Request for Proposal (RFP): National AI Sandbox Ecosystem Study

Summary Scope of Work:

The appointed organisations shall undertake the following scope of work but not limited to:

1. Malaysia Sandbox Ecosystem Landscape
   • Conduct a stocktake and mapping of existing sandbox and controlled-testing mechanisms in Malaysia, focusing on their mandates, scope, target sectors and key functions. Identify existing coverage, overlaps, gaps and potential linkages to determine how existing mechanisms and national capabilities can be connected to or leveraged by the National AI Sandbox ecosystem.
2. International Benchmarking
   • Benchmark approximately seven (7) to ten (10) relevant international sandbox and controlled-testing models, focusing on their mandates, scope, governance and institutional arrangements, operating approaches and key functions. Identify practical and transferable practices and lessons relevant to the Malaysian context.
3. Legal and Regulatory Assessment
   • Conduct a regulatory landscape analysis of applicable laws and regulations, with consideration of the proposed AI Governance Bill and its anticipated sandbox provisions. Identify key regulatory gaps, overlaps, dependencies and coordination requirements, and assess framework-level instrument options that may support the establishment and phased implementation of the National AI Sandbox. Detailed legislative or legal instrument drafting is outside the scope of the Study.
4. AI Sandbox Governance & Operating Model
   • Develop and assess feasible operating model options for the National AI Sandbox and recommend a preferred model. The assessment shall define the proposed governance structure, institutional roles and responsibilities, coordination and decision-making mechanisms, regulatory interfaces, and key ecosystem linkages, including relevant relationships with existing sandbox operators, regulators and My-AISafe.
   • The Study shall test the working hypothesis that the National AI Sandbox may primarily operate as a coordinating mechanism across existing national capabilities, rather than assuming this as a predetermined operating model.
5. AI Sandbox Operating Procedures
   • Develop high-level operating procedures covering the end-to end National AI Sandbox lifecycle, including eligibility and entry criteria, application and onboarding, testing requirements, monitoring and reporting, decision gates, referral and escalation pathways, exit criteria, post Sandbox pathways, and the roles and responsibilities of relevant parties.
   • Where specialised AI assurance, safety evaluation or technical testing is required, the procedures shall define appropriate interfaces and referral pathways to My-AISafe and other relevant national capabilities, rather than duplicating their technical functions.
6. AI Sandbox Validation
   • Identify and conduct tabletop or simulated validation exercises involving two (2) to three (3) representative use cases to test the proposed governance and operating model and operating procedures. The validation shall assess key elements including entry, decision gates, institutional roles, regulatory referral and escalation pathways, My-AISafe referral, and exit arrangements.
   • The findings shall be used to refine the proposed operating model and procedures. Live testing of AI systems and technical evaluation are outside the scope of the Study.
7. Stakeholder Engagement and Institutional Alignment
   • Conduct targeted consultations with approximately 10–15 key organisations, including relevant regulators, Government agencies, existing sandbox operators and other relevant institutions, through approximately five (5) to six (6) focus group discussions (FGDs) and up to two (2) validation workshops.
   • The engagement shall support the development and validation of the proposed governance, operating and institutional arrangements and may incorporate relevant international technical input where appropriate.
8. Implementation and Integration Roadmap
   • Develop a strategic and phased implementation and integration roadmap setting out the key actions, institutional and regulatory requirements, dependencies, roles and responsibilities, indicative sequencing and next steps required to progressively establish and operationalise the National AI Sandbox ecosystem.