPO where its processing reaches the Commissioner’s thresholds: personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000 data subjects, or regular and systematic monitoring. The DPO is resident in Malaysia or easily contactable, is proficient in the national language and English, and is registered within 21 days of appointment.

Regulation (EU) 2022/2554, which has governed digital operational resilience in the EU financial sector since 17 January 2025. Its chapters cover managing ICT risk, reporting incidents, testing resilience and overseeing outside ICT providers, with mandatory clauses in their contracts and a register of information. EU financial entities pass those clauses on to their ICT providers, including providers in Malaysia.

Malaysia’s mandatory electronic invoice, validated through MyInvois by the Inland Revenue Board of Malaysia (IRBM). It came in four phases by annual turnover or revenue: 1 August 2024 (more than RM100 million), 1 January 2025 (more than RM25 million up to RM100 million), 1 July 2025 (more than RM5 million up to RM25 million) and 1 January 2026 (up to RM5 million). Taxpayers with annual turnover or revenue of less than RM3,000,000 are exempt.

The e-procurement system of Malaysia’s Ministry of Finance for government procurement, with online registration for suppliers.

Directive (EU) 2019/882, under which a defined list of products and services must be usable by persons with disabilities: online shops, consumer banking, e-books, and passenger transport websites, apps and electronic tickets, among others. National laws have applied it since 28 June 2025, also to providers outside the EU whose services reach consumers in the EU.

An app foreseen by the revised eIDAS Regulation in which people in the EU store identity data and attestations like diplomas or licences. Users reveal only the data a service asks for and can sign documents with it. Each Member State must issue at least one such wallet, and a wide range of public and private services will be obliged to accept it.

The EU law on personal data, in application since 25 May 2018. Among its principles are purpose limitation and data minimisation; it grants rights to the individuals concerned and imposes duties on controllers and processors, for instance an impact assessment where processing is likely to be high risk. It can apply to an organisation in Malaysia that offers goods or services to people in the EU or monitors their behaviour there (Article 3(2)). Such an organisation generally designates a representative in the EU (Article 27).

A series of international standards on securing industrial automation and control systems. It divides a site into zones joined by conduits, sets target security levels and spells out what asset owners, system integrators and product suppliers are each responsible for.

An EU regulation that makes public services work together across borders. Before introducing or changing a trans-European digital public service, a public body in the EU assesses its effect on interoperability, and public bodies may publish and reuse interoperability solutions on a common portal.

An international standard that sets out how to run an information security management system. Certification shows that an audited system is in place to find security risks, choose controls and keep improving them. FromNine holds ISO/IEC 27001 certification.

An agency under the Ministry of Digital and the Peppol Authority for Malaysia. MDEC is responsible for e-invoicing as part of business digitalisation, while IRBM handles tax reporting and compliance.

Malaysia’s Peppol specification for electronic invoices, presented by MDEC under its National E-Invoicing Initiative. Invoices built to Malaysia PINT travel over the Peppol network between access points.

Malaysia’s national digital identity. A service can accept a MyDigital ID login as one way for users to identify themselves.

The MyInvois Portal and API of the Inland Revenue Board of Malaysia (IRBM), which validate e-Invoices. A business can submit through the portal, from its own systems through the API, or through a Peppol service provider, which IRBM recognises as one option.

Malaysia’s national cyber security agency, placed under the National Security Council. It works with the NCII sector leads on the duties that the Cyber Security Act 2024 (Act 854) gives to NCII entities.

An entity with duties for National Critical Information Infrastructure under the Cyber Security Act 2024 (Act 854), in operation since 26 August 2024. Its duties include risk assessments and audits, compliance with codes of practice and notification of a cyber security incident within six hours of becoming aware of it, with full details within fourteen days.

Directive (EU) 2022/2555, the EU cyber security directive for essential and important entities, for example in energy, health, transport, public administration and digital infrastructure. Those entities must manage cyber risks, secure their supply chain and report significant incidents: first an early warning within 24 hours, then a notification within 72 hours. Each Member State applies it through its own law, so details vary. A Malaysian supplier usually meets NIS2 through its EU customer’s contract. Certain digital providers without an EU establishment, such as cloud and managed service providers, designate a representative in a Member State (Article 26).

An EU system set up by the Single Digital Gateway Regulation. At the explicit request of a citizen or company, public authorities in different Member States exchange official evidence directly, so people need not hand in papers a government already has. The obligations have applied since 12 December 2023.

A global network, with its own specifications, through which businesses exchange invoices, orders and other structured documents via certified access points. MDEC is the Peppol Authority for Malaysia, where the national specification is Malaysia PINT. Within the EU, Belgium has made structured e-invoices between businesses compulsory since 1 January 2026, using Peppol as the standard route.

Malaysia’s data protection law, Act 709, as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727). It covers the processing of personal data in respect of commercial transactions and does not apply to the Federal and State Governments. The amendments came into operation in three stages, on 1 January, 1 April and 1 June 2025.

The authority for personal data protection under the PDPA, supported by the Department of Personal Data Protection (JPDP), a department of the Ministry of Digital. Since 1 June 2025 a data controller notifies a personal data breach to the Commissioner, within 72 hours under the Commissioner’s guidance, and tells affected data subjects within seven days of that notice where significant harm is likely.

The policy document of Bank Negara Malaysia (BNM) on technology risk for financial institutions. The revised version has been in effect since 28 November 2025. Capital market intermediaries follow a separate text, the Guidelines on Technology Risk Management of the Securities Commission Malaysia (SC).

Guidelines from the W3C for making web content accessible, set out as success criteria at three levels: A, AA and AAA. Procurement rules and laws usually aim at level AA; WCAG 2.2 is the current version, and the European standard EN 301 549 builds on it.