The recent Sessions Court ruling ordering a local bank to pay RM166,000 for failing to monitor anomalous transactions represents a critical inflection point for corporate governance in Malaysia. By holding the institution liable for ignoring sudden, uncharacteristic account activity, the court effectively dismantled the legacy defence that merely having a secure system—such as sending automated SMS alerts—absolves an organisation of its duty of care.

The ruling sets a clear legal baseline: financial institutions cannot remain passive when faced with glaring transactional anomalies. It reinforces the expectation that financial compliance requires active, intelligent monitoring of escalation triggers, particularly when a transaction drastically deviates from established customer behaviour.

However, if our institutions are currently facing legal liability for missing traditional, rudimentary anomalies, they are alarmingly exposed to the incoming wave of AI-driven financial manipulation. What used to be neatly divided into IT risk versus finance risk is now one combined problem. Cybersecurity and financial compliance can no longer sit in separate rooms.

AI does not necessarily create new categories of fraud; it amplifies existing ones with devastating precision. The 2024 Arup incident, where a multinational engineering firm lost US$25mil after an employee transferred funds based on a deepfake video call with fabricated “senior management,” serves as the global anchor case. It proves an uncomfortable reality: we can no longer trust the channel. Relying on email authenticity, or even live video confirmation, is now an outdated assumption.

Furthermore, AI enables virtually undetectable fraud at scale. Instead of a single large, suspicious transfer, malicious actors can execute hundreds of micro-transactions over time. In this modern “One Cent Thief” scenario, each transaction sits comfortably below automated detection limits and approval thresholds, yet aggregates into significant corporate losses.

This is where our current regulatory frameworks face a critical gap. The Cybersecurity Act 2024 provides a strong foundation for strengthening system resilience and reporting breaches. However, AI introduces a fundamentally different risk. It does not necessarily hack the system; rather, it manipulates how human decisions are made. While current cybersecurity laws protect the infrastructure, they do not fully address the deception embedded within the financial workflow itself.

To survive this shift, corporate boards and audit committees must recognise that the answer is not simply telling employees to “be careful.” Financial approval systems must be actively redesigned to withstand deception. High-risk actions—such as large payments, urgent transfers, or changes to vendor bank details—must trigger mandatory, independent, out-of-band verification using pre-approved contact channels.

Equally critical is the human factor. Fraud often succeeds not because a policy does not exist, but because an employee is pressured by urgency or perceived authority into bypassing it. Corporate culture must empower people to pause, question, and escalate suspicious, time-sensitive instructions. Crucially, no employee should ever be penalised for slowing down a transaction to exercise independent judgment.

The future of financial security is not just building stronger firewalls. It is disciplined human decision-making, better audit trails, and structured verification built directly into financial processes. As the recent court ruling demonstrates, the expectation of accountability is not new. The law is simply evolving to demand that our internal controls are robust enough to manage exactly how decisions are made and acted upon.

A recent Chinese court ruling—declaring that replacing a worker with AI to cut costs does not legally justify termination—serves as a stark warning: rapid technological adoption cannot bypass established labour protections.

For Malaysia, where TalentCorp projects nearly 700,000 workers will face disruption from AI, digitalisation and the green economy within three to five years, this is a legal reality we must urgently confront.

Under the Industrial Relations Act 1967, terminations require “just cause or excuse.” While companies will inevitably claim “redundancy” to justify AI-driven layoffs, procuring an enterprise AI license is not a legal blank cheque. The burden remains on employers to prove a role has genuinely ceased to exist.

If a company dismisses junior staff but uses algorithms to produce the exact same volume of work—still requiring human prompting, editing, and supervision—the role has simply evolved, not disappeared. Claiming redundancy here could be successfully challenged in the Industrial Court as a sham.

However, the most profound threat to our workforce is not the legally actionable layoff; it is “invisible displacement.” This silent attrition occurs when departing employees are simply not replaced because AI absorbs their workload. No termination letter is issued, and no legal claim arises, but entry-level opportunities permanently evaporate.

We must acknowledge the employer’s reality: in a hyper-competitive global landscape, it is economically irrational to artificially sustain obsolete roles. The law can punish unfair dismissals, but it cannot compel companies to create new jobs.

While TalentCorp anticipates the emergence of 120 new high-value roles, placing the burden entirely on workers to aggressively upskill is a flawed strategy. We cannot rely on 20th-century labour laws to manage 21st-century technological disruption. We urgently need a new “digital social contract” bridging statutory reform and corporate governance.

First, the Human Resources Ministry must establish modernised guidelines explicitly defining “technological redundancy.” The Industrial Court should not be left to interpret AI displacement using decades-old precedents designed for factory closures. We need clear statutory definitions that distinguish genuine business restructuring from opportunistic AI cost-cutting.

Second, corporate governance must evolve. Adopting enterprise AI is a profound human resources event, not merely an IT procurement. Environmental, Social, and Governance (ESG) standards should encourage internal workforce impact audits. Before defaulting to silent attrition or redundancy, employers hold a duty of care to explore how at-risk workers can be transitioned to manage the very AI systems replacing their tasks.

AI will undoubtedly alter existing roles, but more importantly, it will dictate the jobs companies choose not to create tomorrow. True job security in the algorithmic age requires not just an agile workforce, but modernised labour laws and a corporate sector willing to take responsibility for its technological upgrades.