THERE seems to be a rush among some in Malaysia to be first to import robots and humanoids.
Announcements by companies are increasingly being heard and are likely to get more active in months ahead. No doubt, many of these products do raise productivity and enable organisations to reduce their labour requirements.
The global trend, especially in China, where most of these products are being made, is that the robots are moving from controlled industrial settings into warehouses, shops, hospitals, public spaces and potentially homes.
The regulatory challenge is that they combine a physical machine, an artificial intelligence (AI) decision-maker and a connected surveillance device – creating risks related to injury, cybersecurity, privacy and liability that are still not fully known.
So, how are more advanced economies dealing with these risks, from a regulatory standpoint?
Most are not really creating specific regulations for these products, instead putting emphasis on product safety, ensuring that there is always human oversight, ramping up cybersecurity and data protection rules.
There are also regulations regarding traceability and accountability. This is where event logs, records of software versions and remote commands, post-market monitoring, mandatory reporting of serious incidents and clearer liability among all those involved in bringing these machines into the market.
Some of the rules are also tiered based on the levels of risks – a robot in a fenced factory is treated differently from one operating near customers, children, patients, elderly persons, or the public.
Europe is furthest ahead. The European Union (EU) AI Act can classify AI-enabled robots as high-risk, requiring risk management features to be built in.
The EU Machinery Regulation adds specific coverage for autonomous machinery and AI-related safety functions, while the Cyber Resilience Act makes cybersecurity a product-safety obligation for connected devices.
Malaysia does not yet have a stand-alone legal regime specifically for humanoid or general-purpose autonomous robots. It does have relevant laws and regulators, but the system remains fragmented and seems less mature than the emerging EU model.
That said, there are safeguards in place. For example, employers deploying robots in factories, warehouses, hotels, hospitals, or other workplaces must manage occupational risks.
The Department of Occupational Safety and Health, a government agency under the Human Resources Ministry, has developed robotics-industry OSH guidance, while the amended Occupational Safety and Health Act framework reinforces duties such as risk assessment and incident management.
In addition, the Domestic Trade and Costs of Living Ministry can act against unsafe products, including through product recalls or prohibitions.
However, this is more useful after a safety problem appears rather than as a purpose-built pre-sale approval system for humanoids.
Malaysia also issued National Guidelines on AI Governance and Ethics in 2024, centred on safety, reliability, privacy, transparency, accountability, fairness and human-centredness. But these are guidance rather than a compulsory robot-specific safety law.
In terms of data protection, the amended Personal Data Protection Act 2010 or PDPA treats biometric data as sensitive personal data and strengthens breach-notification requirements.
This matters when robots use cameras, microphones, facial recognition, or cloud-based analytics.
One could also argue that existing product and equipment standards can address electrical, radio, and communications issues. However, they do not fully address autonomous movement, human contact, AI failure, or remote takeover.
The principal weakness is that Malaysia does not yet appear to require a unified, compulsory pre-market assurance process for a humanoid that may move autonomously among people.
There are some crucial gaps. For example, there is no clearly defined certification specifically for humanoids relating to their dynamic movement, collision avoidance, or safe human contact.
There should also be some kind of ruling relating to how these products should have emergency stop features or human override functions, or limits on speed and force.
Should we also be looking into having a dedicated cybersecurity-by-design obligation comparable to the EU Cyber Resilience Act?
The importers and distributors of these products should also be forced to report serious robot accidents, near misses or loss-of-control events.
More safety rules are also needed when these robots operate around vulnerable people.
Then there are the liability issues.Should we be looking at compulsory insurance, operator licensing or a comprehensive liability regime for higher-risk deployments?
What about a legal framework that clearly allocates responsibility between the Chinese maker of the humanoids, the Malaysian importer and distributor, the local integrator or employer and end user?
The local distributor should be able to show proof of independent safety testing against recognised robotics standards.
These products also need to be tested against Malaysian operating conditions, including crowded environments, tropical heat, humidity and language use.
Of course having too many regulations can impede Malaysia’s technological advancement enabled by robotics.
What we need is a risk-tiered “physical AI” framework. For example, lighter rules for low risk robots and stronger pre-market testing and local accountability for mobile, autonomous, public-facing, high-force, surveillance-capable and workplace humanoids.
Malaysia has the building blocks – OSH, consumer safety, PDPA, technical standards, and AI ethics guidance – but needs to integrate them into an enforceable regime before broad commercial deployment outpaces public safeguards.