The EU AI Act in Malta

Per Malta - AI Commissioner Designation (227/2025)

• Information and Data Protection Commissioner (IDPC) — Designated Market Surveillance Authority (MSA) for specified high‑risk AI systems; national data protection supervisory authority; enforcement and market surveillance functions under LN 227/2025
• Ministry for Justice and Enforcement / Government of Malta (Department of Information - Gazette) — Publisher of the Government Gazette; national administration supporting designation and publication of Legal Notices

Per Malta - AI Regulations (226/2025)

• Malta Digital Innovation Authority (MDIA) — Primary national Market Surveillance Authority and Notifying Authority for AI; responsible for market surveillance, conformity assessment recognition, regulatory sandbox and enforcement.
• Information and Data Protection Commissioner (IDPC) — Designated national authority for market surveillance of certain high‑risk, data‑sensitive AI systems (per LN 227 of 2025) and custodian of data protection and fundamental rights oversight in AI deployments.
• Malta Financial Services Authority (MFSA) — Sectoral regulator coordinating with MDIA on AI systems used in financial services and supervising sector‑specific compliance where relevant.

Per Malta - Digital Education Strategy

• Ministry for Education, Sport, Youth, Research & Innovation (MEYR) — Policy owner and strategic lead for education policy and the Digital Education Strategy
• Directorate for Digital Literacy and Transversal Skills (DDLTS) — Lead implementing directorate for the Strategy, CPD coordination and device programmes
• Office of the Information and Data Protection Commissioner (ODPC) — Data protection regulator overseeing compliance with data protection obligations for education platforms
• Malta Digital Innovation Authority (MDIA) — Advisory/technical role on secure procurement, digital architecture and innovation governance where applicable

Per Malta - Digital Innovation Authority (XIX/2024)

• Malta Digital Innovation Authority (MDIA) — Primary regulator for digital innovation; issuing recognitions, conducting conformity assessments, market surveillance and enforcement under the amended Act.
• Parliament of Malta (official publication) — Publisher of the Act and authoritative PDF of the statute.
• Department of Information / Government Gazette — Official gazette publication and formal entry into force dissemination.

Per Malta - Digital Strategy (2023-2027)

• Malta Digital Innovation Authority (MDIA) — National authority for digital innovation, standards, certification, and coordination on innovative technologies.
• Malta Information Technology Agency (MITA) — Technical delivery and management of government IT systems, infrastructure and digital security advisory for the Public Administration.
• Malta Communications Authority (MCA) — Regulator for electronic communications, connectivity, and related consumer and market functions.
• Office of the Information and Data Protection Commissioner (IDPC) — National supervisory authority for data protection and enforcement of GDPR obligations.
• Office of the Prime Minister (OPM) — Strategic coordination and political oversight of national digital priorities and inter‑ministerial alignment.

Per Malta - National eSkills Strategy

• eSkills Malta Foundation (functions integrated) — Former coordinator of the National eSkills Strategy; functions integrated into MDIA as implementing body.
• Malta Digital Innovation Authority (MDIA) — Now the principal implementing and coordinating authority following integration of eSkills Foundation functions (from 1 January 2025); supports alignment with innovation and regulatory frameworks.
• Ministry for the Economy, European Funds and Lands — Policy sponsor and convenor for national digital strategy coordination and conferences where strategies were launched.

Per Malta - AI Certification Programme

• Malta Digital Innovation Authority (MDIA) — Primary authority responsible for certification, assurance, registration of technical administrators and systems auditors, sandbox facilitation and market surveillance related to ITAs and AI arrangements.
• Government of Malta / Parliamentary Secretariat for Financial Services, Digital Economy and Innovation — Policy sponsor and collaborator on national AI strategy implementation and public-sector pilot coordination.

Per Malta - Ethical AI Framework

• Malta Digital Innovation Authority (MDIA) — Owner/implementer of AI strategy actions; administrator of voluntary AI certification, responsible for guidance, auditor accreditation and coordination of sandboxes.
• Office of the Prime Minister / Parliamentary Secretariat for Financial Services, Digital Economy and Innovation — Sponsor of the Malta.AI Taskforce and publisher of national AI strategy materials; policy coordination and public consultation host.
• Information and Data Protection Commissioner (IDPC) — Enforcer of data protection obligations under GDPR and Maltese law; relevant for privacy‑related aspects of AI systems.

Per Malta - National AI Strategy

• Malta Digital Innovation Authority (MDIA) — Primary coordinating and oversight authority for the national AI strategy, administrator of the national AI certification programme, registrar of Systems Auditors and national AI portal custodian.
• Office of the Prime Minister / Parliamentary Secretariat for Financial Services, Digital Economy and Innovation — Policy sponsor and public announcement conduit for the strategy; coordinates ministerial-level support and stakeholder engagement.
• Office of the Information and Data Protection Commissioner (IDPC) — Enforcement authority for data protection obligations (GDPR) applicable to personal data processed by AI systems.

Per Malta - Digital Innovation Authority Act (XXXI/2018)

• Malta Digital Innovation Authority (MDIA) — National authority for recognition, certification and oversight of innovative technology arrangements and services; issues guidance, maintains registers and enforces the Act.

Per Malta - AI Commissioner Designation (227/2025)

• Administrative penalty for public authorities or bodies: up to EUR 50,000 for each infringement.
• Daily penalty of EUR 50 for each day the infringement persists.
• Administrative measures available to the IDPC for private operators include warnings, orders to bring processing into compliance, temporary or permanent restrictions on placing AI systems into service, and other non‑monetary corrective measures as permitted under the AI Act and national law.
• Operators and authorities remain liable under civil law for damages arising from unlawful processing; criminal liability may arise under separate national statutes where applicable.
• Decisions by the IDPC imposing penalties or measures are subject to administrative and judicial review under Maltese law.

Per Malta - AI Regulations (226/2025)

• Administrative fines and corrective measures for breaches, including orders to suspend or withdraw non‑compliant AI systems.
• Daily penalties for continuing infringements (national rules provide for daily fines to enforce compliance).
• Civil liability remains available to harmed individuals; regulators may require rectification or compensation actions where applicable.
• Revocation of national notifications/recognitions for conformity assessment bodies or removal from national registers.

Per Malta - Digital Education Strategy

• Administrative corrective actions for implementing units failing to meet assigned milestones or reporting obligations.
• Contractual remedies and penalties under public procurement law for vendors breaching contract terms (including security/data clauses).
• Data-protection enforcement actions under the Data Protection Act for breaches (administrative fines and remedial orders by the ODPC).
• Reputational and managerial consequences within MEYR (reallocation of responsibilities, performance measures).

Per Malta - Digital Innovation Authority (XIX/2024)

• Administrative measures including directions to comply, corrective action requirements, and notices.
• Suspension or revocation of recognitions, registrations, approvals or authorisations granted by the MDIA.
• Financial administrative penalties as may be specified in subsidiary regulations or rules.
• Prohibition on placing a technology or service on the market or continuing operation pending remedial action.
• Other enforcement measures provided by the Act or secondary legislation, including publication of non-compliance.

Per Malta - Digital Strategy (2023-2027)

• The Strategy itself does not create new statutory penalties; compliance incentives are primarily administrative and financial (e.g., funding conditionality).
• Sectoral regulatory penalties (e.g., GDPR fines enforced by the Office of the Information and Data Protection Commissioner) remain applicable where legal requirements are breached.
• Failure to meet publicly signalled milestones may result in reprioritisation of funding, administrative remediation measures or reporting to Cabinet.

Per Malta - National eSkills Strategy

• The Strategy itself does not create criminal penalties; non‑compliance may affect eligibility for public funding and partnership opportunities.
• Entities failing to meet contractual obligations under funded programmes may be subject to standard funding recovery, suspension or ineligibility measures as set out in grant agreements.
• Reputational impacts and loss of priority status in national initiatives are potential practical consequences for persistent non‑delivery.

Per Malta - AI Certification Programme

• Refusal to grant certification where requirements are unmet.
• Suspension or revocation of MDIA-issued certificates for material non-compliance.
• Imposition of administrative fees and fee recovery where prescribed by subsidiary legislation.
• Publication of adverse findings or sanctions affecting reputational standing and market access.
• Obligation to remediate within timeframes or face escalated administrative measures.
• Referral to sectoral regulators or enforcement authorities where statutory breaches are identified (including data protection authorities under GDPR).

Per Malta - Ethical AI Framework

• The Framework itself imposes no statutory fines or criminal penalties.
• Non‑compliance may affect eligibility for Malta’s voluntary AI certification and influence procurement or market acceptance.
• Sectoral or existing statutory regimes (e.g., GDPR) continue to apply and can result in enforcement actions and fines by competent authorities for breaches (e.g., data protection violations).
• Reputational and contractual consequences in private contracts or public procurement if ethical controls are absent or inadequate.

Per Malta - National AI Strategy

• Administrative consequences tied to the certification programme, including suspension or revocation of certification for non-compliant systems.
• Ineligibility for public procurement preference where a supplier refuses or fails to meet certification or ethical framework requirements.
• Enforcement under existing legal regimes (e.g., GDPR fines and penalties) where data protection breaches occur.
• Remediation orders and corrective action plans required by MDIA or relevant sectoral regulator for systems that pose unacceptable risks.
• Reputational sanctions through public reporting and delisting from MDIA registries.

Per Malta - Digital Innovation Authority Act (XXXI/2018)

• Administrative sanctions including fines and penalties for non-compliance with directives and conditions of recognition.
• Suspension or revocation of recognition, certification or authorisation issued by the MDIA.
• Public censure and publication of enforcement actions or decisions in public registers.
• Remedial directions requiring corrective measures (including technical remediation and governance changes).
• Referral to other national authorities for criminal or civil action where breaches engage other laws (e.g., AML, data breaches).