From Soft-Law AI Ethics to Risk-Based Public Sector AI Procurement: Recalibrating Malaysia’s Post-PDPA Governance Model

Public-sector artificial intelligence (AI) is increasingly acquired through procurement rather than developed entirely in-house. This shifts a central governance question from whether public institutions endorse ethical principles to whether those principles become enforceable duties across the system life cycle. Malaysia has introduced national AI governance and ethics guidance and public-sector AI adoption guidance, while the Personal Data Protection (Amendment) Act 2024 recalibrates parts of the data-protection framework. Yet privacy compliance and high-level ethical principles alone cannot fully govern the acquisition and operation of AI used in public administration. This article asks how Malaysia can translate soft-law principles and existing legal duties into procurement controls proportionate to risk. Using doctrinal legal analysis and functional comparison with the European Union’s AI Act, the OECD AI Principles, UNESCO’s Recommendation on the Ethics of AI, Canada’s Directive on Automated Decision-Making, and the NIST AI Risk Management Framework, it develops a normative Risk-to-Contract Accountability Framework (RCAF). The framework links risk classification to six controls: pre-award disclosure; impact assessment; contractual auditability; contestability and human review; incident reporting and material-change control; and continuing monitoring, remedies, and exit. The contribution is not a claim that AI procurement has never been studied, but a Malaysia-specific legal design connecting governance principles to the contract as a practical instrument of public accountability. The article argues that procurement should allocate responsibilities before deployment, preserve the authority’s ability to scrutinise supplier claims, and prevent contractual arrangements from insulating consequential decisions from review.