Before an AI workflow makes a decision, build the decision record.

FIELD NOTE

When does an ordinary workflow become an automated decision?

It happens earlier than many teams expect. Ranking CVs, prioritising leads, segmenting customers, recommending prices, or deciding which case receives attention can all involve profiling or automated decision support when personal data shapes the result.

Malaysia does not need a single general AI Act for existing personal-data duties to matter. The Personal Data Protection Act and the regulator's 2026 guidance already create an operational reason to understand what data enters a system, what outcome it influences, and who remains answerable.

FIELD NOTE

What should the decision record contain?

Keep one living record that a business owner, operator, technical team, and reviewer can understand. It should follow the workflow throughout its life, not appear only at procurement.

• The specific purpose and people affected
• The source, quality, and relevance of personal data
• The model or rules used and known limitations
• The named human owner with authority to intervene
• How a person can ask for an explanation or correction
• Outcome monitoring, incident handling, and retirement criteria

FIELD NOTE

Human review must be a real control

A human checkpoint is not meaningful when the reviewer lacks context, time, authority, or a way to change the result. Design the interface so the reviewer can see the supporting information, recognise uncertainty, record a different decision, and escalate exceptions.

For higher-impact workflows, conduct an impact assessment before launch and revisit it when the data, model, affected population, or intended use changes.

FIELD NOTE

The operating principle

The useful question is not whether the business uses AI. It is whether the business can explain how a consequential result was produced, who owned it, and what happened when the system was wrong. That evidence is part of the product.