How a Malaysian Government Agency Buys ChatGPT or Gemini Licences

← All guides

By Hanny Ramzy · Chief Strategy Officer, Web Impian Sdn. Bhd.

Checked by Hanny Ramzy on 8 October 2026. Drafted with AI help from Treasury circulars PK 2.1, 2.6, 2.9, 2.10 and 2.21, SPA Bil. 2/2021 v2.0 and the JDN GPAISA guideline.

Your director wants ChatGPT or Gemini. The vendor sells in US dollars by credit card, but your agency buys through ePerolehan with a Pesanan Kerajaan. This guide shows the procurement method by value, the cloud and data rules, the budget timing, the supplier documents and the vendor prices on 8 October 2026.

This is general guidance, not legal advice. Confirm each step with your finance and procurement unit before you commit money.

Step 1: Work out the yearly and monthly value in Ringgit

The method depends on the value for one year, for each type of item or each contract (PK 2.1, para 2.1). Count all users and the full term. Also calculate the monthly value, for your budget and for monthly billing. The procurement method uses only the yearly value. Ask the supplier for a quotation in Ringgit, with tax, before you select the method. These limits for supplies and services apply since 1 October 2024:

Direct purchase: up to RM50,000

PK 2.10 gives these rules for a direct purchase:

• Up to RM20,000 a year, the agency can buy from any supplier, MOF-registered or not.
• More than RM20,000 to RM50,000, the supplier must be MOF-registered.
• Where possible, get 3 price offers from local MOF-registered suppliers.
• Issue a Pesanan Kerajaan (government order) or a Surat Setuju Terima (letter of acceptance).
• Do not divide one purchase into smaller parts to stay below the sebut harga limit (para 1.1).

Sebut harga: RM50,000 to RM500,000

PK 2.9 (amended 1 June 2025) gives these rules for a sebut harga:

• RM50,000 to RM100,000: local MOF-registered Bumiputera suppliers in the state can offer. If there are not sufficient suppliers, the agency can invite suppliers from nearby or border states (para 1.4).
• More than RM100,000 to RM500,000: local MOF-registered suppliers can offer. Bumiputera status is not necessary.
• Give a notice of minimum 7 days.
• A Jawatankuasa Sebut Harga (quotation committee) evaluates the offers in 1 or 2 stages.
• Do the full sebut harga online in ePerolehan (para 2.1(ii)).
• The supplier must have the MOF kod bidang (field code) for the item (para 2.1(iii)).
• An offer is valid for maximum 90 days. The agency cannot extend it (para 8.1 and 8.2).
• The performance bond (bon pelaksanaan) is 2.5% of the contract value from RM200,000 to RM500,000, and 5% above RM500,000.

What changed for 2026

PK 2.21 applies from 1 January to 31 December 2026. The limits in the table above stay the same (para 4.3). Only the limits for works went up. These are the rules if you want to split one big purchase into smaller orders:

• Allowed: split a purchase above RM50,000 into smaller sebut harga packages, in place of one tender (para 3.1 and 4.1).
• Not allowed: split a purchase into orders of RM50,000 or less, to use a direct purchase or to avoid sebut harga or tender (PK 2.21 para 3.1 and PK 2.10).

Parliament passed the Government Procurement Act 2025 in 2025. In May 2026, it had no gazetted commencement date, and the Treasury circulars apply until the Act starts. Check ppp.treasury.gov.my before you write your paper.

Step 2: Check the cloud rules before you pick a supplier

ChatGPT, Gemini and Claude are software as a service (SaaS), which is cloud. Thus PK 2.6, the cloud procurement circular, applies. It started on 15 April 2022, and the Treasury extended it on 1 July 2026. Agency cloud purchases go through the JDN Cloud Framework Agreement (CFA), for IaaS, PaaS and SaaS. The current panels continue to 30 June 2027: AWS with Radmik, Microsoft with Enfrasys, Google Cloud with Awantec, and TM with Cloud Connect.

The CFA route has these steps:

• Find the service in the MyGovCloud@CFA catalogue at mygovcloudcfa.jdn.gov.my.
• Up to RM50,000, buy directly from a panel managed service provider (MSP) (para 6.1).
• Above RM50,000, do a sebut harga among the panel MSPs (para 6.1).
• If the catalogue does not have the service, get a CFA-exemption approval from JDN (para 3.2). Then use the normal rules.

Para 5.3.1(d) says that a SaaS that the panel providers do not supply follows the normal rules in PK 2.10 and PK 2.9. ChatGPT and Claude are not products of the four panel providers, so this is probably their route. We did not confirm how JDN handles the exemption for each product. Check with your ICT unit or JDN before you start.

Gemini is different. It comes with the Google Workspace Business plans, and Google Cloud is a panel provider. On 8 October 2026, we could not confirm if the CFA catalogue has Google Workspace. Check the catalogue first. If Google Workspace is in it, a federal agency possibly must buy it through the panel MSP.

Two more documents can apply. PKPA Bil. 1/2021, the public-sector cloud policy, is cloud-first, and cloud subscriptions need JDN approval with reference to the CFA. The JDN GPAISA guideline also refers to SPA Bil. 7/2024, under which ICT projects need technical approval. State governments and local councils follow PK 2.6 only when they adopt it (para 12). If you work for a state agency or a council, also check your state circulars.

Step 3: Classify the data and fix the contract terms

SPA Bil. 2/2021 version 2.0 is the CGSO security guideline for cloud. JDN gave the amended version to officers on 21 July 2026. The guideline sets these limits:

• Do not put rahsia rasmi (classified information) on a public cloud. Only a cloud that the government built and approved is permitted (Arahan Keselamatan para 139).
• Keep classified data under Malaysian legal jurisdiction.
• Classify the data before you select the service.
• Do not put the listed sensitive data on a public cloud with data held offshore (Perkara 9.1.7, Lampiran 2).

Thus, an AI licence is for open and internal work: drafts, letters, summaries of public documents, meeting notes and translations. It is not for classified files. Write that rule into your agency usage guideline before the first login.

The same guideline lists contract terms. Ask for them in the supplier offer:

• The data belongs only to the government.
• The provider does not copy, change, delete or access the data without agency permission.
• The government has the right to audit.
• A service level agreement (SLA) with financial penalties.
• Indemnity from the provider.
• An exit plan.
• Legal advice on access by foreign laws.

We did not find a government rule that says “no training on agency data”. The data-ownership term and the no-access term are the nearest official basis. The business plans of the main vendors say that they do not train models on business customer data. That is only the vendor statement, so get it in writing and attach it to your paper.

The JDN GPAISA guideline (Garis Panduan Pengadaptasian AI Sektor Awam, launched 27 February 2025) gives 7 ethics principles, which include privacy and security. It refers to the Official Secrets Act 1972 and the PDPA. Its self-assessment asks if third-party vendors obey privacy and security standards and get audits. It has no supplier checklist for generative AI, so use the SPA contract terms as your checklist.

Work accounts, not personal accounts

Many officers use a free ChatGPT or Gemini account with a personal email. That is the biggest data risk in this guide. A personal account follows the vendor consumer terms, not an agency contract. The agency has no admin console for it, and cannot see, export or delete the data. When the officer leaves, the chats and files go with the account.

Give each officer a work account under an agency plan. A business plan gives an admin console, user controls and the vendor business data terms. For Gemini, the work account is the agency Google Workspace account. Our guide to Gemini at work shows what it covers.

Budget timing: the 31 December line

Arahan Perbendaharaan 56(a) says that budget that the agency does not spend lapses at the end of the financial year. In the new year, the agency can pay only for supplies received or services completed by 31 December. AP 99(e)(i) adds that each payment voucher must certify that the supply or service is complete.

The Treasury has no rule for prepaid SaaS. Thus, these items are points to check with your finance unit, not rules:

• A 12-month licence that starts and ends in the same year fits one allocation. This is the simplest plan.
• A licence that continues after 31 December needs care, because the agency pays before the vendor supplies all of the service.
• Monthly billing makes 12 payment vouchers a year. Annual billing makes one.
• For a contract of 2 years or more, PK 2.9 calculates the performance bond on the yearly value.

Documents to ask the supplier for

For a sebut harga, PK 2.9 lists these documents:

• Copies of the MOF Sijil Akuan Pendaftaran (registration certificate), and the MOF Sijil Akuan Bumiputera (Bumiputera certificate) if the value band requires it.
• A copy of the manufacturer certificate, if the supplier is a manufacturer.
• The completed and signed Borang Sebut Harga (quotation form) and Borang Maklumat Penyebut Harga (supplier information form).
• A statement of compliance with the specification, and a catalogue if applicable.

The quotation form says “Harga yang ditawarkan adalah harga bersih”. Thus, ask for the final price in Ringgit, with the tax shown. For a direct purchase above RM20,000, PK 2.10 asks only for proof of MOF registration. Some agencies also ask for SSM documents, an LHDN tax-compliance certificate and a letter from the vendor principal. The circulars do not list these, so your agency decides.

What the licences cost on 8 October 2026

Vendors show most prices in US dollars. Each vendor page that shows a tax line says that the price does not include tax. These are the prices on the vendor pages on 8 October 2026:

Product	Vendor price	Notes
ChatGPT Business (OpenAI)	USD 25 per user per month, or USD 20 per user per month billed annually	Annual price for 2 or more users
Claude Team (Anthropic)	USD 25 per user per month, or USD 20 per user per month billed annually	2 to 150 seats. Price excludes tax
Microsoft 365 Copilot Business	USD 18 per user per month billed annually (promotional price, regular USD 21), or USD 25.20 billed monthly	Needs a qualifying Microsoft 365 plan. Up to 300 users. Price excludes tax
Canva Business	RM420 per person per year	Annual billing. The only Ringgit price we saw
Gemini	Included in Google Workspace Business plans	Gemini in Docs, Sheets and Meet needs Business Standard or higher

Vendors change prices without notice. Check the vendor page again on the day that you write your paper, and ask the supplier for a quotation in Ringgit, with the exchange rate and the tax shown. On our quotations, each AI licence is at the vendor price. Our support and management work is a separate line, so your committee can see the two amounts. The Ringgit prices of each Google Workspace plan are on our Gemini for business page.

Where Web Impian fits

Web Impian Sdn. Bhd. is registered with the Ministry of Finance under 357-0002304403 with Bumiputera status, valid until 7 April 2028. For software licences, our codes are 210103 (off-the-shelf software) and 210109 (software leasing and renting). We are not a CFA panel provider, and we do not claim a partnership with an AI vendor. We put Google Workspace with Gemini, the AI licences and the support on one quotation in Ringgit, with the MOF and SSM documents for your file. Our AI licences for the public sector page has the bundle details, and our public sector page has the full list of field codes.

Checklist before you send the request for quotation

Do these steps in this sequence. Tick each step when it is done:

How we wrote this guide

We drafted this guide with AI help from these official texts:

• PK 2.1 (1 October 2024), PK 2.6 (amendment of 28 August 2026), PK 2.9 (amended 1 June 2025), PK 2.10 (29 November 2022) and PK 2.21 (2026), from the Treasury circular portal.
• Arahan Perbendaharaan 2023.
• The JDN slides on SPA Bil. 2/2021 version 2.0 (21 July 2026).
• The JDN GPAISA media release (27 February 2025).

Vendor prices come from the vendor pages on 8 October 2026: ChatGPT, Claude, Microsoft 365 Copilot and Canva. Where we could not confirm a point in an official source, the text says so.

Next steps

If you know the number of users, WhatsApp us. We will calculate the size of the order and attach the MOF documents. Confirm the procurement route with your finance and procurement unit before you send anything.

Hanny RamzyHanny Ramzy runs Office Niaga at Web Impian Sdn. Bhd. (SSM 920163-H) in Kota Bharu, Malaysia, helping businesses and agencies move to Google Workspace and business email with Ringgit billing and local support.Facebook