MaltaArtificial Intelligence Regulations, 2025 (L.N. 226 of 2025)
Legal Notice 226 of 2025, Government Gazette of Malta No. 21,519 (10 October 2025)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 11 months, effective 10 October 2025.
An AI risk obligations rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Expect the Malta Digital Innovation Authority (MDIA) to hold market-surveillance and enforcement jurisdiction, from 2 August 2026, over a high-risk AI system you provide or deploy in Malta that falls outside the Information and Data Protection Commissioner's Annex III categories, under Legal Notice 226 of 2025.
- A provider testing an innovative AI system inside the MDIA's AI regulatory sandbox remains liable for damage the system causes, but is protected from administrative fines while acting in good faith, under the same Legal Notice.
What it reaches
How the hook was established
express
What makes it apply
Operator establishment
Obligation class
Governance
What it makes you log
Who may demand the log
Regulator
Log retention
Regulation 5 extends Article 18(1)'s ten-year technical-documentation retention period through a provider's or authorised representative's bankruptcy or cessation of operations; it is the same ten-year period, not an independent one.
- Unit
- Years
- As of
- 22 September 2026
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Regulation 5 requires a provider or its authorised representative established in Malta that becomes bankrupt or ceases operating before Article 18(1)'s ten-year retention period ends to keep the Article 18(2) technical documentation at the disposal of the national competent authorities for the rest of that period. Regulation 6 requires an importer, on the national competent authorities' reasoned request, to provide all necessary information and documentation, including the Article 23(5) material, to demonstrate a high-risk AI system's conformity. Neither Regulation names a log, a record or an audit trail; each requires documentation to be kept available or produced on request.
- Kind
- Implicit
- As of
- 22 September 2026
- Provision
- Regulations 5 and 6
- Trigger
- high_risk_systems
Who checks it
Audit expectation
on_request
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Legal Notice 226 of 2025 was published in Government Gazette of Malta No. 21,519 of 10 October 2025. It designates the Malta Digital Innovation Authority (MDIA) as Malta's lead market surveillance authority, single point of contact, and national competent authority for establishing and operating Malta's AI regulatory sandbox under the EU AI Act.
The MDIA's market-surveillance and enforcement powers become exercisable from 2 August 2026, in line with the AI Act's own Article 113 application timeline. A provider testing an AI system inside the MDIA's sandbox remains liable for damage the system causes but is protected from administrative fines while acting in good faith.
When LexLint raises it
high_risk_decisions
Read the law
Malta Digital Innovation Authority, official guidance page
legislation.mt, Government Gazette of Malta No. 21,519
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.