MaltaArtificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)
Legal Notice 227 of 2025, Government Gazette of Malta No. 21,519 ()
In force since .
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Biometric, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain prior authorisation from a Magistrate for each use of a real-time remote biometric identification system in a publicly accessible space in Malta for law enforcement purposes (or request it within twenty-four hours where urgency justifies starting without it), and notify the Commissioner of each such use with the Regulation (EU) 2024/1689 Article 5(6) information excluding sensitive operational data; if you deploy a high-risk post-remote biometric identification system, request the Magistrate's authorisation ex ante or without undue delay and within forty-eight hours, except for the initial identification of a potential suspect, under regulations 6 and 7 of Legal Notice 227 of 2025.
- Where you are a public authority or body, expect an administrative penalty of up to EUR 50,000 per infringement plus a daily penalty of up to EUR 50 per day of continuing infringement for a breach of Regulation (EU) 2024/1689 within the Commissioner's Annex III jurisdiction, under the same Legal Notice.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Penalty structure
Ceiling for an administrative penalty the IDPC imposes on a public authority or body for an infringement of Regulation (EU) 2024/1689 within the Commissioner's Annex III market-surveillance jurisdiction under Legal Notice 227 of 2025: EUR 50,000 per infringement plus EUR 50 for each day the infringement persists. The EU AI Act's own Article 99 penalty tiers for a private-sector operator are not restated here.
- Rule
- Per violation only
- As of
- Currency
- EUR
- Fixed cap
- 50,000
- Per violation unit
- Day
- Per violation amount
- 50
Over one month of continuous breach, EUR 1,522.
Who enforces it
Enforcement body
Information and Data Protection Commissioner (IDPC), designated market surveillance authority under Legal Notice 227 of 2025 for the Annex III high-risk AI systems used in law enforcement, migration and border control, and the administration of justice.
Settledness
- As of
- Open questions
- What makes a situation a 'duly justified situation of urgency' under regulation 6(2), so that a law-enforcement deployer may start real-time remote biometric identification before the Magistrate has authorised it?
- Does 'the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence' in regulation 7(1) excuse the deployer from requesting the Magistrate's authorisation for the whole of a first identification, or only for the first match?
- How is the role in regulation 8, where the Commissioner 'shall act as a notified body' for high-risk systems that law enforcement, immigration or asylum authorities put into service, separated from the Commissioner's role as market surveillance authority for the same systems?
What it makes you log
Who may demand the log
Regulator
Log retention
Regulation 9 extends Article 18(1)'s ten-year technical-documentation retention period through a provider's or authorised representative's bankruptcy or cessation of operations; it is the same ten-year period, not an independent one.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
The Magistrate authorisation that regulations 6 and 7 require, and the Article 5(6) notification that regulation 6(4) requires for each use of a real-time remote biometric identification system, are an authorisation and disclosure gate, not a duty to keep an operational log or record over the system's use. Regulations 9 and 10 are different: Regulation 9 requires a provider or its authorised representative established in Malta that becomes bankrupt or ceases operating before Article 18(1)'s ten-year retention period ends to keep the Article 18(2) technical documentation at the disposal of the Commissioner for the rest of that period, and Regulation 10 requires an importer, on the Commissioner's reasoned request, to provide all necessary information and documentation, including the Article 23(5) material, to demonstrate a high-risk AI system's conformity. Neither Regulation names a log, a record or an audit trail; each requires documentation to be kept available or produced on request.
- Kind
- Implicit
- As of
- Provision
- Regulations 9 and 10
- Trigger
- high_risk_systems
What this law does
Legal Notice 227 of 2025 designates the Information and Data Protection Commissioner (IDPC) as a second market surveillance authority under the EU AI Act, for the Annex III high-risk categories of biometric systems used for law enforcement, border management, or justice and democracy purposes; emergency-call evaluation and emergency-response dispatching; law enforcement generally; migration, asylum and border control management; and the administration of justice and democratic processes, each insofar as its use is permitted by law.
Published in Government Gazette of Malta No. 21,519 of . Each use of a real-time remote biometric identification system in a publicly accessible space for law enforcement is subject to prior authorisation granted by a Magistrate, or, in a duly justified urgency, may begin if authorisation is requested within twenty-four hours, and must be notified to the Commissioner with the Article 5(6) information, excluding sensitive operational data.
The deployer of a high-risk post-remote biometric identification system must request the Magistrate's authorisation ex ante, or without undue delay and within forty-eight hours, except for the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence. Regulations 5 to 7 and 9 to 12 came into force on under regulation 1(3).
Where the Commissioner finds an infringement of Regulation (EU) 2024/1689 by a public authority or body within this jurisdiction, an administrative penalty of up to EUR 50,000 per infringement plus a daily penalty of up to EUR 50 for each day the infringement persists may follow.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .