Johor is drawing some of the biggest data-centre money in the world. AWS alone has committed US$6.2 billion. Oracle has committed US$6.5 billion. Counting everything approved so far, more than RM140 billion (about US$30 billion) is coming into Malaysian data centres and cloud.
The growth is the story. Malaysia and India together made up more than half of Asia-Pacific's new data-centre capacity in the second half of 2025. By the end of 2026, the data centres Malaysia has approved add up to about two gigawatts of power capacity — roughly a tenth of Peninsular Malaysia's peak electricity demand.
Sort that money by what it buys, and nearly all of it buys land, power and chips. Malaysia is becoming a landlord of the world's AI. We build the ground the world's AI runs on and rent it out; the intelligence itself, we buy from abroad. Rent is good money. Whether it is enough is the harder question.
The rent is paid in power and water
Being a landlord does pay well. KPMG projects the data-centre wave could add about RM139 billion of output and 30,900 jobs by 2030, and the construction sites are still hiring.
A finished data centre, though, runs on about 30 to 50 staff, many of the specialists flown in; the construction jobs leave with the cranes. AMRO, the ASEAN+3 macroeconomic surveillance office, put it plainly in July 2026: the boom strains Malaysia's power, water and talent while capturing limited domestic value.
Data centres could take up to 40% of Johor's electricity demand by 2035.
The strain has started to show up in government decisions. Data centres could take up to 40% of Johor's electricity demand by 2035. The state rejected up to a third of new applications in 2024 because the grid could not carry them. And the thirstiest water-cooled projects have been told to wait until mid-2027, because people need the water first.
Malaysians are already arguing about whether this is a good deal. Free Malaysia Today calls the backlash "loud, popular and wrong"; Murray Hunter tallies the hidden costs. Both point at real numbers: the tenant brings his own senior staff, and the rent comes partly out of the power and water the landlord's own family uses.
The chips arrive on permission
The second catch is harder to fix. The most valuable thing in those halls, the chips, reaches Malaysia only with Washington's permission.
In the space of seven months in 2025, Washington put Malaysia in a restricted tier for advanced GPUs, scrapped the rule, then drafted a replacement aimed specifically at Malaysia and Thailand, to stop chips leaking onward to China. Malaysia moved in step: since July 2025, re-exporting US AI chips requires a Strategic Trade Permit from the trade ministry. In June 2026, customs seized about US$13 million of falsely declared AI chips at KLIA.
The pressure runs both ways. In May 2025, a deputy minister launched "sovereign AI" servers built on Huawei's Ascend chips, the Chinese alternative. The White House's AI adviser criticised it publicly, and within days the launch was retracted. Hosting both superpowers is a balancing act: lean visibly toward either side's stack, and the other can make its displeasure expensive.
As a place to build data centres, Malaysia's advantage is real and lasting. The supply of chips to fill them is different: it arrives on a permit, and the permit's terms changed three times in 2025 alone.
The thin part is the thinking
Above the ground, the picture thins fast.
Malaysia does hold one rung up the stack: chips. Penang and Kulim handle about 13% of the world's chip assembly, testing and packaging, the strongest evidence against the landlord story anywhere in the economy. The margins tell it: Malaysian plants do the assembly at 15 to 20%; the owners of the advanced-packaging designs earn 40 to 50. The RM12 billion Penang site that is the world's largest advanced-packaging facility belongs to Intel, and it is American-owned.
The software layer above it is thinner. The AI-native software companies of real size, you could count on one hand. Respond.io, out of KL, is the standout: customer-conversation software rebuilt around AI agents, a US$62.5 million Series B in June 2026, on US$35 million of annual recurring revenue by its own count. The other AI-native software companies here are an order of magnitude smaller.
KAIN, a volunteer industry consortium that keeps the fullest public directory of the scene, lists 123 organisations across sixteen categories as of July 2026. The list is broad: it counts universities, government agencies and hardware firms alongside the software companies. Look at the local companies building software in the AI space — most are applying AI to sharpen a service they already run. There are some that build genuinely AI-native products, but they stay small and sparse. There is real room to build in this layer, especially in the few areas I highlight in this essay.
The listed market says the same thing from another angle. Bursa has plenty of "AI" tickers, but sort them and most are hardware or e-government firms with an AI line, not AI-software companies — chip-test and machine-vision names, or Zetrix, which rebranded from the e-government group MYEG. As far as I can tell, only one has put a ringgit figure on its AI revenue in its own filings: SRKK, at RM11.8 million, about a tenth of its revenue, disclosed in its 2026 listing prospectus. The biggest AI announcement the exchange has seen, a US$1 billion "AI Park" with China's SenseTime, lapsed in 2022 without a building.
Malaysia does have a few homegrown models. ILMU, the flagship, was trained locally by YTL with Universiti Malaya. Gamuda shipped its own in May 2026. And the earliest and most independent one, Mesolitica's MaLLaM, was trained from scratch with open weights by a tiny team that raised about RM50,000 of crowdfunding in 2019. They are promising and worth watching, but still a novelty.
One thing I am watching is new money coming into this space. Khazanah seeded Jelawang Capital with RM1 billion as a national fund-of-funds and anchored First Move, a fund built explicitly for AI-native startups. So far the flagship rounds have kept going to chip designers and infrastructure; where the new cheques land will tell us whether this layer thickens.
The moat is the last mile
When code and models are cheap, the defensible work is the last mile: the finishing work that gets a product over the last bit of friction and into someone's habits, the part a generic model will not cheaply do. That finishing is what turns a novelty into something people pay for, and I make the fuller case in a separate essay.
The cleanest example in the country today is Ryt Bank's "Pay with a snap". You photograph a bill; the AI reads it and fills in the payee, the amount and the reference; you check and confirm. It is ordinary technology, optical character recognition feeding a form, and it earns its keep by killing one real, daily pain: typing a 16-digit account number, or hunting a JomPAY biller code, on a phone, without a typo. The bank says nearly half its customers have used the AI, and that those who do come back to the app at almost twice the rate.
DuitNow QR made the same move at national scale: where a merchant once displayed a different QR code for every wallet, one standard collapsed them into a single sticker, and PayNet counted more than three million acceptance points in 2025. Amazon's 1-Click was the same insight two decades earlier. Every one of them got adopted because it removed the right friction.
The Malaysian version of the last mile is everything a foreign product will not bother to get right for a market of 34 million people. Filing invoices through MyInvois, now that e-invoicing is mandatory. Keeping a bank's customer data inside PDPA and Bank Negara's rules. Serving a customer who switches between Malay, English and Chinese in a single conversation. None of it is glamorous. All of it decides whether software actually gets used here. A builder in KL will walk those miles long before a San Francisco lab bothers to.
The bet only Malaysia can make
Here is the specific opening I would put money on.
A frontier-model race in the Muslim world would be brutal to win from here. Saudi Arabia's HUMAIN has the Public Investment Fund's US$100 billion behind it; the UAE has shipped serious Arabic models for years. Matching that spend is not a realistic plan, and trying would be its own kind of vanity project.
But there is a question nobody on earth can yet answer with authority: is this AI actually Shariah-compliant? No accepted standard exists for certifying an AI system the way food gets certified halal. A real certificate would check specific things: that a bank's assistant does not steer a customer who asked for a compliant product into an interest-bearing one, and that an answer written in the register of a religious ruling traces to recognised sources instead of a model's blended guess. And because a model changes in ways a recipe does not, the checks re-run at every update. Halal certification already works like this: JAKIM audits the kitchen and the supply chain rather than tasting one plate.
The buyers are not hypothetical, either. Islamic finance is a roughly US$6 trillion system that already runs on certification, and its centre of gravity is here in Southeast Asia, next door to Indonesia's 243 million Muslims.
Malaysia holds the institutions a standard needs. JAKIM's halal stamp is recognised worldwide. The Shariah Advisory Councils at Bank Negara and the Securities Commission already bind Islamic banking and the capital markets by their rulings. And INCEIF, the central bank's Islamic-finance university, houses ISRA, whose scholarship is much of the field's reference work. There is a template, too: AAOIFI, a standards body in Bahrain, wrote the accounting rules for Islamic finance and saw more than 45 countries adopt them. The opening is to become the certifier of the world's Islamic AI, the way Malaysia already certifies so much of the world's halal food.
The risk is moving carelessly and losing the seat. Malaysia's first product in this space, NurAI, is marketed as a Shariah-compliant model. Under the hood, it is a fine-tune of China's DeepSeek: someone else's model, adjusted at the edges. And so far, the standard-setting conversations have gathered around that single product. The certifier role only works from neutral ground. A standard tied to any one company's model is a standard its rivals will not adopt, and neutrality is exactly what makes the halal stamp worth carrying. The standard needs a home across JAKIM, the Shariah councils and INCEIF, and it needs to get there before Riyadh, Abu Dhabi or an OIC body claims the ground.
Sovereign AI is insurance
The phrase "sovereign AI" invites eye-rolling, usually deserved. So here is the unromantic case. Running your critical systems on foreign AI leaves two things in a foreign government's hands, the switch and the data, and 2026 has already supplied a live demonstration of each.
First, the switch. On 9 June 2026, Anthropic launched Claude Fable 5, its most capable model. Three days later, the US Commerce Department ordered access suspended for every foreign national in the world, including Anthropic's own foreign staff. The order took effect immediately, and the company complied. Access returned on 1 July.
Read that from Kuala Lumpur: the most US-aligned lab in the world, on US soil, had its flagship switched off by its own government, and every non-American with critical work running on it lost access for nearly three weeks, with no notice, over something that had nothing to do with them. Any bank, hospital or ministry whose core service is an API call to a US lab is exposed to that exact mechanism, whatever its own conduct.
Second, the data. Under the US CLOUD Act, a US-headquartered provider must produce data in its control no matter where in the world it is stored; Section 702 of FISA extends the reach for intelligence collection. A Malaysian bank running customers through a US model can have those conversations compelled by a foreign court, and can neither block it nor, in most cases, know it happened. Data sovereignty is decided by court orders, and a US court order reaches a US provider's data anywhere on earth.
Malaysia already owns one working answer. Ryt Bank runs its customers' AI on ILMU, a model hosted in Malaysia: 1.2 million users in about seven months. It is the one shipped, regulated case of the model layer staying home. The fine print: compute, model and bank all belong to one group. Nearly the whole Malaysian sovereign-AI story runs through YTL today, and if it stumbles there is no domestic understudy. Budget 2026's RM2 billion sovereign-AI cloud under MCMC, the communications regulator, is the country's first significant step toward building another.
None of this requires pretending Malaysia can own the whole stack. Chips and fabs are out of reach for an economy our size, and nobody owns everything anyway; even the United States depends on Taiwan for its most advanced manufacturing. The realistic version is narrower: own the model, the hosting and the data for the systems the country cannot afford to lose — banking, government, defence — and rent everything else. Swapping in Chinese hardware is not a way out either; the Huawei episode showed that door closes just as fast. A national model, kept for the systems that matter most, is insurance. 2026 showed exactly what it insures against: the switch and the data.
Becoming more than a landlord
The stakes are high with AI. TalentCorp says 697,000 jobs are at risk within five years without retraining. Scam takedowns jumped from about 6,300 in 2023 to 98,500 in 2025, and 85% of victims were pulled in by AI-made endorsement videos, some deepfaking the King. For most Malaysians, AI showed up as fraud before it showed up as productivity. That, more than any strategy paper, is why the AI law is being rushed.
Malaysia's place in AI has two sides. One is land, power and chips: good money, but everything valuable in it belongs to someone else. The other is still small and harder to build — but it is something we can actually own, and it compounds if we get it right.
The rent is worth collecting; it is real money. But it is earned on other people's ideas. The durable game is owning a piece of the intelligence. For anyone building from here, that means closing a last mile better than anyone else can. For the country, a good position is to bring Shariah leadership into AI certification, and to invest in sovereign systems for the handful of cases that truly need them.
What I am watching
- Whether domestic money reaches AI-native software. Where First Move and Jelawang's cheques land will say more than any blueprint.
- Whether the US moves the chip leash again: another Malaysia-specific rule, or another Fable-style switch-off.
- Whether Shariah-AI certification finds a neutral home across JAKIM, the Shariah councils and INCEIF, or stays attached to a single vendor.
- Whether AI's utility bill comes due. The water pause runs to mid-2027; the 40%-of-Johor's-grid projection is dated 2035.
Personal analysis on public reporting; not affiliated with any company named. Not investment advice.