Malta
EU AI Act implementation, 2026
Malta enacted its national AI Act framework in October 2025 via two legal notices that make the MDIA the lead market surveillance authority, notifying authority and single point of contact, with the IDPC covering rights-sensitive high-risk systems. The national regulatory sandbox has a legal basis but no confirmed launch.
- Implementing law
- EnactedOct 2025
- Penalty regime (Art. 99)
- Adopted
- Regulatory sandbox
- Planned
- Readiness rank
- 7 of 27score 80 / 100
Key findings
- Malta met the Article 70 designation deadline in substance: a two-authority model (MDIA lead, IDPC for rights-sensitive systems) was fixed in secondary legislation in October 2025.
- The MDIA holds every central role at once - market surveillance, notifying authority, single point of contact and sandbox operator - making Malta one of the most centralised set-ups in the EU.
- National penalty provisions and daily fines exist in L.N. 226, so the Article 99 penalty regime is operational from August 2026.
- The regulatory sandbox exists on paper only; no call for participants was found, though Malta now has until August 2027 under the Omnibus.
- The 2019 national AI strategy (vision to 2030) is being realigned; no replacement strategy has been published.
National authorities
Malta Digital Innovation Authority (MDIA)
Lead/default market surveillance authority for most AI systems; also notifying authority, single point of contact and designated operator of the national AI regulatory sandbox (L.N. 226 of 2025)
legislation.mt (opens in new tab)Information and Data Protection Commissioner (IDPC)
Market surveillance authority for Annex III high-risk systems in biometrics, emergency calls, law enforcement, migration/border control and administration of justice/democratic processes; enforces prohibited practices; fundamental-rights authority for data protection (L.N. 227 of 2025)
legislation.mt (opens in new tab)Malta Digital Innovation Authority (MDIA)
Implementing law, penalties and sandbox
Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025) and Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)
Oct 2025
legislation.mt (opens in new tab)National rules on penalties under Article 99 have been laid down.
L.N. 226 of 2025 designates the MDIA as the sole national competent authority responsible for establishing and running a national AI regulatory sandbox. No public call for applications or operational launch was found as of October 2026; the EU deadline for at least one sandbox was moved to 2 August 2027 by the Digital Omnibus on AI. The MDIA's older Technology Assurance Sandbox is a separate, pre-existing scheme.
mdia.gov.mt (opens in new tab)Malta: The Ultimate AI Launchpad - A Strategy and Vision for Artificial Intelligence in Malta 2030
2019
mdia.gov.mt (opens in new tab)Notable developments
-
Legal Notices 226 and 227 of 2025 published
Published in the Government Gazette on 10 October 2025, L.N. 226 designates the MDIA as principal market surveillance authority, notifying authority and single point of contact and gives it national penalty and sandbox powers; L.N. 227 designates the IDPC for specified high-risk and prohibited-practice areas.
bdo.com.mt (opens in new tab) -
National penalty and biometric-authorisation rules set out
Commentary on the legal notices reports MDIA administrative penalties of up to EUR 350,000 or 1% of worldwide annual turnover (whichever is higher) with daily penalties of up to EUR 12,000 for continuing infringements, and prior Magistrate authorisation for real-time remote biometric identification by law enforcement.
ganado.com (opens in new tab) -
IDPC flags revised EU timelines after Digital Omnibus approval
The IDPC publicly noted that the AI regulatory sandbox deadline moved to 2 August 2027 and that transparency duties still applied from 2 August 2026, following Council approval of the Digital Omnibus on AI.
idpc.org.mt (opens in new tab) -
Malta classed as an AI Act 'frontrunner' in Deloitte Legal benchmarking
A July 2026 Deloitte Legal comparison (as reported by Edupedu) grouped Malta with Cyprus, Finland, Hungary, Ireland, Italy and Slovenia as states where Article 70 designations are in force, the single point of contact works and sanctions are operational or nearly so.
edupedu.ro (opens in new tab) -
National enforcement powers become exercisable
MDIA material states that the market surveillance and enforcement powers under the national framework are exercisable from 2 August 2026, in line with Article 113 of the AI Act, with the nudifier prohibition and Article 50(2) watermarking transition applying from 2 December 2026.
mdia.gov.mt (opens in new tab)
Analysis
Malta chose the fastest route available to a small member state: rather than a parliamentary act, it used two legal notices under the Malta Digital Innovation Authority Act, published on 10 October 2025. L.N. 226 of 2025 gives the MDIA the default market surveillance role, the notifying authority role, the single point of contact function and the mandate to build the national regulatory sandbox, while L.N. 227 of 2025 carves out the rights-sensitive Annex III categories (biometrics, law enforcement, migration, justice) for the Information and Data Protection Commissioner. The MDIA also coordinates with the MFSA on high-risk AI in financial services.
Because the framework also contains national administrative penalties (reported at up to EUR 350,000 or 1% of worldwide turnover, plus daily penalties), Malta is one of the few states in this group where sanctions are legally available from 2 August 2026. Deloitte Legal's July 2026 benchmarking accordingly placed Malta in the frontrunner tier with Slovenia, Italy, Ireland, Finland, Cyprus and Hungary.
The weak spots are capacity and the sandbox. The MDIA is a small regulator now carrying four distinct AI Act functions, and the national AI regulatory sandbox, although legally anchored in L.N. 226, had no public call or launch date in any source checked. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the sandbox deadline to 2 August 2027, which gives Malta breathing room but also means the 'full' status rests on legal designation rather than demonstrated operational enforcement.
EU AI Act 2026 Q3 Report
All 27 member-state profiles including Malta, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.
Sources
- Malta Digital Innovation Authority (MDIA) (opens in new tab) legislation.mt
- Information and Data Protection Commissioner (IDPC) (opens in new tab) legislation.mt
- Notifying authority: Malta Digital Innovation Authority (MDIA) (opens in new tab) ganado.com
- Regulatory sandbox (opens in new tab) mdia.gov.mt
- Malta: The Ultimate AI Launchpad - A Strategy and Vision for Artificial Intelligence in Malta 2030 (opens in new tab) mdia.gov.mt
- Legal Notices 226 and 227 of 2025 published (opens in new tab) bdo.com.mt
- IDPC flags revised EU timelines after Digital Omnibus approval (opens in new tab) idpc.org.mt
- Malta classed as an AI Act 'frontrunner' in Deloitte Legal benchmarking (opens in new tab) edupedu.ro