The EU AI Act for public bodies: what a Malaysian AI provider must prepare by December 2027

01Where the AI Act stands in late 2026

Regulation (EU) 2024/1689, the AI Act (opens external site), entered into force at the start of August 2024, with its parts applying in phases. A July 2026 amending act, known as the Digital Omnibus on AI and published as Regulation (EU) 2026/1744 (opens external site), moved the high-risk dates back and changed a number of other articles. It took effect on 27 July 2026, shortly ahead of the date on which the high-risk rules would first have applied.

So some duties are already live, a further set arrives in December 2026, and the most demanding ones for public deployers come in December 2027.

The Omnibus also rewrote the AI literacy article. Providers and deployers are now obliged to support their staff’s AI literacy through measures, instead of guaranteeing that staff reach an adequate level. The duty survives; the proof expected of you has changed. Training that fits each role, and attendance records, remains the sensible response.

02When the Act reaches a provider in Malaysia

The AI Act is not limited to companies inside the EU. Article 2(1)(a) brings in providers that place AI systems on the EU market or put them into service there, wherever they are established. Article 2(1)(c) adds providers and deployers located in a third country where the output of their AI system is used in the Union. A Malaysian software company that develops a system for an EU public body, or operates a service whose output an EU agency relies on, may therefore be a provider under the Act.

For high-risk systems, a provider established outside the Union must, before making the system available on the EU market, appoint by written mandate an authorised representative established in the Union (Article 22). The representative keeps the provider’s documentation at the disposal of the authorities and cooperates with them.

At home, Malaysia’s National Guidelines on AI Governance and Ethics (AIGE) are voluntary guidance, and the National Artificial Intelligence Office (NAIO) was launched under the Ministry of Digital on 12 December 2024. Neither changes what an EU public body will ask of you. Those requirements come from EU law and apply because of where the system is used.

03Provider or deployer?

An EU public body is usually a deployer, using an AI system under its own authority. Whoever develops a system, or has one developed, and places it on the market or puts it into service under its own name is the provider. A Malaysian company that builds and supplies the system is usually the provider; so is a public body that has a system built to its own specification and runs it under its own name.

Roles can move. Article 25 turns a deployer into a provider when it substantially modifies a high-risk system, or repurposes a system in a way that makes it high-risk. Put the intended roles in the tender documents and the contract, so that neither side learns of them from an auditor.

04Which uses count as high-risk?

Annex III names the areas where AI systems count as high-risk. For public bodies, these matter most:

• Public services and benefits: deciding who is eligible, and granting, cutting, withdrawing or recovering benefits and services.
• Migration, asylum and borders, policing and the courts.
• Education and training: admissions, grading of learning outcomes, and monitoring during examinations.
• Work: hiring, promotion, allocating tasks and monitoring staff, since public bodies employ people too.
• Critical infrastructure: components that keep digital networks, roads and utility supply safe.

An Annex III area does not settle the matter. Article 6(3) excludes a system whose risk of harm is not significant, for example because it handles a narrow procedural step, refines a result a person has already produced, spots patterns without replacing human judgement, or does preparatory work. Any system that profiles people stays high-risk. A provider or body relying on the exclusion should write down why.

Plenty of useful tools fall outside high-risk altogether: drafting help, internal knowledge search, translation, summaries. The GDPR and the transparency rules still reach them, but the high-risk obligations do not.

05What an EU public deployer must do, and what it needs from you

From 2 December 2027, an EU public body using an Annex III high-risk system carries the duties of Article 26 (opens external site). In summary:

• Run the system the way the provider’s instructions describe, with suitable technical and organisational measures.
• Give oversight to competent, trained people with the authority to act, and support them.
• Make sure input data under its control fits the purpose and represents the cases the system will meet.
• Monitor performance and warn both provider and authorities without delay about risks and serious incidents.
• Retain the logs the system generates automatically for six months at least, unless other EU or national law sets a different period.
• Tell workers’ representatives and the staff concerned before a high-risk system is used in the workplace.
• Record its use in the EU database before going live, which public authorities must do (Articles 26(8) and 49); a system not registered may not be used.
• Inform individuals when a high-risk system decides, or helps decide, something about them (Article 26(11)); Article 86 gives them a right to an explanation.

Several of these duties depend on the provider. The deployer cannot follow instructions for use it never received, keep logs it cannot reach, or report a serious incident the provider did not tell it about. Expect each of these to appear in the contract.

The fundamental rights impact assessment

Article 27 (opens external site) obliges public-law bodies, and private firms that deliver public services, to assess the effect on fundamental rights before deploying most Annex III systems for the first time; systems for critical infrastructure are left out. The assessment sets out:

1. 01the procedures in which the system will be used, consistent with its purpose;
2. 02how long and how often it will be used;
3. 03which people and groups it is likely to affect;
4. 04the particular risks of harm to them;
5. 05how human oversight works in practice;
6. 06what happens when a risk materialises, including governance and complaint routes.

The deployer sends its findings to the market surveillance authority. Because the work overlaps with the DPIA required by GDPR Article 35, run the two side by side and reuse what you can. The AI Office is due to provide a template questionnaire under Article 27(5); find out whether it exists before designing your own. Some national methods exist already, the Dutch IAMA (Impact Assessment Mensenrechten en Algoritmes) among them.

The deployer writes the assessment, but much of its input comes from the provider: the intended purpose, known limitations, the populations the system was tested on, and how oversight is built in. A Malaysian provider can prepare that material once, as part of its technical documentation, so that each EU client’s assessment starts from facts rather than from a blank questionnaire.

06Transparency duties in force today

Since 2 August 2026, Article 50 has bound both sides. A provider builds conversational systems so that users know they face AI, unless it is self-evident, and labels synthetic output in a form machines can detect. A deployer discloses deepfakes. It also discloses text that AI wrote or altered when the text informs the public on public-interest matters, except where a person reviewed it and editorial responsibility is held.

Public bodies meet this most often with a chatbot on their website or in a service channel. The chatbot should identify itself as AI, state the limits of what it handles, and hand over to staff on request.

07A preparation plan for 2026 and 2027

1. 01Take stock now. Record each AI system already running or being bought, including AI features in platforms already licensed, with owner, purpose, provider, data and the people affected.
2. 02Classify by early 2027. Sort each system into banned, high-risk (keeping the Article 6(3) reasoning), transparency-only or minimal-risk, and note whether you are its provider or deployer.
3. 03Settle the provider’s role. A provider outside the Union appoints its authorised representative, prepares the technical documentation and decides how logs and incident information reach each deployer.
4. 04Fix contracts during 2027. Deployers require the instructions, the conformity papers and log access, and write the provider’s help with the impact assessment and with incident reports into the contract.
5. 05Design oversight. Appoint the overseers, train them, let them override and escalate, and counter automation bias; our article on AI agents and the actions a person must approve shows one way.
6. 06Log and monitor. Retain logs for no less than six months, and agree what a serious incident is and who files the report.
7. 07Before go-live. Finish the rights assessment alongside the DPIA, make the EU database entry, and notify staff and those affected.
8. 08Keep literacy current. Role-based courses for operators, reviewers and officials who decide, refreshed after system changes, with attendance kept on file.

08Penalties and enforcement

Penalty rules are set by each Member State. Article 99(8) leaves each Member State to decide if, and to what extent, its own public authorities can be fined; the provision says nothing about their providers. That is no argument for delay. Supervisors can still demand corrections, and a public decision that nobody can explain or contest loses its legitimacy.

09What to watch in the coming months

• Commission guidance under Article 6(5) on what counts as high-risk, next to the existing guidelines on prohibited practices (opens external site).
• Harmonised standards for the high-risk requirements, the main route by which providers will show conformity.
• The supervisors each Member State appoints, and the first guidance they give public deployers.
• The AI Office’s questionnaire template for the rights impact assessment.

The Commission’s AI Act Service Desk (opens external site) maintains the official timeline and explanations per article. Bookmark it, and put a date on each internal memo about the Act, since the text keeps changing.