Malta - AI Regulations (226/2025)

Overview

Legal Notice 226 of 2025 ("Artificial Intelligence Regulations, 2025") is Malta's primary national implementing instrument for the EU Artificial Intelligence Act framework. Published in the Government Gazette on 10 October 2025, LN 226 designates the Malta Digital Innovation Authority (MDIA) as the principal national market surveillance authority and Notifying Authority for the recognition of conformity assessment bodies in relation to AI systems. The Notice establishes national enforcement powers, reporting and registration arrangements, and the national AI regulatory sandbox. LN 226 is intended to complement and operate alongside Legal Notice 227 of 2025, which designates the Information and Data Protection Commissioner (IDPC) for certain data‑sensitive and Annex III high‑risk AI systems. For an official announcement and summary of designations, see the IDPC notice and the MDIA website for guidance materials and tools.

Definitions

LN 226 incorporates key definitions aligned with the EU AI Act (e.g., "AI system", "provider", "operator", "user", "high‑risk AI system", "conformity assessment", "market surveillance authority"). The Legal Notice clarifies national terms where necessary (for example, specifying the MDIA as the "Notifying Authority" and defining "national market surveillance" processes). These definitions are functionally harmonised with Regulation (EU) 2024/1689 to ensure consistent interpretation across Member States while allowing LN 226 to designate specific national bodies and procedural rules for Malta.

Governance and Institutional Framework

Under LN 226, the Malta Digital Innovation Authority (MDIA) is assigned primary supervisory duties including: acting as Malta's default Market Surveillance Authority (MSA) for AI systems not specifically allocated to another authority; serving as the Notifying Authority responsible for recognising conformity assessment bodies; operating the national AI regulatory sandbox; issuing guidance and non‑binding technical standards; and coordinating national enforcement and international cooperation. The Legal Notice requires MDIA to coordinate with the Information and Data Protection Commissioner (IDPC) and sectoral regulators (e.g., the Malta Financial Services Authority) when systems overlap sectoral or data protection competencies. LN 226 establishes formal cooperation and information‑sharing channels, requires memoranda of understanding between agencies where appropriate, and sets out the procedure for referral of cases between MDIA and other competent authorities to ensure clarity of responsibilities and to avoid regulatory gaps or duplication.

Key Focus Areas

LN 226 emphasises a risk‑based supervisory model mirroring the EU approach and focuses on: (1) conformity assessment and registration for high‑risk AI systems; (2) mandatory risk management systems, technical documentation and data governance; (3) transparency obligations (user notices, deepfake labeling, general‑purpose model disclosures where relevant); (4) human oversight and operational limits on automated decision‑making; (5) cybersecurity and model security (including requirements for vulnerability management, patching and secure design); (6) post‑market monitoring and incident reporting duties; and (7) market surveillance and enforcement powers including corrective measures, recalls, and administrative fines. The Notice also addresses novel national mechanisms such as the MDIA‑operated regulatory sandbox to support innovation while safeguarding rights, and processes to coordinate cross‑border enforcement with EU authorities and notified conformity assessment bodies.

Implementation Framework

LN 226 specifies practical steps for implementation: MDIA is tasked with developing secondary guidance and templates (for technical documentation, post‑market monitoring reports, and risk management records); procedures for registration and national importation/distribution oversight; accreditation and notification of conformity assessment bodies (in line with national accreditation rules and EU standards); inspection protocols and sampling methodologies for market surveillance; and formal rules to run the national AI regulatory sandbox with confidentiality and IP safeguards for participants. The Legal Notice mandates that providers and importers maintain technical files and make them available to MDIA and other competent authorities on request, and prescribes timelines for conformity assessment outcomes and corrective actions where non‑conformity is detected.

Monitoring and Evaluation

LN 226 establishes continuous monitoring mechanisms. Providers of high‑risk AI systems must implement post‑market monitoring and report serious incidents or malfunctions to MDIA (and IDPC where personal data or fundamental rights issues arise). MDIA is required to publish periodic enforcement and market‑surveillance reports, to maintain a register of notified conformity assessment bodies, and to evaluate the national sandbox outcomes. The Notice introduces metrics for assessing regulatory impact (compliance rates, incidents reported, corrective actions taken, time to close enforcement files) and foresees stakeholder consultations to refine guidance and harmonise practice with EU and international standards.

Penalties, Liability, and Appeals

LN 226 grants MDIA administrative enforcement powers including inspections, orders to suspend or withdraw non‑compliant systems, and the imposition of administrative fines for breaches. National reporting indicates that MDIA may levy significant sanctions calibrated to severity, including fixed fines and daily penalties for ongoing breaches; secondary reporting on the instrument references national maximums and proportionality principles for penalties. The Legal Notice also preserves existing civil and criminal liability pathways under Maltese law, including rights for affected persons to seek civil remedies. Procedural safeguards include rights of appeal against administrative decisions to independent tribunals and requirements that enforcement decisions be reasoned and proportionate.

Relationship to Other Instruments

LN 226 operates in tandem with the EU AI Act and complementary national measures. It explicitly coordinates with Legal Notice 227 of 2025, which designates the IDPC as the Market Surveillance Authority for certain Annex III high‑risk AI systems and data‑sensitive implementations. LN 226 references the Data Protection Act (Cap. 586), sectoral rules (e.g., MFSA rules for financial services; health sector legislation), and national cybersecurity guidelines. It instructs MDIA to enter into MoUs with sectoral authorities and to rely on established accreditation and conformity infrastructures where possible, thereby ensuring that national implementation is consistent with both sectoral protections and data protection obligations.

International Alignment

LN 226 deliberately aligns Maltese domestic measures with the EU AI Act and international standards to ensure interoperability and facilitate cross‑border trade in AI systems. The Legal Notice tasks MDIA with cooperation in the European AI Board, participation in EU market surveillance networks, and recognition of conformity assessment bodies in line with EU rules. LN 226 also encourages alignment with international standards for AI safety, cybersecurity (e.g., ISO/IEC series), and data governance to reduce fragmentation and to help local providers comply with external market requirements.

Implementation Timeline

Sources and References