ICOP Indoor Air Quality: Malaysia Compliance Guide

Ten parts per million of carbon monoxide. 0.1 ppm of formaldehyde. 0.15 mg/m3 of respirable particulates. Those are not aspirational targets, they are the acceptable limits written into Malaysia's ICOP indoor air quality code, approved in August 2010 under the Occupational Safety and Health Act 1994. If your building is an enclosed workplace served by mechanical ventilation and air conditioning, and almost every commercial building in Kuala Lumpur is, the code applies to you and the duty to comply sits with the employer, not the landlord, not the ACMV contractor.

Most facility teams meet the Industry Code of Practice on Indoor Air Quality 2010 exactly once: when a complaint escalates, an assessor is called in, readings are taken over a day or two, and a report lands on a desk. That snapshot is a legitimate part of the process, but it says almost nothing about the other 363 days. This guide covers what the code actually requires, where Malaysian offices typically fail it, and what changes when the readings never stop.

What is the ICOP indoor air quality code?

The Industry Code of Practice on Indoor Air Quality 2010 is a code issued by the Department of Occupational Safety and Health (DOSH, or JKKP), approved in August 2010 under OSHA 1994. It gives practical guidance on how an employer discharges the general duty to provide a safe and healthy workplace when the air in that workplace is conditioned and recirculated rather than drawn fresh through open windows.

The code does two useful things. It sets acceptable limits for a defined list of contaminants and comfort parameters, so "the air feels stuffy" becomes a measurable claim. And it sets out what a competent IAQ assessment looks like, so the results of one assessment can be compared against another. Full details and the published document are available through DOSH at dosh.gov.my.

A code of practice is not a regulation in its own right, but it is the yardstick DOSH and the courts use to judge whether the general duties under OSHA 1994 were met. Ignoring it is not a neutral choice.

Who does it apply to?

Enclosed workplaces served by mechanical ventilation and air conditioning. In practice that means offices, call centres, retail floors within malls, clinics, laboratories, hotels, banks, government departments and the air-conditioned parts of factories and warehouses. If occupants cannot open a window and the air they breathe is delivered by an AHU or a fan coil unit, you are inside the scope.

The obligation lands on the employer. This is the point most tenants misread. A tenant occupying three floors of a leased tower is the employer of the people on those floors, and the responsibility to assess and maintain acceptable indoor air quality follows the employment relationship. The building owner controls the chillers and the fresh air intake, which makes the relationship a negotiation, but it does not transfer the duty. Tenants who assume "the landlord handles air conditioning" tend to find that out during an investigation rather than before one.

The acceptable limits under ICOP IAQ 2010

The CO2 row deserves a note, because it is the single most misunderstood line in the code. The 1,000 ppm figure is not a toxicity threshold. Nobody is harmed by 1,100 ppm of carbon dioxide. It is a ventilation performance indicator: human beings exhale CO2 at a predictable rate, so if the concentration is climbing above 1,000 ppm, the outdoor air being delivered is not keeping pace with the number of people in the space. Whatever else is accumulating in that air, including the VOCs off-gassing from new furniture and the bioeffluents that make a meeting room smell tired, is accumulating too. CO2 is the cheap proxy that tells you the dilution has failed.

The temperature and relative humidity ranges align with what MS 1525 recommends for indoor design conditions, roughly 23 to 26 degrees C. That alignment matters, because it means comfort compliance and energy efficiency are pointing in the same direction rather than fighting each other, a relationship we cover in more depth in our piece on how indoor air quality and energy performance interact.

What does an IAQ assessment involve?

The code places responsibility for assessing and maintaining indoor air quality on the employer, and expects assessments to be carried out by trained, competent assessors rather than by whoever owns a handheld meter.

A proper assessment is more than a walk-around with a probe. It normally begins with a walkthrough inspection: how the ACMV system is configured, where the fresh air intake sits and what is near it, the condition of filters and drain pans, whether return air paths are blocked by partitions installed three tenancies ago. Occupant feedback is gathered, because a cluster of complaints on one side of a floor is diagnostic information. Then measurements are taken at representative locations during normal occupancy, since sampling an empty office at 7am proves nothing about conditions at 3pm with 120 people in the room.

The output is a report comparing measured values against the acceptable limits, with recommendations where a parameter is out of range. What we deliberately will not do here is quote assessment frequencies or penalty figures, because the specifics of your obligation depend on your circumstances and DOSH is the authority on them. If you want the mechanics in more detail, see our breakdown of what an IAQ assessment in Malaysia actually requires.

Where Malaysian offices actually fail

Two failure modes account for the majority of what we see, and both are invisible without instrumentation.

The first is CO2 from under-ventilation. Fresh air dampers are the easiest thing in a building to quietly close. They get shut during commissioning to hit a temperature setpoint, or trimmed by an operator chasing a chiller energy target, or they simply seize in position and nobody notices because nothing alarms. As a rough benchmark, ASHRAE Standard 62.1 sizes office outdoor air at approximately 5 cfm per person plus 0.06 cfm per square foot, which means ventilation demand scales with how many people are actually in the room. A meeting room designed for eight and used by fourteen will breach 1,000 ppm within the hour, every time, and no one will report it as an air quality problem. They will report headaches and afternoon drowsiness.

Density changes make this worse. Offices that added hot-desking, or consolidated two floors into one after a restructure, are running ventilation systems sized for a headcount that no longer exists.

The second failure mode is relative humidity, and it is specific to the tropics. Malaysian outdoor air is heavy with moisture, and an air conditioning system removes humidity only while the cooling coil is actively running wet. Oversized systems satisfy the thermostat quickly, cycle off, and leave the moisture behind. The result is a space at a comfortable 23 degrees C sitting at 75 or 80% RH, above the recommended 40 to 70% band, with condensation on cold surfaces and the conditions that total fungal counts thrive in. Then the weekend arrives, the ACMV shuts down entirely, and Monday morning starts with two days of accumulated moisture in the ceiling void.

Low humidity happens too, usually in server-adjacent zones or in aggressively over-cooled floors, bringing dry eyes and static complaints. Both directions are excursions from the code's recommended range.

Why continuous monitoring changes the compliance picture

A spot assessment is a photograph. Compliance is a film.

Consider a floor where CO2 sits at 700 ppm at 9am, climbs past 1,300 ppm by 3pm, and falls back after 6pm. An assessment taken in the morning passes cleanly. The occupants still spend their most cognitively demanding hours in under-ventilated air, and the report gives management no reason to act. Continuous logging shows the curve, and the curve is the actual condition of the workplace.

Continuous data also converts IAQ from a reactive exercise into a maintainable one. A humidity trend creeping upward over three weeks is a coil or a reheat problem you can fix on a planned work order. The same problem discovered through a mould complaint is a remediation project. The difference between those two outcomes is knowing early, which is the argument we make in detail in continuous IAQ monitoring versus spot checks.

And it gives you evidence. When a DOSH officer, an insurer or an anxious tenant asks how the space has performed, a continuous record answers the question. A single-day certificate from eleven months ago does not.

Building a monitoring setup that holds up

The practical implementation is not complicated. Place sensors where people actually sit, weighted toward the zones most likely to fail: dense open-plan areas, enclosed meeting rooms, floors at the end of long duct runs, spaces near printing or pantry areas. Log CO2, temperature and relative humidity continuously. Set alert thresholds a margin below the code's limits, so a room that reaches 850 ppm triggers a look before it reaches 1,000 ppm.

CobiNeural does this alongside energy, water and chilled water monitoring, with alerts to WhatsApp or email when a zone drifts out of range, dashboards for daily operations, and reporting you can hand to management or an assessor. It deploys standalone in a tenanted floor with no BMS access, or as an overlay on an existing BMS, PLC or SCADA system where one already exists, which matters when the building owner controls the plant and you control only your demised area.

The point is not to replace the competent assessor the code expects. It is to make sure that when the assessor arrives, the readings they take are the readings your building produces every day, not a number you happened to get lucky on.

If you want to see what continuous IAQ data looks like for a floor like yours, request a demo and we will walk through it with your actual layout.