Malta - Digital Innovation Authority (XIX/2024)

Overview

The Malta Digital Innovation Authority (Amendment) Act, Act No. XIX of 2024 (published 14 June 2024), amends the principal Malta Digital Innovation Authority Act (Cap. 591) to modernise the statute, expand institutional powers and provide a clearer enforcement framework. The amendment restructures the Act into thematic Parts (Preliminary, Principles, Establishment and Functions, Staff, Finance, Recognition, Enforcement & Sanctions, Administrative Review, Miscellaneous, and Schedules), revises core definitions (including "innovative technology" and "recognition"), substitutes outdated terminology and creates new statutory mechanisms to support a proactive regulatory approach. The text and official PDF are available from the Parliament of Malta and the national legislation portal; see the official parliamentary PDF Act No. XIX of 2024 (PDF) and the ELI entry hosted by the Maltese legislation portal at legislation.mt.

Definitions

The Amendment expands and harmonises statutory definitions to reflect contemporary technology and regulatory practice. Notable definitional changes include: replacement of gendered terms (e.g., "Chairman" to "Chairperson"); an expanded definition of "innovative technology" to explicitly include a broad non-exhaustive list of digital technologies and their associated products, solutions and services (referencing the First Schedule); clarification that "recognition" encompasses licences, registrations, authorisations, approvals, certifications and other formal instruments the Authority may issue; inclusion of definitions for "Board", "Authority", "user", "Minister" and cross-references to other Maltese Acts (notably Cap. 490 – Administrative Justice, and Cap. 586 – Data Protection). The new definitions emphasise the MDIA’s role in protecting public and user interests, and confirm that the Authority’s remit extends beyond users in Malta to public/users in other jurisdictions if relevant.

Governance and Institutional Framework

The Act reconstitutes the statutory governance structure of the MDIA by updating the Board composition, appointment mechanics, and role descriptions. It clarifies the powers of the Chairperson and Board, formalises delegation and authorisation powers, and sets out the Authority’s fiduciary, staffing and financial arrangements. The Amendment provides for a dedicated section on officials and employees (appointment, duties and protections), and strengthens the statutory basis for issuing guidelines and regulations. The reorganisation supports administrative efficiency by enabling the MDIA to undertake delegated tasks, enter into cooperative arrangements with other national or EU authorities, and to represent Malta in international/regulatory fora. For the official institutional text, see the parliamentary publication Act No. XIX of 2024 (PDF) and the consolidated listing at legislation.mt.

Key Focus Areas

The Amendment emphasises a set of operational and regulatory priorities: (1) recognition and conformity assessment — empowering the MDIA to issue recognitions (licenses, registrations and approvals) and to supervise conformity assessment processes; (2) market surveillance and enforcement — introducing enhanced surveillance, inspection powers and administrative measures to address non-compliance; (3) risk-based oversight — enabling targeted supervision of higher-risk technologies and services; (4) accountability and documentation — requiring records, transparency and traceability for registered/recognised entities; (5) user protection and fundamental rights — consolidating safeguards and clarifying exclusions for defence or criminal law; (6) administrative review — establishing a Tribunal-oriented appeals route for administrative decisions; and (7) international cooperation — facilitating cross-border regulatory coordination. These priority areas align the MDIA’s remit with EU digital governance trends and facilitate Malta’s operational readiness for sectoral EU instruments and designation as a competent authority where applicable. The MDIA’s public pages summarise its services and priorities: Malta Digital Innovation Authority homepage and specific service pages such as MDIA – Artificial Intelligence.

Implementation Framework

The Act sets out an implementation pathway that relies on a combination of primary statutory powers and secondary instruments (regulations, rules and guidelines) to operationalise details such as application procedures, fees, recognition criteria and enforcement processes. The Amendment grants the Minister and the MDIA powers to make subsidiary legislation and guidance to fill technical requirements, and to remove or modify parts of the prior schedules to keep the legal framework adaptable to technological change. The MDIA may also enter into memoranda of understanding with other national authorities to coordinate functions such as data protection and sectoral supervision — complementing Malta’s broader approach to the EU Data Act and future AI governance responsibilities. For practical guidance, the MDIA publishes service guidance and templates at MDIA Services.

Monitoring and Evaluation

The Amendment imposes monitoring and evaluation responsibilities on the Authority to ensure the effectiveness of recognitions, compliance measures and market surveillance. The MDIA is empowered to collect information, require records, carry out inspections and commission assessments of recognised technologies. The Act anticipates periodic review of regulatory measures and the power to adjust enforcement intensity according to observed risk patterns. The availability of an Administrative Review mechanism provides an independent administrative oversight channel and supports transparency and accountability in decision-making.

Penalties, Liability, and Appeals

The Act strengthens enforcement by clarifying administrative sanctions and remedies the MDIA may impose (including suspension, revocation of recognitions, directions to comply, and administrative fines or measures as prescribed in subsidiary rules). It also preserves access to the Tribunal for administrative review and provides procedural safeguards for affected parties. Liability provisions cover revocation consequences and the Authority’s discretionary powers in the event of serious risks to users or the public. The Amendment is explicit that public safety, defence and criminal law matters remain outside the MDIA’s substantive regulatory reach, while administrative penalties are used for regulatory compliance enforcement.

Relationship to Other Instruments

The Amendment expressly amends Cap. 591 and makes consequential references to other Maltese statutes (including Cap. 490 Administrative Justice and Cap. 586 Data Protection) and revokes or replaces certain subordinate instruments (the ELI entry notes revocation of S.L. 592.1 and Cap. 592 related instruments). It is designed to be compatible with EU-level regulatory instruments affecting digital and data governance; subsequent subsidiary instruments (Legal Notices and Regulations) may designate the MDIA as Competent Authority for specific EU Acts where appropriate. For statutory cross-references see ELI: Act No. XIX of 2024.

International Alignment

The Act aligns Malta’s national framework with prevailing EU objectives to regulate digital innovation responsibly and to support conformity assessment, market surveillance, and cross-border cooperation. By providing flexible recognition instruments and enhanced enforcement capacity, the statute prepares the MDIA to act where national designation is required under EU-level measures (for example, in areas touching upon AI and data governance). The MDIA’s public materials highlight engagement with EU processes and readiness to serve as national competent authority where designated; see MDIA guidance at MDIA.

Implementation Timeline

Sources and References