AI regulation in Malta (2026)

Regulation (EU) 2024/1689, published in the EU Official Journal on 12 July 2024 and in force from 1 August 2024, applies directly in Malta without transposition. It establishes a four-tier risk classification (prohibited, high-risk, limited-transparency, minimal-risk) with phased application dates running from February 2025 through August 2026.

Legal Notice 226 of 2025 (Artificial Intelligence Regulations, S.L. 591.05), gazetted 10 October 2025, is Malta's national instrument designating competent authorities, establishing procedural rules for market surveillance, and setting out domestic penalty procedures aligned with Article 70–99 of the EU AI Act.

The Malta Digital Innovation Authority (MDIA), established in 2018, is designated under L.N. 226/2025 as Malta's default market surveillance authority, notifying authority for conformity assessment bodies, and operator of the national AI regulatory sandbox. It also serves as Malta's single point of contact with the European AI Office.

Legal Notice 227 of 2025 designates the Information and Data Protection Commissioner (IDPC) as a co-market surveillance authority specifically for AI systems used in law enforcement contexts, reflecting the intersection of the EU AI Act with GDPR and the Law Enforcement Directive.

The MDIA may impose administrative fines of up to €350,000 or 1% of total worldwide annual turnover (whichever is higher) per infringement, plus daily penalties of up to €12,000 for continuing violations. These figures mirror the EU AI Act's penalty ceilings scaled for Malta's SME-heavy economy.

The MDIA operates a national AI regulatory sandbox that grants SMEs and start-ups a controlled testing environment and priority access. This implements Article 57 of the EU AI Act and is intended to position Malta as an AI-friendly jurisdiction within the EU regulatory perimeter.