Malta AI Regulation Overview

Overview

Malta's regulatory philosophy for artificial intelligence balances the proactive promotion of technological innovation with rigorous, fundamental-rights-focused oversight. The foundation of Malta's AI governance landscape was laid with the enactment of the Malta Digital Innovation Authority Act (Cap. 591) in 2018 and the publication of its national AI strategy, "Malta — The Ultimate AI Launchpad: A Strategy and Vision for Artificial Intelligence in Malta 2030" in 2019. This framework positioned Malta as a compact, testing-friendly jurisdiction supporting the development, prototyping, and scaling of innovative technology arrangements, including AI systems, distributed ledger technologies (DLT), and smart contracts.

In October 2025, Malta operationalized its national compliance structure for the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) through twin legal notices. Legal Notice 226 of 2025 designated the Malta Digital Innovation Authority (MDIA) as the default national Market Surveillance Authority (MSA) and Notifying Authority for conformity assessment bodies. Concurrently, Legal Notice 227 of 2025 designated the Information and Data Protection Commissioner (IDPC) as the designated MSA for specific data-sensitive and high-risk AI system categories listed in Annex III of the EU AI Act. This dual-authority model integrates technical and product-safety oversight with privacy and fundamental-rights protections.

Regulatory Approach

Malta employs a hybrid regulatory approach that combines binding statutory enforcement of EU instruments with voluntary, risk-based certification regimes and ethical soft-law principles. Under Legal Notices 226 and 227 of 2025, mandatory obligations apply to providers, deployers, and operators of high-risk AI systems, including risk management documentation, technical logging, conformity assessments, and post-market surveillance. For sensitive law enforcement deployments involving real-time remote biometric identification (RBI) in publicly accessible spaces, the legal framework mandates prior ex-ante authorization by a Magistrate alongside formal notification to the IDPC.

Alongside binding legislative requirements, Malta maintains voluntary assurance frameworks. The Innovative Technology Arrangements and Services (ITAS) certification scheme, formalised under Subsidiary Legislation 591.01, provides voluntary certification pathways for AI systems assessed against MDIA control objectives. Operational guidance is guided by the non-binding guidance document "Malta — Towards Ethical and Trustworthy AI" (2019), which sets out four core ethical principles: human autonomy, prevention of harm, fairness, and explicability. To encourage safe testing, MDIA operates regulatory sandboxes, including the Technology Assurance Sandbox (MDIA-TAS) launched in 2021 and the national AI regulatory sandbox established under LN 226 of 2025.

Key AI Legislation

• Legal Notice 226 of 2025 (Artificial Intelligence Regulations, 2025): Published on 10 October 2025, this Legal Notice serves as Malta's primary implementing legal instrument for the EU AI Act. It designates MDIA as the default Market Surveillance Authority and Notifying Authority, regulates national AI sandboxes, and defines market surveillance and enforcement procedures.
• Legal Notice 227 of 2025 (Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025): Issued under the Data Protection Act (Cap. 586), this Legal Notice designates the IDPC as MSA for specified Annex III high-risk AI systems (including law enforcement biometrics, emergency call triage, border management, and judicial administration) and introduces prior Magistrate authorization rules for real-time remote biometric identification.
• Malta Digital Innovation Authority (Amendment) Act, 2024 (Act No. XIX of 2024): Amends Cap. 591 to update definitions (including "innovative technology"), formalise public interest protections, establish an Administrative Review Tribunal appeal pathway, and restructure enforcement powers.
• Malta Digital Innovation Authority Act (Cap. 591 / Act No. XXXI of 2018): The principal statute establishing the MDIA, defining innovative technology arrangements and services, and setting statutory powers for recognition, registration, and supervision.
• ITAS Certification Regulations (Subsidiary Legislation 591.01): Subsidiary legislation specifying the voluntary certification regime, control objectives, and registration processes for systems auditors and technical administrators.
• Malta — The Ultimate AI Launchpad: Strategy and Vision 2030 (2019): National strategic document setting out 72 short-term action points and long-term targets across three pillars (Investment, Public Sector Adoption, Private Sector Adoption) and three enablers (Education, Legal/Ethical Framework, Infrastructure).
• Malta — Towards Ethical and Trustworthy AI (2019): Non-binding ethical guidelines translating global AI principles into concrete control practices.

Governance & Enforcement Bodies

Institutional oversight of AI in Malta is divided primarily between two statutory authorities working in coordination with sectoral regulators and judicial bodies. The Malta Digital Innovation Authority (MDIA) serves as the primary national regulator for digital innovation, default Market Surveillance Authority under the EU AI Act, and Notifying Authority for conformity assessment bodies. The MDIA is responsible for operating the national AI regulatory sandbox, issuing technical guidelines, maintaining registries of systems auditors and technical administrators, and leading national digital skills integration following the absorption of the eSkills Malta Foundation's functions on 1 January 2025.

The Information and Data Protection Commissioner (IDPC) acts as the designated Market Surveillance Authority for Annex III high-risk AI systems where fundamental rights, data protection, and biometrics are implicated. The IDPC oversees mandatory notifications submitted by operators under Article 5(6) of the EU AI Act and monitors compliance with personal data safeguards. Specialized deployments of real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement require prior judicial authorization granted by a Magistrate. Where regulatory decisions are contested, administrative appeals are heard before the Administrative Review Tribunal established under national law.

Penalties & Enforcement

Enforcement powers and administrative sanctions are specified under both Legal Notice 226 and Legal Notice 227 of 2025, operating alongside the powers granted in the Malta Digital Innovation Authority Act (Cap. 591). Under Legal Notice 227 of 2025, the IDPC is authorized to impose administrative penalties against public authorities or public bodies of up to EUR 50,000 per infringement for non-compliance with EU AI Act obligations, together with a daily penalty of EUR 50 for persistent ongoing breaches.

Legal Notice 226 of 2025 grants the MDIA comprehensive enforcement levers over operators and providers, including the right to conduct inspections, compel technical records, mandate corrective actions, order system withdrawals or recalls, and issue daily administrative fines. In relation to voluntary ITAS certifications under Cap. 591, MDIA enforcement mechanisms include refusal, formal suspension, or revocation of technology certificates and public disclosures of regulatory non-compliance. Affected parties may seek judicial review of administrative sanctions before the Administrative Review Tribunal.

Data Protection Framework

Data protection principles form a core pillar of Malta's AI governance architecture, governed primarily by the Data Protection Act (Cap. 586) and Regulation (EU) 2016/679 (GDPR). The strategic assignment of MSA responsibilities for high-risk, data-intensive AI systems to the IDPC under LN 227 of 2025 ensures that market surveillance directly incorporates fundamental rights, purpose limitation, data minimization, and privacy-by-design requirements.

Deployers of Annex III high-risk AI systems must adhere to mandatory documentation, logging, and notification procedures. Where AI applications process personal data, operators are required to execute Data Protection Impact Assessments (DPIAs) and establish strict governance protocols. For sensitive applications involving real-time remote biometric identification in public areas, national legal safeguards mandate dual oversight: prior legal approval from a Magistrate and operational reporting to the IDPC excluding sensitive operational data.

Sector-Specific Rules

Sector-specific requirements apply to high-impact domains where AI systems create heightened operational or social risks. In law enforcement, border control, and judicial administration, AI deployment is tightly restricted under LN 227 of 2025, requiring adherence to Annex III controls and judicial approval for real-time remote biometric surveillance. AI systems used to classify emergency calls or prioritize dispatch for first responders are similarly categorized as high-risk systems subject to mandatory IDPC surveillance.

In the education sector, the Digital Education Strategy 2024–2030 (coordinated by MEYR and DDLTS) frames the integration of digital tools, eSafety, and AI literacy across primary and secondary curricula through 16 measures and approximately 50 strategic actions. For financial services and general public administration, the MDIA coordinates surveillance with sectoral regulators such as the Malta Financial Services Authority (MFSA) and technical agencies like the Malta Information Technology Agency (MITA) under established cooperation frameworks.

International Alignment

Malta's legal and strategic AI framework is fully harmonized with European Union legislation and international guidelines. Legal Notices 226 and 227 of 2025 directly implement the national supervisory infrastructure required by the EU AI Act (Regulation (EU) 2024/1689). Maltese authorities participate in the European Artificial Intelligence Board, liaise with the EU AI Office, and contribute to cross-border market surveillance coordination.

In addition, Malta's strategic policy instruments—including the Malta Digital Strategy 2023–2027 and the National eSkills Strategy 2022–2025—align national benchmarks with the EU Path to the Digital Decade targets. The 2019 Malta Ethical AI Framework explicitly incorporates guidance from the European Commission High-Level Expert Group (HLEG) on AI and the OECD Principles on Artificial Intelligence, promoting cross-border interoperability and international recognition.

Future Developments

Malta is actively updating its strategic landscape to match rapid technological changes and European regulatory milestones. The MDIA is leading a comprehensive realignment of "Malta — The Ultimate AI Launchpad: Strategy and Vision 2030," with scheduled completion in 2025, to update national action points, pilot projects, and economic incentives in light of the EU AI Act.

Further structural developments include the full operational integration of the eSkills Malta Foundation into the MDIA (effective 1 January 2025) to centralize digital skills development alongside regulatory oversight. The MDIA is also advancing the rollout of its Technology Assurance Assessment Framework (TAAF) and expanding access to national AI regulatory sandboxes under LN 226 of 2025 to enable controlled testing for emerging generative and general-purpose AI models.

Enforcement Bodies