Malaysia’s Shift To Smart Manufacturing: Key Legal Risks For Foreign Investors In Robotics And Factory Automation.

Malaysia’s push towards higher-value manufacturing is accelerating investment in industrial robots, AI-enabled inspection and interconnected production lines. Yet the legal risks of an automated factory cannot be managed by purchasing compliant machines alone. They arise at different stages: investment approval, plant installation, network operation, technology integration and workforce transition.

For foreign investors, the practical question is how to allocate those risks before the factory becomes operational.

1. Manufacturing approvals and incentives: distinguishing eligibility from entitlement

Malaysia generally permits 100% foreign ownership in new manufacturing projects,¹ but investors must still satisfy applicable licensing requirements, while those seeking investment incentives must establish eligibility. Under the Industrial Co-ordination Act 1975, manufacturers with shareholders’ funds of at least RM2.5 million or 75 or more full-time paid employees must obtain a manufacturing license before undertaking the relevant manufacturing activities, following an application through the Malaysian Investment Development Authority (MIDA);² smaller manufacturers below the thresholds may apply for a confirmation of exemption.³ Investors must also assess applicable site-specific planning, building, fire, and environmental requirements.

From 1 March 2026, new manufacturing tax-incentive applications fall under Malaysia’s New Incentive Framework (NIF), while existing approvals remain subject to approved terms.⁴ Under the NIF, eligible applicants may select one of two mutually exclusive tax incentives for each qualifying manufacturing project: a Special Tax Rate (STR) of 0% to 10% for up to 10 years, or an Investment Tax Allowance (ITA) of up to 100% of qualifying capital expenditure, incurred over a period of up to 10 years, which may be set off against 70% to 100% of statutory income, subject to the applicable eligibility criteria and approval requirements.⁵ Separately, the Automation Capital Allowance (Automation CA) may provide a 200% allowance on up to RM10 million of qualifying expenditure for YAs 2023-2027. However, eligibility requires at least 36 months of manufacturing or services activity and is subject to technical criteria,⁶ potentially limiting its availability to new entrants. New entrants who do not satisfy the 36-month requirement should therefore assess their eligibility for incentives under the NIF, including the STR or ITA, as applicable, rather than assume that automation expenditure automatically qualifies for relief.

NIF’s National Investment Aspirations Scorecard recognises automation and 4IR technologies, including autonomous robots, but also assesses economic outcomes beyond capital expenditure, such as high-skilled employment, research and development, technology transfer, local supply-chain linkages and sustainability.⁷ As automation may increase productivity while reducing headcount,⁸ investors should plan for realistic workforce development and technology transfer to avoid making commitments they cannot sustain. Applications for the STR or ITA must also precede commencement of operations, with the ITA incentive start date tied to qualifying capital expenditure achieved after application.⁹ Capital investment alone does not guarantee tax relief.

2. Robot safety: liability is not confined to the factory operator

Under the Occupational Safety and Health Act 1994 (OSHA), employers must, so far as practicable, safeguard employees¹⁰ and assess workplace risks and implement the necessary controls.¹¹ Section 18A governs principals’ duties towards contractors and their personnel, including whether their work is performed under the principal’s direction. Crucially, section 20 imposes duties on persons who design, manufacture, import or supply workplace plant; subsection 20(3) separately addresses those responsible for installation. The respective obligations of a robot supplier, installer and operator therefore require separate analysis, as contractual indemnities cannot displace statutory duties. Risk assessments should address guarding, human-robot interaction, unexpected movement, maintenance isolation, worker training, and changes to safety-critical software.¹²

Investors must also check whether ancillary equipment, particularly powered lifting machinery or pressure vessels, requires a Certificate of Fitness under the Occupational Safety and Health (Plant Requiring Certificate of Fitness) Regulations 2024. Although the Department of Occupational Safety & Health (DOSH)’s guidance identifies robotic arms used for material handling among equipment excluded from the lifting-machinery certificate-of-fitness requirements,¹³ other components within an integrated automation system may require separate assessment.

3. Connected factories: distinguishing general cyber exposure from NCII obligations

Remote maintenance links, industrial control systems and cloud-connected machinery create routes for cyber incidents to interrupt production or compromise physical safety. The Cyber Security Act 2024 imposes specific risk-assessment, audit and incident-notification duties on designated National Critical Information Infrastructure (NCII) entities.¹⁴ Although “trade, industry and economy” is an NCII sector,¹⁵ an automated manufacturer is not automatically designated merely by operating connected equipment.

Whether or not designation applies, procurement and operating arrangements should specify control over remote access, operational-technology network segregation, security patches, incident response, backup and recovery. In particular, the operator should retain a practical means of disabling supplier access without disabling essential safety functions.

4. Factory data: separating personal information from industrial know-how

Robot telemetry and production metrics do not necessarily constitute personal data. However, identifiable worker-location records, CCTV footage, biometric access-control data and employee productivity profiles may constitute personal data, where they relate to identified or identifiable individuals, subject to the Personal Data Protection Act 2010 (PDPA),¹⁶ where the processing falls within the Act’s statutory scope.¹⁷ The PDPA amendments brought into force in stages during 2025 introduced requirements concerning data-breach notification and appointment of data protection officers, subject to applicable conditions.

Investors should also assess whether remote access to personal data by a foreign parent company or equipment vendor engages section 129 of the PDPA, which regulates the cross-border transfers of personal data outside Malaysia.¹⁸ A different issue is contractual control of non-personal industrial data. Technology agreements should settle rights to access, extract, retain and commercialise machine data, and whether suppliers may reuse it to train or improve AI models. PDPA compliance alone does not resolve ownership or permitted commercial use of industrial data.

5. Systems integration: procuring an operating factory, not unrelated warranties

On a more technical note, the principal risk in factory automation is whether an integrated system can deliver the investor’s intended production outcomes. As an automated production line may ultimately depend on robotics, sensors, conveyors, production software and multiple cloud services functioning together, contracts should specify measurable acceptance criteria for testing, production throughput and uptime, with milestone payments linked to successful commissioning and change-control procedures for software updates.

End-to-end integration responsibility should also be clearly allocated, preferably to a lead integrator, with defined interfaces and recourse against subcontractors. Liability caps and exclusions warrant particular scrutiny, as they may leave the investor bearing prolonged downtime, reconfiguration costs and cyber-related losses despite contractual warranties.

Investors should negotiate appropriate performance remedies, continued maintenance, access to technical documentation and transition assistance if a supplier fails or exits the project. The allocation is commercial, but these arrangements should be agreed upon procurement, before supplier dependencies makes replacement or transition costly and operationally disruptive.

6. Workforce changes and overseas technicians: planning before commissioning

Automation can create genuine redundancies, but employers must still comply with applicable employment safeguards because employees may challenge dismissal without just cause or excuse.¹⁹ In Yap Chin Wah v Mahkamah Perusahaan Malaysia & Anor [2025] 10 CLJ 61, the Court of Appeal confirmed that redundancy may be genuine even if the underlying functions continue, where fewer employees are required to conduct the same or reduced amount of work. Employers must nevertheless be able to substantiate the restructuring and its good faith. Selection criteria, redeployment possibilities, notice and termination benefits should be addressed before retrenchment. In Peninsular Malaysia, the prescribed Borang PK notification must generally be lodged at least 30 days²⁰ before the relevant retrenchment exercise, with applicable post-event reporting.

Immigration planning requires a further distinction. Foreign engineers engaged temporarily by overseas suppliers for machine installation, stabilisation or training may qualify for a Professional Visit Pass; expatriates employed locally generally require an Employment Pass. The revised Employment Pass salary thresholds have applied since 1 June 2026. Applications within MIDA’s remit, particularly the manufacturing sector, also use its MIDA Expatriate System, introduced on that date.²¹ Treating installation work as an ordinary business visit risks deployment delays.

Conclusion

The most costly failures in smart manufacturing often arise at the interfaces: between a manufacturing approval and incentive commitment, between a robot and a human worker, or between a machinery supplier and the software integrator.

Foreign investors should therefore complete an integrated legal and technical review before procurement and commissioning, with responsibilities assigned to identifiable parties and backed by enforceable contracts. That is the most reliable way to translate Malaysia’s smart-manufacturing opportunities into a resilient operating investment.

For further information, please contact:

Kho Feng Ming, Azmi & Associates

kho.fengming@azmilaw.com

1. Ministry of International Trade and Industry (MITI), “Equity Policy for New, Expansion or Diversification Projects” (accessed 15 October 2026).
2. MIDA, “Guideline on Application for Manufacturing Licence” (2024) at paragraph 1.2 (accessed 14 October 2026).
3. Ibid, paragraph 1.3.
4. MITI, “New Incentive Framework” (accessed 15 October 2026).
5. MIDA, “Guidelines of Tax Incentives for New Investment” (accessed 16 October 2026).
6. MIDA, “Guidelines and Procedures for the Application of Automation Capital Allowance (Automation CA) for Manufacturing and Services Sectors”(accessed 15 October 2026).
7. MIDA, “Guidelines of Tax Incentives for New Investment in the Manufacturing Sector under the New Incentive Framework (NIF)” at Appendix II (accessed 15 October 2026).
8. Sara Brown, “A new study measures the actual impact of robots on jobs. It’s significant” (accessed 15 October 2026).
9. MIDA, supra note 6 at paragraphs 5.3 and 5.4.
10. Occupational Safety and Health Act 1994 (Act 514), section 15.
11. Ibid, section 18B.
12. Department of Occupational Safety and Health (DOSH), “Garis Panduan Keselamatan dan Kesihatan Pekerjaan dalam Industri Robotik 2025” (accessed 15 October 2026).
13. DOSH, “Application Guide for Design Verification and Alteration Approval of Lifting Machinery other than Lift, Escalator and Walkator” at Appendix 2 (accessed 15 October 2026).
14. Cyber Security Act 2024 (Act 854), sections 21 to 23.
15. National Cyber Security Agency (NACSA), “The National Critical Information Infrastructure” (accessed 15 October 2026).
16. As amended by the Personal Data Protection (Amendment) Act 2024.
17. Personal Data Protection Act 2010 (Act 709), section 4.
18. Ibid, section 129.
19. Industrial Relations Act 1967 (Act 177), section 20.
20. Department of Labour Peninsular Malaysia, “Employment Retrenchment Notification 2004” (accessed 15 October 2026).
21. MIDA, “Investor Guide: Navigating the MIDA Expatriate System” (accessed 15 October 2026).