Skip to main content

    AI by country · Southern Europe

    AI in Malta: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Malta know before starting with AI?

    Malta applies the EU AI Act through two legal notices from October 2025, which make the Malta Digital Innovation Authority (MDIA) the main AI market surveillance authority and give the Information and Data Protection Commissioner (IDPC) the sensitive high-risk areas. Personal data falls under the GDPR and the Data Protection Act (Cap. 586). Malta also sets its own penalties for AI breaches, so a company should check its AI uses against both the EU and Maltese rules.

    At a glance

    Malta at a glance

    Key facts about Malta
    Data protection lawGDPR (applies since 25 May 2018) plus the Data Protection Act, Cap. 586 (Act XX of 2018), in force since 28 May 2018
    RegulatorInformation and Data Protection Commissioner (IDPC) for personal data; MDIA as main AI Act authority
    AI policyArtificial Intelligence Regulations, 2025 (L.N. 226 of 2025) and L.N. 227 of 2025; AI Strategy 2030 from 2019, being realigned
    Time zoneCET, UTC+1 in winter and UTC+2 in summer
    CurrencyEUR (euro)
    Business languageEnglish and Maltese, both official

    Why now

    Why Malta is worth watching

    Each point links to the document it comes from.

    • Eurostat data show 21.51% of Maltese enterprises with 10 or more staff used at least one AI technology in 2025, up from 17.3% in 2024 and above the EU figure of 19.95%.[7]

    • Malta published the Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025) in the Government Gazette on 10 October 2025, with key parts in force from 2 August 2026.[3]

    • L.N. 227 of 2025 makes the IDPC the market surveillance authority for high-risk biometric, emergency-call triage and law enforcement AI systems, among others.[4]

    • The AI Act's Article 50 transparency duties began on 2 August 2026, and Annex III high-risk rules now start on 2 December 2027.[1]

    • Malta's AI strategy, 'The Ultimate AI Launchpad', dates from 2019, and OECD.AI records that Malta is realigning it.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation, Regulation (EU) 2016/679, with the Data Protection Act (Cap. 586)

    In force2016People have a right not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches go to the IDPC within 72 hours where feasible (Article 33). GDPR fines can reach 20 million euros or 4% of worldwide turnover.[2]

    Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025, under Cap. 591)

    In force2025The MDIA is the default market surveillance authority, single point of contact, notifying authority and sole authority for the national AI sandbox. For high-risk AI used by financial institutions it must coordinate with the MFSA. Operators can face a penalty of up to 350,000 euros per infringement or 1% of worldwide turnover, whichever is higher, plus up to 12,000 euros a day, without prejudice to AI Act fines.[3]

    Artificial Intelligence (Designation of the IDPC) Regulations, 2025 (L.N. 227 of 2025, under Cap. 586)

    In force2025The IDPC supervises high-risk AI for remote biometric identification, biometric categorisation and emotion recognition, emergency call and patient triage, and law enforcement uses. Its operative regulations apply from 2 August 2026.[4]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI

    Phased2024Prohibitions and AI literacy have applied since 2 February 2025, and general-purpose AI rules since 2 August 2025. High-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in Annex I products). AI Act fines reach 35 million euros or 7% of turnover for prohibited practices.[1]

    Where AI fits first

    Where AI fits first

    Financial services

    Onboarding document checks, transaction monitoring support and report drafting.

    For high-risk AI used by financial institutions, L.N. 226 of 2025 requires the MDIA and the MFSA to coordinate.[3]

    Online gaming

    Customer support in several languages and spotting unusual player activity for human review.

    Player profiling uses personal data, so GDPR rules on profiling and automated decisions apply. We found no AI-specific rule from the gaming regulator.

    Health care

    Summarising records and supporting appointment scheduling.

    Emergency healthcare patient triage AI is high-risk and supervised by the IDPC under L.N. 227 of 2025.[4]

    Tourism and services

    Guest chat in English and other languages, and review analysis.

    Chatbots must tell people they are dealing with AI under Article 50 of the AI Act, from 2 August 2026.[1]

    Your first steps

    Your first steps

    1. List every AI system you use and mark which fall under the AI Act's prohibited, high-risk or Article 50 transparency categories.
    2. Work out whether your AI falls to the MDIA, the IDPC or a sector regulator, using L.N. 226 and L.N. 227 of 2025.
    3. Add AI notices to chatbots and label AI-generated content now.
    4. Run a GDPR impact assessment before using AI for profiling, credit, hiring or health.
    5. Give staff basic AI training so you can show the measures you took on AI literacy.
    6. Put a GDPR transfer mechanism, such as standard contractual clauses, in place before personal data leaves the EU.
    7. If you want to test a new AI product, ask the MDIA about the national AI regulatory sandbox.

    AI services for Malta

    AI consulting and development for teams in Malta

    We work remotely with companies in Malta, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Malta is on UTC+1 in winter and UTC+2 in summer, and India is on UTC+5:30, a gap of 4.5 hours in winter and 3.5 hours in summer. Taking a 9:00 to 18:00 day in Malta and 9:30 to 18:30 in India, the overlap is 5 hours in winter (09:00 to 14:00 Malta time) and 6 hours in summer (09:00 to 15:00). India has no EU adequacy decision, so personal data we handle from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Malta

    Who supervises AI in Malta?

    The MDIA by default, under L.N. 226 of 2025, and it is listed by the European Commission as Malta's single point of contact. The IDPC covers biometric, emergency triage and law enforcement high-risk systems under L.N. 227 of 2025.

    Does Malta add its own AI penalties?

    Yes. L.N. 226 of 2025 allows a penalty of up to 350,000 euros per infringement or 1% of worldwide turnover, whichever is higher, and a daily penalty of up to 12,000 euros. These sit alongside the AI Act's own fines.

    Were the AI Act deadlines delayed?

    Partly. The Digital Omnibus on AI moved high-risk rules to 2 December 2027 and 2 August 2028. Article 50 transparency duties still apply from 2 August 2026.

    Is there an AI sandbox in Malta?

    L.N. 226 of 2025 makes the MDIA the sole authority for a national AI regulatory sandbox. We could not confirm from the MDIA site whether it is open for applications as of 29 October 2026.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, AI Act Service Desk, 2026-10-29. Timeline for the implementation of the EU AI Act(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Timeline for the implementation of the EU AI Act. Primary. Accessed on this date; reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744). Fine caps were read on the Service Desk Article 99 page.

    2. [2] Boletín Oficial del Estado (copy of the Official Journal of the EU, L 119), 2016-05-04. Regulation (EU) 2016/679 (General Data Protection Regulation)(boe.es)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary GDPR text, read in the Spanish official copy because EUR-Lex could not be opened from our tools. Used for Articles 22, 33, 35 and 83.

    3. [3] Government of Malta, legislation.mt, 2025-10-10. L.N. 226 of 2025, Artificial Intelligence Regulations, 2025(legislation.mt)
      Full title and what we used it for

      L.N. 226 of 2025, Artificial Intelligence Regulations, 2025. Primary. Read in full text (Government Gazette No. 21,519). Used for regulations 1, 3, 7, 9 and 11: MDIA roles, MFSA coordination, sandbox, penalties and the 2 August 2026 commencement.

    4. [4] Government of Malta, legislation.mt, 2025-10-10. L.N. 227 of 2025, Artificial Intelligence (Designation of the Informati…(legislation.mt)
      Full title and what we used it for

      L.N. 227 of 2025, Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025. Primary. Read in full text. Used for the list of high-risk systems the IDPC supervises and commencement.

    5. [5] Government of Malta, legislation.mt, 2018-05-28. Data Protection Act (Cap. 586)(legislation.mt)
      Full title and what we used it for

      Data Protection Act (Cap. 586). Primary. Used for the Act number (XX of 2018), the in-force date and later amendments (Act XII of 2021, L.N. 212 of 2023).

    6. [6] OECD.AI Policy Navigator, 2025-12-25. The Ultimate AI Launchpad: A strategy and vision for Artificial Intelli…(oecd.ai)
      Full title and what we used it for

      The Ultimate AI Launchpad: A strategy and vision for Artificial Intelligence in Malta 2030. Secondary tracker, used because the MDIA and gov.mt sites refused our requests. Used for the 2019 start and the note that Malta is realigning its strategy. A law-firm guide reports a draft 2025 to 2030 strategy went to consultation in November 2025; we could not confirm it officially.

    7. [7] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary dataset, read through the Eurostat API. Indicator E_AI_TANY, enterprises with 10 or more persons employed, excluding the financial sector.

    8. [8] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists the MDIA as Malta's single point of contact, not marked as pending.

    This is general information, not legal advice. Malta's AI rules took effect in August 2026 and guidance is still developing; we could not open the MDIA's own website. Check with a qualified Maltese lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Malta?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score