Ahead of the Curve

AI is already in daily use in most law and accounting firms, often without firm rules. Formal governance is moving more slowly. The gap is where confidential client work, inaccurate output and weak records accumulate. This article is a practical map for closing that gap. It is not legal advice. Named sources are listed at the end.

1What 2 August actually means here

The EU AI Act is the world’s first comprehensive horizontal AI law. From 2 August 2026 most remaining provisions apply, including transparency duties for certain AI systems and AI-generated content. A firm in Malaysia or Singapore is not an EU regulator’s first concern. The Act still matters in two practical ways.

First, the expectations travel through contracts. A firm acting for European clients, or feeding work into an EU-based matter, can find those duties arriving as a client requirement long before any local statute says a word. A domestic address is not a protection on its own.

Second, the Act is the most complete written expression so far of ideas that are already converging: know where AI is used, keep a competent human accountable, protect confidential information, and be transparent where it matters. Those are usable habits now. They do not require waiting for a Malaysian bill or a new Singapore statute.

2The GDPR pattern, in one lesson

In 2018, GDPR was widely treated outside Europe as someone else’s task. Within a few years its core ideas had been absorbed into data-protection regimes across the world, including Malaysia’s PDPA and Singapore’s PDPA. Procurement teams wrote them into contracts. Clients came to expect them. One defensible baseline proved easier than many.

There will not be a single global AI law soon. The direction is still clear. Documentation, accountability, human oversight and transparency proportionate to risk are the same handful of expectations, written in different instruments. A firm that already practises them will have less to retrofit later.

3What the region already expects

Malaysia and Singapore are not waiting for European norms. They are building their own, in different instruments, toward the same handful of duties.

Malaysia has moved from voluntary AI-governance guidelines (2024) to a National AI Office, a local standards platform, and consultation on an AI Governance Bill. The Personal Data Protection (Amendment) Act 2024 has already added breach-notification and data-protection-officer duties that bear on any AI workflow with client information.

Singapore has so far preferred guidance and testing tools. The Model AI Governance Framework for Generative AI (2024) and the Ministry of Law’s legal-sector guide (March 2026) set three anchors: legal professionals remain responsible for all work products; they must safeguard client confidentiality; and they should consider informing clients where AI use is substantial. The courts already have their own guide for court users.

Law and accounting sit first in line because both are built on a duty to protect confidential client information, and both are licensed and supervised. That is the profile that attracts specific obligations once general concern crystallises.

4What to put in place now

Getting ahead does not mean banning AI, and it does not mean waiting for the final text of a Malaysian statute. It means adopting AI inside a boundary the firm actually controls.

1. List the tools. Name what staff may use, for which work, and who approves anything new.
2. Classify the data. Public AI for general learning. Approved tools for everyday work that is not a confidential client file. Private AI for the file itself.
3. Keep a person accountable. AI assists. Lawyers and accountants review, verify sources, and remain responsible for anything that leaves the firm.
4. Keep a short record. For higher-risk use, note the tool, the work and who checked. When a client, a DPO or a later standard asks the firm to show how it governs AI, that record is the answer.
5. Give confidential work a private path. Secure Law and Secure Accounting run on premises, so confidential client work is processed under the firm’s control rather than sent to a public model.

Those five steps are the same habits the EU AI Act, Malaysia’s direction of travel and Singapore’s guidance are already describing. Doing them now is how a firm uses the window, rather than reading about it.