Skip to main content
FromNine
Menu

Insights

Notes from engineers who build AI for regulated work.

Our engineers write here about questions an organisation in Malaysia is likely to face: how an accountable officer keeps the final say over an AI agent, how a search answer can cite its source, how MyInvois and Peppol fit one ERP, and what EU acts mean for a supplier in Malaysia.

For decision makers and engineers in Malaysia, with every source linked so you can check it.

All articles
7 articles
Topics
Platforms · Architecture · Cloud · AI agents · Public sector · AI engineering · Data

FeaturedPublic sector / AI engineering

The EU AI Act for public bodies: what a Malaysian AI provider must prepare by December 2027

Public bodies in the EU that deploy high-risk AI face their heaviest duties from 2 December 2027, while the bans, the literacy duty and the transparency rules already bind them. This article sets out the 2026 amendments, what an EU public deployer must do, and what a Malaysian company supplying AI to such a body has to prepare: the reach of Article 2, an authorised representative in the Union and the documentation the deployer’s impact assessment relies on.

FromNine editorial team9 min read

More articles

  1. Platforms / Architecture

    MyInvois e-Invoicing and Peppol: one ERP for Malaysia and EU buyers

    Since 1 January 2026, the fourth e-Invoice phase applies in Malaysia, with each e-Invoice validated through the MyInvois Portal or API. Peppol enters from two directions: through Malaysia PINT and submission via a Peppol service provider, and through EU buyers whose own rules require structured invoices for supplies between Member States from July 2030. What applies, how the networks work, and how to feed both from a single ERP.

    FromNine editorial team8 min read

  2. Architecture

    Selling digital services to EU consumers: the European Accessibility Act

    Online shops, banking and payment apps, e-books and passenger ticketing aimed at consumers in the EU have had to be accessible since 28 June 2025, whichever country the provider works from. For a Malaysian company with EU customers, this article explains what is covered, what a compliant website or app looks like, where Member States differ, and why accessibility belongs in the delivery process rather than in a final audit.

    FromNine editorial team9 min read

  3. Architecture / Cloud

    NIS2 for Malaysian software and managed service providers

    NIS2 obliges essential and important entities in the EU to secure their supply chain, and holds their management to account for it. A Malaysian software house or managed service provider usually meets the directive through its customers’ contracts, and sometimes directly. What the directive asks, how it reaches a supplier in Malaysia, and how its 24-hour early warning sits beside the six-hour notification that applies to NCII entities under Malaysia’s Cyber Security Act 2024.

    FromNine editorial team9 min read

  4. Cloud / Architecture

    DORA for Malaysian IT providers serving EU banks and insurers

    DORA makes operational resilience a set of enforceable duties for banks, insurers and other EU financial firms, and most of those duties reach their IT suppliers by way of the contract, wherever the supplier sits. What the regulation demands, what the first designations of critical providers mean, what a provider in Malaysia should have ready, and how this sits beside Bank Negara Malaysia’s RMiT and the SC guidelines at home.

    FromNine editorial team10 min read

  5. AI agents / Public sector

    AI agents and the actions a person must approve

    An AI agent that calls tools can change records, send messages and queue payments. The design work lies in deciding which of those actions it may finish alone and which wait for an accountable officer. A tiered method to place approval gates, enforce them in your systems and relax them only when the records justify it.

    FromNine editorial team10 min read

  6. AI engineering / Data

    Knowledge search a compliance team can rely on

    An assistant that replies from your organisation’s own files is quick to demonstrate and slow to earn trust. Picture a compliance team working through BNM policy documents, SC guidelines and its own procedures. It needs answers that respect access rights, cite the paragraph, reflect the version in force, admit when nothing reliable exists, and keep being measured after launch.

    FromNine editorial team7 min read