MaltaCyber Resilience Regulations, MDIA Designation under the Cyber Resilience ActNew, enacted
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Governance, Security
What it requires
- This designation does not itself add a duty beyond the Cyber Resilience Act's own: the Regulation's essential requirements and market-placement duties reach a manufacturer's product with digital elements from , and its vulnerability and incident reporting duties have applied since , both documented at the European Union jurisdiction level.
- Report an actively exploited vulnerability or a severe incident to ENISA's single reporting platform under the Regulation's own Article 14 and Article 16; from , regulation 10 of the Cyber Resilience Regulations, 2026 designates the national computer security incident response team (CSIRT) as the CSIRT designated as coordinator for Regulation (EU) 2024/2847, which article 8(1) of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order establishes within the Malta Information Technology Agency.
These lines are LexLint's reading of the law's text. Also read by: Malta Digital Innovation Authority (MDIA) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The Malta Digital Innovation Authority (MDIA), designated by regulation 8 of the Cyber Resilience Regulations, 2026 as the Notifying Authority and by regulation 9, from , as the Market Surveillance Authority for Regulation (EU) 2024/2847.
Settledness
- As of
- Guidance link
- https://mdia.gov.mt/services/cyber-security/
- Guidance body
- Malta Digital Innovation Authority (MDIA)
- Open questions
- What guidelines or other binding documentation will the Malta Digital Innovation Authority prescribe under regulation 8(3) for appeals to the Notifying Authority against decisions of notified bodies?
What this law does
Legal Notice 238 of 2026, the Cyber Resilience Regulations, 2026, was published in the supplement to the Malta Government Gazette No. 21,717 of . The Regulations implement the requirements of Regulation (EU) 2024/2847 (the Cyber Resilience Act). Regulation 8 designates the Malta Digital Innovation Authority as the Notifying Authority for the purpose of Regulation (EU) 2024/2847.
Regulation 9 designates the Malta Digital Innovation Authority as the Market Surveillance Authority for the purpose of Regulation (EU) 2024/2847. Regulation 10 designates the national computer security incident response team (CSIRT), as defined in article 8 of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, as the CSIRT designated as coordinator for the purpose of Regulation (EU) 2024/2847.
That national CSIRT is the one article 8(1) of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order establishes within the Malta Information Technology Agency. Regulation 1(3) brings regulations 3 to 7 and regulations 9 to 12 into force on , so the Market Surveillance Authority and CSIRT coordinator designations, and the penalty provisions of regulation 11, apply from that date.
Regulation 8 is not among the regulations that regulation 1(3) dates, and the Legal Notice states no other commencement date for it. The Cyber Resilience Act's own essential requirements and market-placement duties for a manufacturer, applicable from , and its vulnerability and incident reporting duties, applicable since , are the Regulation's own and are documented at the European Union jurisdiction level rather than restated here.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.
Back to the example · Lint your app
Page updated .