Request for Proposal (RFP): Study of AI Sandbox

Summary Scope of Work:

The vendor will be responsible for a comprehensive range of services including but not limited to:

1. Baseline Study, Ecosystem Analysis, Problem Definition and Benchmarking for an AI Sandbox
   
   • Conduct a focused study to understand Malaysia’s landscape of controlled testing environments and programmes in order to identify current practices, institutional roles, sectoral gaps, technical capabilities, regulatory uncertainties, data governance requirements, privacy, cybersecurity, AI safety, human oversight, ethical AI considerations and the practical problems that an AI sandbox is expected to solve.
   • The vendor shall assess regulatory and technical readiness, identify key risks and compliance gaps, benchmark relevant international AI sandbox, AI safety evaluation and virtual testing models, and survey suitable governance and approval mechanisms in order to provide findings and options that support secure, safety-oriented and practical sandbox arrangements. The vendor shall analyse the different sandbox archetypes and determine which elements may be relevant for Malaysia, including technical testing, data access, model assurance, product or service pilots, operational workflow testing, learning or simulation arrangements, and regulatory or supervisory arrangements, with emphasis on how each element contributes to risk containment, safety assurance and evidence-based decision-making.
2. Proposed AI Sandbox Governance Options
   
   • Design a proposed structured AI sandbox governance options paper for NAIO’s consideration, including:
     • Sandbox objectives, scope, structure, and governance model;
     • Categories of use cases suitable for testing and categories that may require exclusion, restriction, heightened scrutiny or additional safeguards;
     • Participation eligibility criteria, application requirements and onboarding processes;
     • Entry, monitoring, reporting, escalation, exit and post-sandbox decision pathways, including criteria for deployment, scaling, restriction, further testing or discontinuation;
     • Roles and responsibilities of stakeholders (e.g. NAIO, regulators, participants, and technical partners);
     • Control boundaries, including scale limits, time limits, user restrictions, data controls, human oversight, logging, incident reporting, audit trails, kill-switch arrangements and rollback mechanisms;
     • AI risk assessment, safety assessment, compliance assessment and performance evaluation mechanisms; and
     • Operational procedures and implementation guidelines for the AI sandbox, including safety monitoring, incident response, evidence preservation and post-sandbox decision processes.
3. AI Assurance Framework
   
   • Develop the AI assurance overarching approach for the sandbox, the processes by which AI systems are tested, verified, documented and monitored to demonstrate they are trustworthy and fit for their intended use as a complement to AI Safety, the AI Governance Bill and the MY-AI Standards initiative:
     
     • Certification process;
     • Data governance, privacy, cybersecurity, safety and ethical AI considerations;
     • Sectoral regulatory overlaps and relevant approval or notification mechanisms;
     • AI risk management considerations and evidence requirements for sandbox participation;
     • Possible compliance assessment processes within a sandbox environment;
     • Standards, testing protocols, performance metrics and benchmarking approaches that may be referenced or adapted; and
     • Options for future non-binding guidance, implementation instruments, standards-referencing documents or regulatory proposals, where appropriate.
4. Virtual Testing Environment Framework
   
   • Propose and define the architecture for a virtual testing environment and safety assurance process, including:
     • Technical infrastructure, data environment and platform requirements;
     • Testing protocols, validation procedures, red-teaming or stress-testing approaches, and performance evaluation metrics; and
     • Risk identification, monitoring and mitigation mechanisms, including incident logging, audit trails, human override and rollback arrangements.
5. Pilot Design and Safety Validation
   
   • Design a pilot implementation and safety validation plan using selected illustrative use cases or stakeholder scenarios. This may include engagement with government agencies, regulators, industry, academia, technical experts and other relevant stakeholders, to:
     • Test and refine the safety controls, governance tools and operational processes;
     • Validate regulatory, technical and safety assurance components; and
     • Capture lessons learned, risk signals, evidence gaps and improvement areas.
6. Stakeholder Engagement and Capacity Building
   • Engage with key stakeholders (government, industry, academia) through workshops, consultations, and focus groups to:
     • Ensure alignment and adoption
     • Gather feedback for continuous improvement
     • Build awareness and capability in AI safety, AI governance and practical implementation
7. Final Deliverables & Recommendations
   • Provide a complete set of deliverables, including:
     • Malaysia sandbox ecosystem and readiness assessment, including governance gap analysis;
     • AI Sandbox Framework and Governance Model Proposal;
     • Regulatory, Compliance and AI Safety Issues Paper with recommended options;
     • Virtual Testing Environment and Safety Assurance Blueprint;
     • Pilot Design, Safety Validation and Stakeholder Engagement Report; and
     • Final Recommendations Report, including implementation roadmap, safety and governance decision matrix, and proposed next steps for NAIO’s consideration