Firmus and OpenAI's Malaysia Deal: Map the AI Workload Boundary

What Firmus and OpenAI announced

The Sydney-headquartered infrastructure company said the multi-year partnership covers dedicated AI compute at two Malaysian sites. OpenAI becomes an anchor customer supporting further capacity across Firmus' regional platform. Firmus says its contracted customer portfolio now exceeds 900 MW across seven AI factories in Australia, Singapore, Indonesia and Malaysia.

That figure is contracted portfolio capacity, not capacity operating today. Firmus says two sites are operational in Australia and Singapore, while five are under development and target ready-for-service over the next 24 months. Reuters independently reported the partnership on 8 September. The public announcement does not disclose the Malaysian site locations, commercial value, workload split or the amount of capacity assigned to OpenAI.

A facility location is not a workload boundary

Firmus describes its infrastructure as sovereign and says the Malaysian sites will use NVIDIA's DSX AI Factory Platform, Vera Rubin NVL72 systems and Firmus' HyperCube design. Those are provider statements about the planned infrastructure. They do not, on their own, establish where a customer's data is stored, which people can access it, where orchestration runs or which legal entities deliver the service.

A workload can cross several systems even when accelerators sit in one country. Inputs may arrive through a global application; identity and billing may run elsewhere; telemetry may be aggregated in another region; backups may use a separate provider; and support personnel may connect remotely. Business leaders should therefore approve an end-to-end service boundary, not infer one from a data-centre address.

Use a five-part workload-boundary test

Before committing a regulated, confidential or operationally critical workload, require a current architecture and responsibility record covering five questions:

• Data: where prompts, uploaded files, embeddings, fine-tuning data, outputs, logs and backups are stored and processed.
• Control: where identity, keys, model routing, policy enforcement, monitoring and administrative consoles operate.
• People: which provider, subcontractor and support roles can access each environment, from which countries and under what approval.
• Evidence: how the provider proves commissioned capacity, isolation, deletion, recovery, incident response and service performance.
• Exit: which artefacts can be exported, in what format and time, with a tested migration path and a defined deletion certificate.

Separate future capacity from present service

Anchor-customer agreements can improve financing certainty and signal demand, but a buyer still needs phase-specific acceptance criteria. Treat power availability, network readiness, cooling performance, accelerator delivery, security accreditation and workload acceptance as separate milestones. Firmus says it integrates power, cooling, computing, networking, software and workload performance, and publishes real-time energy, thermal and compute data. Procurement should state which of those measurements the customer receives and what remedy applies when a threshold is missed.

NIST's supply-chain risk guidance recommends managing supplier risk throughout acquisition, operations and disposal, then reassessing when conditions change. For AI compute, useful triggers include a site delay, a new subcontractor, a control-plane relocation, a hardware substitution or a material change to support access.

What business leaders should do next

Ask the infrastructure owner, cloud provider and application vendor to sign the same workload-boundary diagram. Assign an internal owner to each boundary crossing, attach measurable evidence and run a small export-and-recovery exercise before production approval. If one party cannot explain a control or exit path, record the dependency rather than assuming another provider owns it.

ELYMENT AI's analyses of TCS HyperVault's metered infrastructure proof, Anthropic's enterprise data-retention plan and Flower Labs' private-deployment trade-offs provide related tests. ELYMENT AI can help turn those questions into a procurement scorecard and operating control set for a specific workload.

Sources

• Firmus: OpenAI anchor-customer partnership (8 September 2026) - Primary announcement covering the two Malaysian sites, OpenAI's anchor-customer role, Firmus' contracted portfolio, regional footprint and intended platform design.
• Reuters: Firmus signs OpenAI Malaysia capacity deal (8 September 2026) - Independent reporting confirming the multi-year partnership and Malaysia expansion.
• Firmus: Engineering principles (Accessed 8 September 2026) - First-party description of Firmus' integrated infrastructure, measurement and transparency approach.
• NIST SP 800-161 Rev. 1: Cybersecurity supply-chain risk management (November 2024) - Authoritative guidance on supplier risk across acquisition, operations, monitoring, change and disposal.

Continue learning

• TCS HyperVault: require metered infrastructure proof
• Review enterprise AI data-retention boundaries
• Compare managed and private AI deployment responsibility

Related analysis

• JERA's Chiba AI Infrastructure: Buy Capacity as a System

  JERA, Dell and RHAELM plan a 400 MW AI site in Chiba for 2028. Learn how to test power, cooling, compute, financing and recovery as one system.

• Lambda’s Oklahoma AI Data Centre: Put Community Costs in the Contract

  Lambda plans an Oklahoma AI data centre under new ratepayer protections. Learn which power, water and community obligations buyers should verify.

• Stargate UAE Rethink: Why AI Capacity Needs Failure Domains

  The reported Stargate UAE redesign shows why AI data-centre strategy needs distributed failure domains, tested recovery and resilient supplier contracts.

Frequently asked questions