MaltaArtificial Intelligence Regulations, 2025 (L.N. 226 of 2025)
Legal Notice 226 of 2025, Government Gazette of Malta No. 21,519 ()
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with the market-surveillance and enforcement decisions of the Malta Digital Innovation Authority (MDIA), which holds that jurisdiction from over a high-risk AI system you provide or deploy in Malta that falls outside the Information and Data Protection Commissioner's Annex III categories, under Legal Notice 226 of 2025.
- A provider testing an innovative AI system inside the MDIA's AI regulatory sandbox remains liable for damage the system causes, but is protected from administrative fines while acting in good faith, under the same Legal Notice.
These lines are LexLint's reading of the law's text. Also read by: Malta Digital Innovation Authority (MDIA) (guidance, recorded ).
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Penalty structure
Regulation 11(1) sets the ceiling for each infringement of the Artificial Intelligence Regulations or of Regulation (EU) 2024/1689: EUR 350,000 or, where the offender is an undertaking, 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Regulation 11(2) lets the MDIA impose a daily penalty of EUR 12,000 for each day an infringement persists, instead of or in addition to that penalty. Regulation 11(5) caps an administrative penalty on a public authority or body at EUR 50,000 for each infringement, with a daily penalty of EUR 50. The penalties of Chapter XII of Regulation (EU) 2024/1689 apply without prejudice to these.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 350,000
- Turnover percentage cap
- 1
Who enforces it
Settledness
The MDIA's page says its market surveillance and enforcement powers are exercisable as of , in line with Article 113 of Regulation (EU) 2024/1689.
- As of
- Guidance link
- https://mdia.gov.mt/services/artificial-intelligence/
- Guidance body
- Malta Digital Innovation Authority (MDIA)
- Open questions
- Does 'unless otherwise provided in these regulations or any other law' in regulation 3(1), with the Minister's power to designate other market surveillance authorities by order, leave the MDIA as the market surveillance authority for a high-risk system used by a financial institution, where regulation 3(1)(b) requires only coordination with the Malta Financial Services Authority, and does that make the MDIA the 'lead' authority that its own page names?
- Does regulation 1(3), which defers only regulations 4, 5, 6, 8, 9 and 10 to , let the MDIA impose an administrative penalty under the penalty regulation for an infringement of Regulation (EU) 2024/1689 committed before that date?
What it makes you log
Who may demand the log
Regulator
Log retention
Regulation 5 extends Article 18(1)'s ten-year technical-documentation retention period through a provider's or authorised representative's bankruptcy or cessation of operations; it is the same ten-year period, not an independent one.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Regulation 5 requires a provider or its authorised representative established in Malta that becomes bankrupt or ceases operating before Article 18(1)'s ten-year retention period ends to keep the Article 18(2) technical documentation at the disposal of the national competent authorities for the rest of that period. Regulation 6 requires an importer, on the national competent authorities' reasoned request, to provide all necessary information and documentation, including the Article 23(5) material, to demonstrate a high-risk AI system's conformity. Neither Regulation names a log, a record or an audit trail; each requires documentation to be kept available or produced on request.
- Kind
- Implicit
- As of
- Provision
- Regulations 5 and 6
- Trigger
- high_risk_systems
What this law does
Legal Notice 226 of 2025 was published in Government Gazette of Malta No. 21,519 of . It designates the Malta Digital Innovation Authority (MDIA) as Malta's lead market surveillance authority, single point of contact, and national competent authority for establishing and operating Malta's AI regulatory sandbox under the EU AI Act.
It also designates the MDIA as the notifying authority, with the National Accreditation Board (Malta) carrying out the assessment and monitoring referred to in Article 28(1) of the EU AI Act. The MDIA's market-surveillance and enforcement powers become exercisable from , in line with the AI Act's own Article 113 application timeline. Under regulation 1(3), regulations 4, 5, 6, 8, 9 and 10 came into force on ; the other regulations are not deferred.
An operator that infringes the Artificial Intelligence Regulations or Regulation (EU) 2024/1689 is liable to an administrative penalty of up to EUR 350,000 for each infringement or, for an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher. The MDIA may impose a daily penalty of EUR 12,000 for each day an infringement persists, instead of or in addition to that penalty.
An administrative penalty on a public authority or body may not exceed EUR 50,000 for each infringement, with a daily penalty of EUR 50 for each day the infringement persists. A provider testing an AI system inside the MDIA's sandbox remains liable for damage the system causes but is protected from administrative fines while acting in good faith.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .