Malta's Artificial Intelligence Regulations (EU AI Act implementation)

What it is

Malta implements the EU AI Act through two pieces of subsidiary legislation published on 10 October 2025.

The Artificial Intelligence Regulations, Legal Notice 226 of 2025, made under the Malta Digital Innovation Authority Act (Cap. 591) and now consolidated as Subsidiary Legislation 591.05. It designates the Malta Digital Innovation Authority (MDIA) for most AI Act roles and sets national penalties.

The Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025, Legal Notice 227 of 2025, made under the Data Protection Act (Cap. 586). It gives the Information and Data Protection Commissioner (IDPC) a supervisory role over a defined set of high-risk and prohibited uses.

Neither instrument creates new categories of obligation. The duties on providers and deployers come from the EU AI Act itself. The Maltese regulations decide who supervises, how complaints are handled, and what national penalties apply.

Who it applies to

Any operator under the AI Act whose AI systems are placed on the market, put into service or used in Malta. That includes Maltese providers and deployers, importers and distributors, and foreign providers whose systems are used in Malta. Public authorities are covered too, with lower penalty caps.

What it requires

The MDIA leads. Regulation 3 of LN 226 makes the MDIA the market surveillance authority unless another law says otherwise, and the automatic authority where no other has been designated. It is also the single point of contact with the EU, the sole authority for Malta’s AI regulatory sandbox under Article 57, and the notifying authority for conformity assessment bodies, with the National Accreditation Board (Malta) carrying out the assessment and monitoring of those bodies.

Coordination with the MFSA. For high-risk AI systems placed on the market, put into service or used by financial institutions regulated by EU financial services law, the MDIA and the Malta Financial Services Authority must coordinate. The MDIA reports information relevant to prudential supervision, and the MFSA supplies information the MDIA asks for. The MFSA’s own expectations are set out in its June 2026 letter on AI.

The IDPC’s areas. LN 227 designates the IDPC as market surveillance authority for high-risk biometric systems used for law enforcement, border management and justice and democracy (remote biometric identification, biometric categorisation by sensitive attributes and emotion recognition), emergency call evaluation and dispatch systems, law enforcement systems, migration, asylum and border control systems, and AI used in the administration of justice and to influence elections. It also exercises AI Act powers over several prohibited practices, acts as notified body for high-risk systems put into service by law enforcement, immigration or asylum authorities, keeps a national register of the high-risk systems it supervises, and is the fundamental rights authority under Article 77 for the protection of personal data.

Biometric identification by police. Each use of real-time remote biometric identification in publicly accessible spaces for law enforcement needs prior authorisation from a Magistrate, with a 24-hour window in urgent cases, and must be notified to the IDPC. Post-remote biometric identification needs a Magistrate’s authorisation within 48 hours.

National procedural duties. Providers or their authorised representatives must register high-risk AI systems in point 2 of Annex III (critical infrastructure) with the MDIA. Importers provide conformity documentation in Maltese or English on a reasoned request. A provider established in Malta that goes bankrupt or stops trading must still keep its documentation available for ten years.

Fundamental rights bodies. The MDIA publishes a list of the national public authorities and bodies protecting fundamental rights, which hold the AI Act’s powers for those bodies in relation to Annex III high-risk systems.

Penalties. Without prejudice to the AI Act’s own fines, the MDIA can impose up to €350,000 per infringement, or 1% of worldwide annual turnover for an undertaking if higher, and a daily penalty of €12,000. Public authorities face up to €50,000 per infringement and €50 a day. The MDIA can also accept written undertakings, issue reprimands and warnings, and must start proceedings within two years of an infringement. Decisions of the MDIA are appealed under the MDIA Act. Decisions of the IDPC go to the Information and Data Protection Appeals Tribunal.

For an organisation using AI in Malta, the practical work is the same as anywhere in the EU. Know which systems you run and which AI Act role you hold for each, classify them by risk, meet the transparency duties that have applied since 2 August 2026, and prepare for the high-risk obligations. The difference is knowing which Maltese authority will ask the questions.

Key dates

• 10 October 2025. Legal Notices 226 and 227 of 2025 published and in force, except for specified provisions.
• 2 August 2026. The fundamental rights, documentation, language, high-risk registration and sandbox provisions of LN 226 came into force, together with the IDPC’s designations as fundamental rights authority, its biometric authorisation rules, documentation and language rules, national register and complaints procedure under LN 227. The MDIA says these supervision and enforcement powers are exercisable from that date, in line with Article 113 of the AI Act.
• 2 December 2026. New AI Act prohibitions apply and the Article 50(2) marking grace period ends, under the Digital Omnibus on AI.
• 2 December 2027. AI Act obligations for Annex III high-risk systems apply.
• 2 August 2028. AI Act obligations for Annex I product-embedded high-risk systems apply.

How it relates to other frameworks

The EU AI Act sets the obligations, and these regulations supply the Maltese machinery. The IDPC also enforces the GDPR in Malta, so a high-risk system in its area is likely to raise questions under both the AI Act and GDPR Article 22 at once. Financial institutions sit under the MDIA for the AI Act and under the MFSA for prudential and conduct supervision. Malta’s national AI strategy and Ethical AI Framework are policy, not law, but use principles that match the AI Act’s.

A note on this page

This is Aicura’s reading of Malta’s AI Act implementing regulations. It is not legal advice and it is not the legislation itself. Read the primary sources published on legislation.mt and the MDIA’s guidance, and take advice on how they apply to your organisation.