Standard MY-AI should change the questions in your vendor meeting.

FIELD NOTE

A standard is useful when it changes operating behaviour

The Ministry of Digital described Standard MY-AI as trust infrastructure and linked it to the wider development of Malaysia's AI governance and ethics environment. A buyer should not reduce that signal to a badge on a proposal.

Use it to make procurement evidence-based. The vendor should explain how the exact proposed workflow behaves, not only provide a general policy for the company.

FIELD NOTE

Ask for the system boundary

Request a diagram showing inputs, models, integrations, storage, users, logs, subprocessors, overseas processing, and outputs. Mark what the vendor controls, what your team controls, and what depends on another provider.

• The intended decision or task
• Personal and confidential data involved
• Model and provider dependencies
• Human approval and override points
• Logging, retention, deletion, and export
• Failure modes and service fallback

FIELD NOTE

Test the awkward cases

A polished demonstration normally follows the happy path. Procurement should test incomplete data, contradictory instructions, unavailable integrations, prompt injection, incorrect output, staff misuse, and the removal of a user's access. Record who detects each problem and who has authority to stop the workflow.

FIELD NOTE

Contract for change

AI services change quickly. Require notice for material model, subprocessor, data-use, and security changes. Preserve the ability to export business records and continue essential operations when a model or vendor is replaced.