AI regulation in Malta: the EU AI Act (2026)

Yes. As an EU member, Malta is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.

It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.

It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.

Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.

Regulation (EU) 2024/1689, published in the EU Official Journal on 12 July 2024 and in force from 1 August 2024, applies directly in Malta without transposition. It establishes a four-tier risk classification (prohibited, high-risk, limited-transparency, minimal-risk) with phased application dates running from February 2025 through August 2026.

Legal Notice 226 of 2025 (Artificial Intelligence Regulations, S.L. 591.05), gazetted 10 October 2025, is Malta's national instrument designating competent authorities, establishing procedural rules for market surveillance, and setting out domestic penalty procedures aligned with Article 70-99 of the EU AI Act.

The Malta Digital Innovation Authority (MDIA), established in 2018, is designated under L.N. 226/2025 as Malta's default market surveillance authority, notifying authority for conformity assessment bodies, and operator of the national AI regulatory sandbox. It also serves as Malta's single point of contact with the European AI Office.

Legal Notice 227 of 2025 designates the Information and Data Protection Commissioner (IDPC) as a co-market surveillance authority specifically for AI systems used in law enforcement contexts, reflecting the intersection of the EU AI Act with GDPR and the Law Enforcement Directive.

The MDIA may impose administrative fines of up to €350,000 or 1% of total worldwide annual turnover (whichever is higher) per infringement, plus daily penalties of up to €12,000 for continuing violations. These figures mirror the EU AI Act's penalty ceilings scaled for Malta's SME-heavy economy.

The MDIA operates a national AI regulatory sandbox that grants SMEs and start-ups a controlled testing environment and priority access. This implements Article 57 of the EU AI Act and is intended to position Malta as an AI-friendly jurisdiction within the EU regulatory perimeter.