🇲🇹Malta

Overview

Malta has established itself as an early and proactive jurisdiction in the realm of digital innovation, particularly artificial intelligence. Its comprehensive approach to AI regulation is rooted in a forward-looking vision, initially articulated in the 2019 “Malta — The Ultimate AI Launchpad” strategy. This foundational policy aimed to position Malta as an international hub for AI innovation, testing, and scaling, balancing economic growth with a strong emphasis on ethical considerations and trustworthy AI development. The country's regulatory philosophy is characterized by an innovation-friendly stance coupled with robust governance mechanisms designed to instill public trust and ensure responsible deployment of AI technologies. The current regulatory landscape is evolving significantly with the direct implementation of the European Union's Artificial Intelligence Act (EU AI Act) through national legal instruments. This integration marks a maturation of Malta's AI governance, transitioning from largely policy-driven guidance and voluntary certification schemes to a more binding, harmonized framework. The Malta Digital Innovation Authority (MDIA) and the Information and Data Protection Commissioner (IDPC) are central to this architecture, designated with specific responsibilities for market surveillance and enforcement, particularly concerning high-risk AI systems. Malta's commitment extends to fostering digital literacy and skills, as evidenced by national strategies in education and e-skills, ensuring a holistic approach to its digital transformation journey.

Regulatory approach

Malta employs a hybrid regulatory approach to AI, seamlessly integrating binding national legislation that operationalizes the EU AI Act with existing non-binding policies and guidelines. The core of this framework is distinctly risk-based, mirroring the EU's comprehensive methodology, which imposes stringent obligations on providers and deployers of high-risk AI systems. This includes requirements for risk management, technical documentation, human oversight, and conformity assessments, ensuring that AI systems posing significant threats to health, safety, or fundamental rights are subject to rigorous scrutiny. The regulatory structure is primarily horizontal, with the Malta Digital Innovation Authority (MDIA) serving as the default national Market Surveillance Authority (MSA) for the majority of AI systems. However, it incorporates crucial sectoral carve-outs, most notably designating the Information and Data Protection Commissioner (IDPC) as the MSA for high-risk AI systems that involve sensitive personal data, such as those used in law enforcement, border management, justice, and democratic processes. This division of responsibility leverages existing expertise in data protection for particularly sensitive AI applications. Additionally, Malta maintains a voluntary AI certification program (AI ITA scheme) administered by the MDIA, which predates the EU AI Act and continues to offer a pathway for enhancing transparency, accountability, and trust in advanced technology deployments through adherence to ethical and technical control objectives. Malta's AI governance is primarily anchored by two key national authorities, the Malta Digital Innovation Authority (MDIA) and the Information and Data Protection Commissioner (IDPC), both of which have been designated with specific roles under the national implementation of the EU AI Act. The MDIA, established by the Malta Digital Innovation Authority Act, serves as the principal national Market Surveillance Authority (MSA) for the majority of AI systems. Its mandate encompasses recognizing conformity assessment bodies, operating the national AI regulatory sandbox, issuing guidance, and coordinating national enforcement. The MDIA also administers Malta’s voluntary AI certification program, fostering innovation while ensuring adherence to ethical and technical standards. Complementing the MDIA's broad oversight, the Information and Data Protection Commissioner (IDPC) has been specifically designated as the Market Surveillance Authority for a critical subset of high-risk AI systems. These include systems used in law enforcement, border management, justice, and democratic processes, particularly those involving biometric identification. The IDPC's designation underscores the intersection of AI governance with fundamental rights, especially privacy and data protection, ensuring that these sensitive applications are subject to rigorous oversight and judicial safeguards. Beyond these primary bodies, the Ministry for Education, Youth, Sport, Research & Innovation (MEYR) and its Directorate for Digital Literacy and Transversal Skills (DDLTS) play a crucial role in implementing the Digital Education Strategy, integrating digital literacy and e-safety into the national curriculum. Other sectoral regulators, such as the Malta Financial Services Authority (MFSA), are also expected to coordinate with the MDIA for AI systems operating within their respective domains.

Enforcement & penalties

Malta's AI regulatory framework includes a robust system of penalties and enforcement mechanisms, particularly for non-compliance with the obligations stemming from the EU AI Act. The Malta Digital Innovation Authority (MDIA), as the primary Market Surveillance Authority, is empowered to institute investigations, impose administrative measures and sanctions, and issue daily penalties for ongoing breaches. Its enforcement toolkit also includes the right to conduct inspections, demand technical documentation and logs, and coordinate with other MSAs and EU bodies. For systems under its voluntary certification program, the MDIA can refuse, suspend, or revoke certifications, and impose registration sanctions on service providers or auditors for non-compliance with its control objectives. The Information and Data Protection Commissioner (IDPC), in its capacity as the designated Market Surveillance Authority for specific high-risk AI systems, possesses significant enforcement powers. For infringements of the EU AI Act committed by public authorities or bodies, the IDPC can impose administrative penalties of up to EUR 50,000 per infringement, alongside a daily penalty of EUR 50 for the persistence of the infringement. This highlights a strong emphasis on accountability, especially in sensitive public sector deployments of AI. Both the MDIA Act and its amendment establish an Administrative Review Tribunal, providing an essential pathway for appeals and judicial review of decisions made by the MDIA, ensuring due process and transparency in regulatory actions. This multi-layered enforcement approach aims to ensure compliance while offering avenues for redress.

Data protection

Malta's data protection framework is intrinsically linked to the European Union's General Data Protection Regulation (GDPR), which is directly applicable across all Member States, including Malta. The GDPR sets a high standard for the processing of personal data, requiring principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality. These principles are foundational to the ethical and trustworthy development and deployment of AI systems in Malta. The Data Protection Act (Cap. 586) further complements the GDPR by establishing national provisions and designating the Information and Data Protection Commissioner (IDPC) as the national supervisory authority responsible for enforcing these regulations. In the context of AI regulation, the IDPC plays a pivotal role, particularly in overseeing high-risk AI systems that involve the processing of personal and sensitive data. Legal Notice 227 of 2025 specifically designates the IDPC as the Market Surveillance Authority for such systems, including those used for biometric identification, law enforcement, border management, justice, and democratic processes. This designation reinforces the intersection of fundamental rights, privacy, and AI governance, ensuring that AI deployments in these sensitive areas adhere strictly to data protection requirements. Operators of high-risk AI systems are therefore subject to mandatory notifications, prior judicial authorizations for certain uses (like real-time remote biometric identification in public spaces), and robust record-keeping obligations consistent with both the EU AI Act and GDPR.

Sector-specific rules

While Malta's primary AI regulatory framework, particularly through the implementation of the EU AI Act, is largely horizontal, specific provisions and policy documents address AI and digital technologies within particular sectors. A notable example is the education sector, guided by the Digital Education Strategy 2024–2030. This national policy framework focuses on integrating digital literacy, digital citizenship, and technology-enhanced learning into Malta’s education system. It explicitly emphasizes data protection and e-safety in the procurement of digital resources and the rollout of platforms, ensuring that AI tools and digital learning environments are deployed responsibly and ethically within educational settings. The Directorate for Digital Literacy and Transversal Skills (DDLTS) coordinates these efforts, ensuring alignment with national data protection requirements and safer internet guidance. Furthermore, the Information and Data Protection Commissioner (IDPC) has been specifically designated as the Market Surveillance Authority for high-risk AI systems deployed in critical public sectors such as law enforcement, border management, the administration of justice, and democratic processes. This highlights a targeted regulatory focus on areas where AI applications can have significant impacts on fundamental rights and public safety. For instance, the deployment of real-time remote biometric identification systems in publicly accessible spaces for law enforcement purposes is subject to prior judicial authorization by a Magistrate, underscoring stringent sector-specific safeguards. While the provided information does not detail specific AI regulations for sectors like finance or healthcare, the broad remit of the Malta Digital Innovation Authority (MDIA) for innovative technologies and its coordination with sectoral regulators, such as the Malta Financial Services Authority (MFSA), implies that AI systems in these domains would fall under MDIA's general oversight in conjunction with existing sectoral regulatory frameworks.

International alignment

Malta's AI regulatory strategy is deeply intertwined with and strongly aligned to international and, particularly, European Union frameworks. The most significant recent development is the direct implementation of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) through national Legal Notices 226 and 227 of 2025. These national instruments establish Malta's institutional and procedural framework for enforcing the EU AI Act, designating the Malta Digital Innovation Authority (MDIA) and the Information and Data Protection Commissioner (IDPC) as key Market Surveillance Authorities. This ensures a harmonized approach to AI governance across the EU, leveraging the risk-based methodology and comprehensive obligations set forth by the Union. Beyond the EU AI Act, Malta's earlier "Malta — Towards Ethical and Trustworthy AI (Malta's Ethical AI Framework)" explicitly builds on and aligns with international guidance, including the European Commission's High-Level Expert Group on AI (HLEG) Trustworthy AI Guidelines and the OECD AI Principles. This demonstrates a consistent commitment to universally recognized ethical standards for AI development and deployment. Furthermore, Malta's broader digital strategies, such as the Digital Education Strategy 2024–2030 and the National eSkills Strategy 2022–2025, consistently reference and aim for coherence with EU initiatives like the European Digital Education Action Plan and the EU Digital Decade targets. This comprehensive alignment positions Malta as a jurisdiction committed to fostering AI innovation within a globally recognized and ethically sound regulatory environment.

What's next

Malta's AI regulatory landscape is poised for continued evolution, primarily driven by the ongoing operationalization of the EU AI Act and strategic national realignments. The Malta Digital Innovation Authority (MDIA) has initiated a realignment process for the national AI strategy, "Malta — The Ultimate AI Launchpad: A Strategy and Vision for Artificial Intelligence in Malta 2030," which is scheduled for completion in 2025. This process is intended to update the strategy's priorities and actions in response to rapid technological advancements, evolving regulatory frameworks at both national and EU levels, and changing societal needs. The realignment will likely refine Malta's approach to AI investment, public and private sector adoption, education, and the legal and ethical framework, ensuring its continued relevance and effectiveness. Further developments will focus on the practical implementation and refinement of the national enforcement architecture for the EU AI Act. This includes the MDIA and IDPC issuing more detailed guidance, developing templates for technical documentation and post-market monitoring reports, and establishing clear protocols for inspections and incident reporting. The national AI regulatory sandbox, operated by the MDIA, is also expected to play a crucial role in future developments, providing a controlled environment for testing innovative AI systems and informing regulatory adjustments. This iterative approach, combining strategic foresight with adaptive implementation, underscores Malta's commitment to maintaining a dynamic and responsive AI regulatory environment that supports innovation while safeguarding public interest.