Can Malaysia be more than an AI landlord?

Johor is drawing some of the biggest data-centre money in the world. AWS alone has committed US$6.2 billion. Oracle has committed US$6.5 billion. Counting everything approved so far, more than RM140 billion (about US$30 billion) is coming into Malaysian data centres and cloud.

For scale: by the end of 2026, all of Malaysia's data centres together will draw about two gigawatts of power, a few percent of the world's total at most. The growth is the story: Malaysia and India together accounted for more than half of Asia-Pacific's new data-centre capacity in the second half of 2025.

Sort that money by what it buys, and nearly all of it buys land, power and chips. Malaysia is becoming a landlord of the world's AI. We are building the ground a slice of the world's AI runs on and renting it out; the intelligence itself, we buy from abroad. And the position is shakier than the headlines suggest. At home, the boom is straining the power and water it depends on. Abroad, the chips that fill the halls arrive only with another country's permission.

The rent is paid in power and water

Being a landlord does pay well. KPMG projects the data-centre wave could add about RM139 billion of output and 30,900 jobs by 2030, and the construction sites are still hiring.

A finished data centre, though, runs on about 30 to 50 staff, many of the specialists flown in; the construction jobs leave with the cranes. AMRO, the ASEAN+3 macroeconomic surveillance office, put it plainly in July 2026: the boom strains Malaysia's power, water and talent while capturing limited domestic value.

The strain has started to show up in government decisions. Data centres could take up to 40% of Johor's electricity demand by 2035. The state rejected up to a third of new applications in 2024 because the grid could not carry them. And the thirstiest water-cooled projects have been told to wait until mid-2027, because people need the water first.

Malaysians are already arguing about whether this is a good deal. Free Malaysia Today calls the backlash "loud, popular and wrong"; Murray Hunter tallies the hidden costs. Both point at real numbers: the tenant brings his own senior staff, and the rent comes partly out of the power and water the landlord's own family uses.

The chips arrive on permission

The second catch is harder to fix. The most valuable thing in those halls, the chips, reaches Malaysia only with Washington's permission.

The paper trail is short. In the space of seven months in 2025, Washington put Malaysia in a restricted tier for advanced GPUs, scrapped the rule, then drafted a replacement aimed specifically at Malaysia and Thailand, to stop chips leaking onward to China. Malaysia moved in step: since July 2025, re-exporting US AI chips requires a Strategic Trade Permit from the trade ministry. Enforcement is real; in June 2026, customs seized about US$13 million of falsely declared AI chips at KLIA.

The pressure runs both ways. In May 2025, a deputy minister launched "sovereign AI" servers built on Huawei's Ascend chips, the Chinese alternative. The White House's AI adviser criticised it publicly, and within days the launch was retracted; Huawei said it had not sold the chips here at all. Hosting both superpowers is a balancing act: lean visibly toward either side's stack, and the other can make its displeasure expensive.

As a place to build data centres, Malaysia's advantage is real and lasting. The supply of chips to fill them is different: it arrives on a permit, and the permit's terms changed three times in 2025 alone.

The thin part is the thinking

Above the ground, the picture thins fast.

Malaysia does hold one rung up the stack: chips. Penang and Kulim handle about 13% of the world's chip assembly, testing and packaging, the strongest evidence against the landlord story anywhere in the economy. The margins tell it: Malaysian plants do the assembly at 15 to 20%; the owners of the advanced-packaging designs earn 40 to 50. The RM12 billion Penang site that is the world's largest advanced-packaging facility belongs to Intel, and it is American-owned.

The software layer above it is thinner. The AI-native software companies of real size, you could count on one hand. Respond.io, out of KL, is the standout: customer-conversation software rebuilt around AI agents, a US$62.5 million Series B in June 2026, on US$35 million of annual recurring revenue by its own count. Everyone cites it, because no other venture-funded, AI-native software company here comes anywhere near its size.

KAIN, a volunteer industry consortium that keeps the fullest public directory of the scene, lists 123 organisations across sixteen categories as of July 2026. The count flatters the picture. Several are foreign-built products that happen to be Malaysian-owned, and most of the rest apply AI rather than build it: the largest category, AI products, holds 28 members; computer vision, 13. The category for companies that build their own models holds three names. Plenty of organisations here use AI, and almost none build it.

Among Malaysia's listed companies it is starker still. As far as I can tell, only one has put a ringgit figure on its AI revenue in its own filings: SRKK, at RM11.8 million, about a tenth of its revenue, disclosed in its 2026 listing prospectus. The biggest AI announcement the exchange has seen, a US$1 billion "AI Park" with China's SenseTime, lapsed in 2022 without a building.

The Malay-model efforts make the point sharpest. ILMU, the flagship, was trained locally by YTL, a conglomerate better known for power and construction, working with Universiti Malaya. Gamuda, another construction group, shipped its own model in May 2026. And the most credible independent effort, Mesolitica's MaLLaM, trained from scratch with openly published weights, is a tiny team that raised about RM50,000 of crowdfunding in 2019 and survives on consulting. Not one of them is a venture-backed AI company.

The thing to watch in this thin layer is new money with a new mandate. Khazanah seeded Jelawang Capital with RM1 billion as a national fund-of-funds and anchored First Move, a fund built explicitly for AI-native startups. So far the flagship rounds have kept going to chip designers and infrastructure; where the new cheques land will tell us whether this layer thickens.

Malaysia is not without cards. Most of them, though, are also rented. The chip packaging: the work happens here, but the designs belong to others. The English-speaking back offices, a RM28 billion sector: real jobs, but India and the Philippines offer the same at bigger scale. What cannot be found elsewhere is a short list: a society that lives in several languages at once; the most developed Islamic-finance system in the world; and working national rails like DuitNow and MyInvois that most richer countries have not managed to build.

The moat is the last mile

When code and models are cheap, the defensible work is the last mile: the finishing work that gets a product over the last bit of friction and into someone's habits, the part a generic model will not cheaply do.

The cleanest example in the country today is Ryt Bank's "Pay with a snap". You photograph a bill; the AI reads it and fills in the payee, the amount and the reference; you check and confirm. It is ordinary technology, optical character recognition feeding a form, and it earns its keep by killing one real, daily pain: typing a 16-digit account number, or hunting a JomPAY biller code, on a phone, without a typo. The bank says nearly half its customers have used the AI, and that those who do come back to the app at almost twice the rate.

DuitNow QR made the same move at national scale: where a merchant once displayed a different QR code for every wallet, one standard collapsed them into a single sticker, and PayNet counted more than three million acceptance points in 2025. Amazon's 1-Click was the same insight two decades earlier. Every one of them got adopted because it removed the right friction.

The Malaysian version of the last mile is everything a foreign product will not bother to get right for a market of 34 million people. Filing invoices through MyInvois, now that e-invoicing is mandatory. Keeping a bank's customer data inside PDPA and Bank Negara's rules. Serving a customer who switches between Malay, English and Chinese in a single conversation. None of it is glamorous. All of it decides whether software actually gets used here. A builder in KL will walk those miles long before a San Francisco lab bothers to.

The bet only Malaysia can make

Here is the specific opening I would put money on.

A frontier-model race in the Muslim world would be brutal to win from here. Saudi Arabia's HUMAIN has the Public Investment Fund's US$100 billion behind it; the UAE has shipped serious Arabic models for years. Matching that spend is not a realistic plan, and trying would be the vanity project people accuse sovereign AI of being.

But there is a question nobody on earth can yet answer with authority: is this AI actually Shariah-compliant? No accepted standard exists for certifying an AI system the way food gets certified halal. A real certificate would check specific things: that a bank's assistant does not steer a customer who asked for a compliant product into an interest-bearing one, and that an answer written in the register of a religious ruling traces to recognised sources instead of a model's blended guess. And because a model changes in ways a recipe does not, the checks re-run at every update. Halal certification already works like this: JAKIM audits the kitchen and the supply chain rather than tasting one plate.

The buyers are not hypothetical, either. Islamic finance is a roughly US$6 trillion system that already runs on certification, and its centre of gravity is here in Southeast Asia, next door to Indonesia's 243 million Muslims.

Malaysia holds the institutions a standard needs: JAKIM, whose halal stamp is recognised worldwide; the Shariah Advisory Councils at Bank Negara and the Securities Commission, whose rulings already bind Islamic banking and the capital markets; and INCEIF, the central bank's Islamic-finance university, whose research academy ISRA produces much of the field's reference scholarship. The play has a template, too: AAOIFI, a standards body in Bahrain, wrote the accounting rules for Islamic finance and saw them adopted across more than 45 countries without ever running a bank. The opening is to become the certifier of the world's Islamic AI, the way Malaysia already certifies so much of the world's halal food. A lab cannot credibly certify itself, which is why the seat is still open.

The risk is moving carelessly and losing the seat. Malaysia's first product in this space, NurAI, is marketed as a Shariah-compliant model. Under the hood, it is a fine-tune of China's DeepSeek: someone else's model, adjusted at the edges. And so far, the standard-setting conversations have gathered around that single product. The certifier role only works from neutral ground. A standard tied to any one company's model is a standard its rivals will not adopt, and neutrality is exactly what makes the halal stamp worth carrying. The standard needs a home across JAKIM, the Shariah councils and INCEIF, and it needs to get there before Riyadh, Abu Dhabi or an OIC body claims the ground.

Sovereign AI is insurance

The phrase "sovereign AI" invites eye-rolling, usually deserved. So here is the unromantic case. Running your critical systems on foreign AI leaves two things in a foreign government's hands — the switch and the data — and 2026 has already supplied a live demonstration of each.

First, the switch. On 9 June 2026, Anthropic launched Claude Fable 5, its most capable model. Three days later, the US Commerce Department ordered access suspended for every foreign national in the world, including Anthropic's own foreign staff. The order took effect immediately, and the company complied. Access returned on 1 July.

Read that from Kuala Lumpur: the most US-aligned lab in the world, on US soil, had its flagship switched off by its own government, and every non-American with critical work running on it lost access for nearly three weeks, with no notice, over something that had nothing to do with them. Any bank, hospital or ministry whose core service is an API call to a US lab is exposed to that exact mechanism, whatever its own conduct.

Second, the data. Under the US CLOUD Act, a US-headquartered provider must produce data in its control no matter where in the world it is stored; Section 702 of FISA extends the reach for intelligence collection. A Malaysian bank running customers through a US model can have those conversations compelled by a foreign court, and can neither block it nor, in most cases, know it happened. Data sovereignty is decided by court orders, and a US court order reaches a US provider's data anywhere on earth.

Malaysia already owns one working answer. Ryt Bank runs its customers' AI on ILMU, a model hosted in Malaysia: 1.2 million users in about seven months. It is the one shipped, regulated case of the model layer staying home. The fine print: compute, model and bank all belong to one group. Nearly the whole Malaysian sovereign-AI story runs through YTL today, and if it stumbles there is no domestic understudy; Budget 2026's RM2 billion sovereign AI cloud under MCMC is the start of a second leg.

None of this requires pretending Malaysia can own the whole stack. Chips and fabs are out of reach for an economy our size, and nobody owns everything anyway; even the United States depends on Taiwan for its most advanced manufacturing. The realistic version is narrower: own the model, the hosting and the data for the systems the country cannot afford to lose — banking, government, defence — and rent everything else. Swapping in Chinese hardware is not a way out either; the Huawei episode showed that door closes just as fast. Owned at that size, a national model is insurance, and 2026 showed exactly what it insures against.

More than a landlord

The stakes are already here. TalentCorp says 697,000 jobs are at risk within five years without retraining. Scam takedowns jumped from about 6,300 in 2023 to 98,500 in 2025, and 85% of victims were pulled in by AI-made endorsement videos, some deepfaking the King. For most Malaysians, AI showed up as fraud before it showed up as productivity. That, more than any strategy paper, is why the AI law is being rushed.

So weigh the two sides. One is land, power and chips: good money, but everything valuable in it belongs to someone else, and the chips come on a permit someone else signs. The other side is smaller, and it is ours to keep: the last miles no foreign product will walk, the certification seat nobody has filled, the handful of systems that should run on models kept at home. Only the second side compounds.

The rent is worth collecting; it is real money. But it is earned on other people's ideas. The durable game is owning a piece of the intelligence, and for anyone building from here, that starts with a last mile worth owning. The ground, we are already renting out.

What I am watching

• Whether domestic money reaches AI-native software. Where First Move and Jelawang's cheques land will say more than any blueprint.
• Whether the US moves the chip leash again: another Malaysia-specific rule, or another Fable-style switch-off.
• Whether Shariah-AI certification finds a neutral home across JAKIM, the Shariah councils and INCEIF, or stays attached to a single vendor.
• Whether the boom's utility bill comes due. The water pause runs to mid-2027; the 40%-of-Johor's-grid projection is dated 2035.

Personal analysis on public reporting; not affiliated with any company named. Not investment advice.