Malta

The EU AI Act (Regulation (EU) 2024/1689) applies directly in Malta and is not restated here as national law. Malta designated its national competent authorities by Legal Notices 226 and 227 of 2025, both published in Government Gazette of Malta No. 21,519 of 10 October 2025. Legal Notice 226 designates the Malta Digital Innovation Authority (MDIA) as the lead market surveillance authority, single point of contact, and national competent authority for Malta's AI regulatory sandbox.

Legal Notice 227 designates the Information and Data Protection Commissioner (IDPC) as a second market surveillance authority, for specific Annex III high-risk categories including biometric identification, emergency response dispatching, law enforcement, migration and border control, and the administration of justice, and requires a Magistrate's prior authorisation before a real-time or post-remote biometric identification system is deployed in a publicly accessible space for law enforcement.

Both designations' market-surveillance and enforcement powers become exercisable from 2 August 2026, in line with the AI Act's own Article 113 application timeline. No Maltese Criminal Code provision addressing AI-generated child sexual abuse material or non-consensual intimate imagery, distinct from the EU AI Act's own Article 5 prohibitions, was confirmed in the sources reached during this visit.

Malta's private-sector regime is the General Data Protection Regulation (GDPR) plus the Data Protection Act, Chapter 586 of the Laws of Malta, in effect since 25 May 2018 alongside the GDPR itself.

Its most consequential national addition, per two independent secondary sources not independently confirmed against Cap. 586's own text, is a prior-authorization and ethics-consultation duty: a controller must consult, and obtain prior authorization from, the Information and Data Protection Commissioner (IDPC) before processing genetic, biometric, or health data for statistical or research purposes in the public interest.

A separate designation (Legal Notice 227 of 2025) makes the IDPC an EU AI Act market-surveillance authority for biometrics among other categories, an AI-topic matter not covered here. As at 24 August 2026; later amendment to Cap. 586 is not independently confirmed.

Malta's principal scraping-relevant statute located here is the Criminal Code's computer-misuse subtitle. Article 337C makes it an offence to access, copy, output, or otherwise deal with data, software, or supporting documentation held in a computer without authorisation, turning on whether the actor was permitted by whoever is entitled to control the resource rather than on whether the resource sat behind a login.

Article 337D separately criminalises modifying, damaging, or impairing the operation of computer equipment, a computer, a computer system, or a computer network without authorisation. Article 337E extends both offences to conduct committed outside Malta that affects a computer, software, or data situated in or connected to Malta. No provision stating either article's maximum penalty was located in the sources this visit reached.

Malta's terms-of-service enforceability, database right, unfair-competition doctrine, and robots.txt weight were not independently confirmed in this visit; the reach of Malta's data-protection law over scraped personal data is addressed in the privacy topic's Data Protection Act (Cap. 586) and General Data Protection Regulation (GDPR) entries for this jurisdiction.

Malta's cyber-resilience posture for the private-sector duty-bearer rests mainly on directly applicable EU regulations, documented at the European Union jurisdiction level, plus one confirmed national implementing measure and one significant open gap.

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets the essential cybersecurity requirements a manufacturer must meet before placing a product with digital elements on the EU market, applicable from 11 December 2027, and its vulnerability and incident reporting duties, applicable since 11 September 2026; both are documented at the eu jurisdiction level and are not restated here.

Malta's own legislation portal carries a consolidated Subsidiary Legislation record, S.L. 591.6, Cyber Resilience Regulations, under Chapter 591, the Malta Digital Innovation Authority Act, with a recorded point in time of 11 September 2026, and the Malta Digital Innovation Authority (MDIA) describes itself as the prospective Notifying Authority and Market Surveillance Authority under the Cyber Resilience Act.

The MDIA's own published complaints procedure nonetheless states, as of 18 September 2026, that the corresponding provisions under the Cyber Resilience Act are still to come into application, so S.L. 591.6's existence and stated role are recorded here without asserting the designation is yet fully operative; the regulation's own operative text could not be reached, because Malta's legislation portal serves this record only as a metadata card behind client-side JavaScript, with the underlying document published solely as a PDF the portal loads on a user click rather than at a stable address reachable directly.

No located instrument names Malta's transposition of the NIS2 Directive (Directive (EU) 2022/2555), which sets cybersecurity risk-management and incident-reporting duties for essential and important entities including the digital providers its Annex II names, and which Malta was due to transpose by 17 October 2024.

The MDIA's own list of the EU regulations it administers (the Artificial Intelligence Act, the Cybersecurity Act, the Cyber Resilience Act, the Data Act and the Data Governance Act) does not include NIS2.

The Critical Infrastructure Protection Department, which the MDIA names as its partner on Malta's National Coordinated Vulnerability Disclosure Policy, and the National Cybersecurity Coordination Centre, hosted by the Malta Information Technology Agency (MITA) as Malta's node in the EU's Cybersecurity Competence Centre network, both look like more likely holders of a Maltese NIS2 transposition than the MDIA, but no Act or Legal Notice naming either body as a NIS2 competent authority or CSIRT was located; both of their own websites were read and neither names a transposing instrument.

Malta's legislation portal's own full-text search runs only as a client-side form that posts to an anti-forgery-token-guarded endpoint, which could not be submitted with the tools available, and Malta's Ministry for Home Affairs and the Malta Communications Authority's own sites returned no matching content on direct navigation.

This is recorded as an unresolved research gap rather than a finding that Malta has not transposed NIS2, since Malta's EU Member State obligation makes an actual gap surprising.

The Cybersecurity Act (Regulation (EU) 2019/881) and Malta's own S.L. 591.02, Cybersecurity Certification Regulations, designate the MDIA as Malta's National Cybersecurity Certification Authority, but this is a voluntary EU-wide certification framework for ICT products, services and processes rather than a mandatory security duty, so it is named here and not filed as an instrument.

No general reasonable-security or information-security-programme statute with no sector gate was located for Malta; the closest general duty is General Data Protection Regulation (GDPR) Article 32's security-of-processing obligation and the Data Protection Act, Chapter 586, which sits in the privacy topic together with the Articles 33-34 breach-notification duty to the Information and Data Protection Commissioner, and neither is restated here.

No enforcement record specific to a Maltese cyber-resilience or product-security duty was located; the Cyber Resilience Act's own fine structure under its Article 64 is directly applicable EU-wide regardless of Malta's national designation.

Malta's principal age-related duty binds a video-sharing platform provider. The Broadcasting (Amendment) Act, 2020 (Act No. LVI of 2020), transposing the revised EU Audiovisual Media Services Directive (Directive (EU) 2018/1808), inserted Articles 16R and 16S into the Broadcasting Act, Cap. 350.

Article 16S requires a video-sharing platform provider under Maltese jurisdiction to take the necessary measures to protect minors from programmes, user-generated videos and audiovisual commercial communications that may impair their physical, mental or moral development, including the establishment and operation of age-verification systems for users in relation to such content and of parental-control systems under the end-user's control; the Broadcasting Authority is charged with ensuring providers under its jurisdiction apply those measures.

Malta has no dedicated social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code distinct from this video-sharing platform duty as of the date below.

Malta's Copyright Act, Chapter 415 of the Laws of Malta, carries a press and current-events reporting exception and a quotation exception at Article 9(1), each excepting a specified use from copyright control provided the source and author are credited.

No provision creating a press-publisher neighbouring right equivalent to the EU Digital Single Market Copyright Directive's Article 15, and no text-and-data-mining exception distinct from Article 9's existing exceptions list, was located in the Copyright Act's principal text as consolidated through Act XXXV of 2023; Malta's subsidiary legislation register could not be independently checked in this visit.

Malta carries no compelled platform-to-publisher bargaining regime comparable to Australia's News Media Bargaining Code or Canada's Online News Act, and no hot-news or misappropriation doctrine distinct from the general law was located in the sources this visit reached.