Malta’s Legal Notice 226 of 2025 formally designates the Malta Digital Innovation Authority (MDIA) as the primary market surveillance and competent authority for the EU AI Act. The MDIA has powers to inspect, investigate, and impose administrative fines of up to €350,000 or 1% of worldwide annual turnover. The Information and Data Protection Commissioner (IDPC) oversees AI systems involving biometric data and law enforcement applications. The MDIA operates the national AI regulatory sandbox and serves as the single point of contact for the EU AI Office. Full enforcement of the EU AI Act applies from August 2, 2026.
Who it affects: All developers, deployers, and importers of AI systems classified as high-risk under the EU AI Act who operate in Malta fall under MDIA oversight. Malta-based AI companies, fintech firms, and public-sector deployers of automated systems face direct regulatory scrutiny. Biometric and law enforcement AI applications face joint MDIA-IDPC supervision.
What is notably missing: Legal Notice 226 creates a strong AI regulatory framework for system-level compliance but includes no literacy or training obligations for workers, students, or citizens. The MDIA’s mandate covers governance of AI systems, not governance of AI knowledge. No employer training requirement and no civil servant training standard are created by this measure.