By Ts. Syida Nazri, IAQ Assessor at Airscan Malaysia
In any client conversation I have about indoor air quality regulation, the topic that draws the most questions is fines and penalties. People want to know the figures, where the liability sits and what triggers enforcement. The curiosity makes sense. Most operators have never read the regulations that govern indoor air quality in Malaysian workplaces, and practical guidance on what the law actually requires is hard to find.
This article is meant to answer those questions. What the law is, what it requires, and what it costs to ignore.
What laws explicitly relate to indoor air quality at the workplace in Malaysia?
Let’s put this to rest: yes, Malaysian law places a duty on employers and building occupiers to protect the health and safety of everyone in their workplace, and indoor air quality falls within that obligation. If you are running a commercial workplace in Malaysia, this applies to you.
The document that matters is the Industry Code of Practice on Indoor Air Quality (ICOP) 2010, written and gazetted by Malaysia’s Department of Occupational Safety and Health. ICOP is the operational standard for indoor air quality in Malaysian workplaces, and every parameter, duty and recordkeeping obligation around indoor air quality sits inside this one document.
It draws its legal force from the Occupational Safety and Health Act (OSHA) 1994, which is the parent law. OSHA does not address indoor air directly, instead creating general duties for employers to protect the health of their workers, and ICOP is the instrument that turns those general duties into something measurable for IAQ. Compliance with ICOP is what evidence of good practice looks like in a Malaysian court.
That said, the OSHA Amendment 2022 came into force in June 2024 and expanded the act’s scope to all workplaces, which means every commercial office in Malaysia now sits within the same enforcement scope that historically focused on industrial and manufacturing settings.
What ICOP says about the air
ICOP defines acceptable indoor conditions through a set of parameters: air temperature between 23 and 26 degrees, relative humidity between 40 and 70 percent and air movement between 0.15 and 0.50 metres per second. For contaminants, carbon dioxide must stay below 1,000 ppm, carbon monoxide below 10 ppm, formaldehyde below 0.1 ppm and total volatile organic compounds below 3 ppm. Bacterial counts should sit under 500 cfu per cubic metre and fungal counts under 1,000.
These look like technical thresholds for a specialist to worry about. In practice, if your building’s ventilation isn’t actively managing the air, occupancy alone – humans present? yes / no – will push several of these parameters past their limits faster than you’d expect. The assumption that a modern office with working air conditioning will sit comfortably within these ranges is one I encounter in almost every engagement, and it almost never survives an actual measurement.
Carbon dioxide at 1,000 ppm is really a proxy for whether the ventilation is doing its job. A decently sized meeting room with eight people in it will breach that limit within twenty minutes if the system is undersized or running on a reduced energy setting, and we see this constantly in spaces that on paper meet every spec.
Formaldehyde at 0.1 ppm catches operators out after fit-outs and furniture installations. New laminates, adhesives and engineered wood off-gas formaldehyde for months after they’re installed, and most building managers don’t connect a recent office refresh to the air quality complaints that arrive six weeks later.
Bacterial and fungal counts come into play where the MVAC system has been left alone too long. Filters unchanged, drain pans uncleaned, cooling coils sitting wet for years on end. The biology accumulates quietly, and the first sign is often a complaint about a smell rather than a measured breach.
Put these parameters next to each other and you can see what ICOP is really asking for: an indoor environment that is healthy across temperature, ventilation, chemistry and biology at the same time. Hitting one number while missing the others does not amount to compliance.
ICOP requirements beyond the air
This is the part most operators don’t realise applies to them. ICOP imposes ongoing duties on whoever runs the building, and those duties exist regardless of whether the air on any given day happens to be within range.
An OSH Coordinator must be appointed if a workplace has five or more employees and is not required to have a dedicated Safety and Health Officer. This person handles internal safety matters including IAQ complaints. Most SMEs I work with do not have one in place.
A documented complaint procedure for occupants must exist in writing, properly drafted and accessible to staff. Almost no office I audit has one of these on paper before I arrive, and the casual “you can email anyone in HR” approach is not what the law has in mind.
MVAC systems must be inspected and maintained at least every six months, which is where the most common compliance gap shows up. Most building maintenance contracts cover filter changes and routine servicing, and that is not the same as the diagnostic checks ICOP expects. The phrase “we maintain our HVAC” rarely translates into ICOP-compliant maintenance records.
All employees must receive training on the contents of ICOP and how to recognise signs of poor ventilation at least once every two years. In practice this almost never happens, because most operators have never read ICOP themselves and so the training conversation has nowhere to begin.
These four duties are the part of compliance that does not show up on a sensor reading, and they are the part DOSH expects to find documented when they come looking.
How DOSH actually enforces this
Most office managers picture an inspector arriving with sampling equipment, taking readings and writing up the result. That does happen, though it is rarely what catches an operator out.
Enforcement runs on records. Complaint logs, investigation reports, training records and maintenance records must be kept for five years. Formal IAQ assessment reports must be kept for thirty years. DOSH can request any of these at any time, and what they find in the paper trail tends to matter more than what they find in the air on any given afternoon.
That changes how to think about the whole question. The thing DOSH is really testing is whether you can produce evidence of consistent management going back years, which is a different exercise from making sure the air is fine on the day of an inspection. Without records, the assumption is that the work was not being done.
It is also worth knowing what triggers a DOSH visit in the first place. The usual triggers are employee complaints filed with the agency, workplace incident reports and renovation activity, all of which are predictable enough that an operator who is paying attention can prepare for them.
There is one expectation that sits outside ICOP’s written text, and it is the one DOSH has been most direct about in my conversations with the agency: IAQ testing is a baseline requirement. The reasoning follows from the duties ICOP already imposes. If you are required to maintain air quality parameters within specific ranges, to keep records proving those parameters have been managed and to produce evidence of consistent stewardship when asked, you need a measurement to work from. You cannot demonstrate compliance with conditions you have never actually tested. The upcoming revision of ICOP, which is currently being developed, is expected to make that expectation explicit in the text.
What non-compliance costs
This is the section my clients always have the most questions about.
A breach of the general duty under OSHA, which is the legal hook IAQ failure ultimately attaches to, can carry a fine of up to RM500,000, imprisonment of up to two years, or both. Failure to comply with a Notice of Improvement or a Notice of Prohibition issued by DOSH reaches the same RM500,000 ceiling. Continued non-compliance after a notice incurs RM2,000 per day. The 2022 amendment introduced personal liability for directors and managers, which means the consequences of a serious IAQ failure do not end at the company being fined.
These figures sit on DOSH’s books ready to be used. The 2024 expansion of OSHA’s scope means they apply to every commercial office in the country, not only the industrial sites that historically drew enforcement attention.
Formal IAQ testing requires DOSH-certified IAQ Assessor
There is one detail in ICOP that ends up doing a lot of work:
A formal IAQ assessment under ICOP can only be carried out by a person registered with the Director General of DOSH as an Indoor Air Quality Assessor. Self-certification has no standing. If you are responding to a complaint, defending against a notice or producing the kind of report DOSH might request, an assessment signed off by anyone other than a registered assessor will not satisfy the requirement.
If you have been running an office for years and have never had a formal IAQ assessment by a registered assessor, that is the first gap worth closing.
Speak to us at Airscan about indoor air quality in your environment.
