The Enterprise AI Framework for Malaysian Agencies and GLCs: Scope, Cost and a 26-Week Rollout

AIHQ has trained and engaged over 9,000 professionals across corporate, public sector, professional and regulated environments. The pattern that repeats across those engagements is not a shortage of enthusiasm. It is a shortage of sequence.

Agencies and GLCs usually start with a tool licence, a two-day workshop, or a single departmental pilot. Six months later the pilot has a slide deck, no owner, and no route into procurement. The enterprise AI framework below is built to prevent that: five stages, each with a measurable entry point, a named accountable owner, an MYR cost band, and an explicit stop-or-proceed gate.

Stage 1: Opportunity assessment — before anyone buys a licence

Most public sector AI work in Malaysia starts at the wrong end. A vendor demo arrives first, the tool decision follows, and only later does anyone ask which processes actually need help.

Run the assessment as a workflow audit, not a technology scan. Take three to five functions — typically HR, finance, procurement, service delivery or records — and map where staff spend time on repetitive drafting, document search, status chasing and data re-entry. Score each process on volume, error cost, sensitivity of data, and whether a human must remain in the loop.

Deliverable: a ranked list of six to ten candidate use cases, each with a named process owner, current time cost per month, and a data classification.

Cost band in Malaysia: MYR 20,000–60,000 for a facilitated assessment across three to five functions. A structured AI use-case discovery workshop compresses this into two to three weeks rather than a quarter.

Gate: proceed only if at least three use cases clear all four of these — a willing process owner, data the agency can lawfully process, measurable before-and-after, and a workflow that does not depend on a system being replaced first.

Stage 2: Governance and data guardrails — build before scale, not after

Governance that arrives after rollout becomes an incident response. For agencies and GLCs the relevant reference points are the PDPA amendments that came into force in 2025, including the mandatory data breach notification requirement and the appointment of a Data Protection Officer where applicable, plus your own internal classification rules and any Public Sector Data Sharing provisions that apply to your context.

Practically, you need four things written down before staff use AI on real work:

• A classified list of what may never be entered into a public AI tool — citizen data, personal data, tender pricing, legal advice, investigation material.
• An approved tool list with the settings already applied, not a policy that tells staff to configure security themselves.
• A human review rule for any AI output that leaves the organisation, reaches a constituent, or feeds a decision.
• An incident route: who is notified, within what timeframe, and with what record.

The AI Centre of Excellence Setup guide covers the operating model options if you need to decide whether governance sits in a central unit, an existing IT and risk function, or a hybrid.

Cost band in Malaysia: MYR 15,000–45,000 for policy drafting plus a governance workshop, depending on how many legacy classification rules must be reconciled.

Gate: proceed only when the tool list, the prohibited-data list and the incident route are signed by someone with actual authority — usually the CIO, the Chief Risk Officer, or the officer named as Data Protection Officer.

Stage 3: Leadership alignment — one decision, not one briefing

The most common reason enterprise AI work stalls between stages two and four is that leadership attended a briefing rather than made a decision. A briefing creates awareness. An alignment session ends with a written decision on scope, budget envelope and who is accountable when the first use case goes live.

Put three questions in front of the leadership team and require answers in the room:

1. Which two use cases go first, and which are explicitly deferred?
2. What is the budget envelope for the next 12 months, and whose line does it sit on?
3. Who is the single accountable owner for adoption outcomes — not for the tool, for the outcomes?

AIHQ has delivered leadership briefings and strategy sessions for organisations including Lion Group, MTD Group, Parkland Group and MUI Group, with senior leaders present. The consistent finding: when the accountable owner is named in the room, the programme moves. When the answer is "the digital team will coordinate", it usually does not.

Cost band in Malaysia: MYR 10,000–35,000 for an executive-level alignment session, structure and follow-through documentation. An executive AI briefing is often the format that gets the right people in the same room.

Gate: proceed only with a named accountable owner, a signed budget envelope, and a written list of deferred use cases — deferral is a decision, and writing it down prevents scope drift.

Stage 4: Role-based capability — train the workflow, not the tool

Train the workflow per role: service, finance, HR, records — not the tool in general.

Generic AI training produces awareness and not much else. Cautious language matters here: prompting is genuinely useful, but sustainable adoption requires role-based capability, workflow thinking and leadership alignment working together.

Structure capability by role rather than by seniority:

• Service and counter staff — drafting replies, summarising case notes, checking correspondence against policy.
• Finance and procurement officers — variance explanation drafts, tender document review support, reconciliation anomaly flagging.
• HR officers — job description drafting, policy Q&A, interview note structuring.
• Records and knowledge staff — document search, minutes, classification tagging.

For a 2,000-person agency, a realistic sequencing is 120–200 staff trained in the first two quarters — two or three functions, using their own documents and their own processes as the exercises. Diluting the first cohort across every department is what turns a training programme into a compliance activity.

A useful benchmark for what a structured multi-month capability journey can look like: AIHQ supported Media Prima through a 12-month programme covering awareness, fundamentals, intermediate LLM skill-building and advanced application workshops, with 98% satisfied participants, 90% reporting increased practical knowledge and skills, and 92% finding the training relevant and applicable to work. Those figures are specific to that programme and should not be read as a general expectation.

Cost band in Malaysia: MYR 1,200–3,500 per participant per day for role-based enterprise delivery, with meaningful volume discounts above 30 participants per cohort. Programmes can be structured to be HRDC claimable, subject to client eligibility, grant approval and HRD Corp submission requirements. AIHQ is a registered HRD Corp training provider.

Gate: proceed to the next stage only when post-training measurement shows the trained cohort actually using AI in their own workflows — assessed by output sample and manager confirmation, not by attendance or a quiz score.

Stage 5: Organisational rollout — scale what passed, retire what did not

Rollout is where most enterprise AI frameworks quietly lose control. The discipline is to expand only the use cases that cleared their service-level target in stage four, and to formally close the ones that did not.

By this stage you need three pieces of infrastructure working:

• An internal copilot or chatbot for SOPs, HR policy and internal knowledge, so answers are consistent across departments and the source of truth stays inside your systems. Where roles need specific tooling — service counter support, internal enquiry handling — a custom AI chatbot is usually the right build rather than a general-purpose tool.
• An adoption dashboard the leadership team actually reads each month: active users by function, use cases in production, escalation rate, incidents logged.
• A quarterly review cycle that re-scores use cases against their original targets and decides on retirement, continuation or expansion.

Multi-step approval, follow-up and notification processes are usually where value concentrates, and they are also where off-the-shelf tools reach their limit; that is the point at which custom AI solutions and workflow automation become the sensible next step rather than a bigger licence.

Cost band in Malaysia: MYR 40,000–180,000 for rollout infrastructure depending on whether you buy configured tools, build a custom copilot, or integrate with existing case management systems. Managed services add a monthly retainer typically in the MYR 4,000–15,000 range.

Gate: the framework only produces compounding value if the quarterly review actually has authority to stop things. A review that can only add use cases is a backlog, not a framework.

The 26-week sequence, with owners

Agencies asking for a realistic timeline rather than an aspirational one can use this as a starting point:

Weeks	Stage	Owner	Output
1–3	Opportunity assessment	Head of Transformation	Ranked use-case list, data classification
4–6	Governance drafting	CIO or Chief Risk Officer	Tool list, prohibited-data list, incident route
7–8	Leadership alignment	Secretary-General or CEO	Signed scope, budget envelope, accountable owner
9–18	Role-based capability (cohort 1)	Head of HR / L&D	120–200 staff trained on live workflows
19–22	Adoption measurement	Accountable owner	Usage evidence, escalation rate, incidents
23–26	Rollout decision	Leadership team	Scale, continue or retire, per use case

Two things break this plan most often. First, the procurement cycle running in parallel rather than after the governance gate — a licence signed in week 5 with no prohibited-data list is a liability, not a head start. Second, running capability and governance as competing workstreams when governance must come first.

What the numbers mean for a Malaysian agency or GLC

Add the low ends of the five stages and you land near MYR 85,000 for a first year that reaches a defensible rollout decision. Add the high ends and you are closer to MYR 320,000 before infrastructure integration. The difference is almost never the training cost. It is whether the governance stage was done properly the first time, and whether leadership named an accountable owner instead of a coordinating committee.

Two practical readings. Where budget is genuinely constrained, fund stages one to three first — a use-case list, guardrails and an aligned leadership team are the three assets that make any later spend defensible, and they are the cheapest part of the sequence. Where the workforce is large, treat HRDC-claimable structuring as a funding mechanism to explore with your HR function rather than a certainty, since eligibility and approval sit with HRD Corp and your own organisation's status.

Off-the-shelf tools remain a reasonable starting point for individuals. What they do not do is give an agency a governed, role-specific, measurable enterprise framework — which is the part that survives a change of leadership.