EU AI Act in Malta: The MDIA, Enforcement, and What Companies Must Do

Malta has done what many small Member States have not: it has formally designated its EU AI Act authorities. By Legal Notice 226 of 2025, in force from 10 October 2025, Malta named the Malta Digital Innovation Authority (MDIA) as its lead market surveillance authority and single point of contact, with the data protection commissioner co-supervising rights-sensitive systems. If you have read that Malta "already certifies AI," be careful — that refers to a voluntary MDIA assurance scheme that long predates the Act and is a separate thing from this new, mandatory enforcement role. This guide keeps the two clearly apart.

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Malta. Below: the designated authorities, the timeline after the Digital Omnibus, the penalties, and what Maltese providers and deployers should do.

---

A Regulation, Not a Directive: Direct Application

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and applies directly in Malta under Article 288 of the Treaty on the Functioning of the European Union. Article 5's prohibited practices have applied since 2 February 2025, Article 4 AI literacy since the same date, and the Chapter V GPAI duties since 2 August 2025.

What Malta has added on top is national designation and a domestic enforcement layer — set out in two Legal Notices of October 2025. Most of the substantive enforcement bites from 2 August 2026 (subject to the Digital Omnibus), but the authorities themselves are designated and in force now.

---

Who Enforces the EU AI Act in Malta?

Malta adopted a dual-authority model through two instruments published on 10 October 2025.

The MDIA: Lead Authority

Legal Notice 226 of 2025 — the Artificial Intelligence Regulations, 2025, made under the Malta Digital Innovation Authority Act — designates the MDIA as Malta's lead market surveillance authority, the Article 70 single point of contact, the notifying authority, and the national competent authority for the AI regulatory sandbox. The one carve-out: the assessment and monitoring of conformity assessment bodies under Article 28(1) sits with the National Accreditation Board. For most Maltese companies, the MDIA is the authority to know.

Don't Confuse the MDIA's Two Hats

This is the trap on Malta. Since around 2019, the MDIA has run a voluntary technology-assurance and certification pathway for "Innovative Technology Arrangements" — including AI — now under its Technology Assessment Recognition Framework. That is an opt-in national assurance scheme, useful for signalling quality, but it is not the EU AI Act's mandatory conformity machinery. The Article 70 market surveillance designation created by Legal Notice 226 of 2025 is a new and distinct legal role. Getting an MDIA voluntary certificate is not the same as meeting the Act's high-risk obligations, and the Act's duties apply whether or not a company has touched the voluntary scheme.

The IDPC: Co-Supervisor for Rights-Sensitive Systems

Legal Notice 227 of 2025, made under the Data Protection Act, makes the Information and Data Protection Commissioner (IDPC) the market surveillance authority for the most rights-sensitive high-risk domains — biometrics, emergency call handling, law enforcement, migration and border control, and the administration of justice and democratic processes — plus enforcement of certain prohibited practices. So a Maltese company in those areas deals with the IDPC, not the MDIA, for AI Act market surveillance.

GPAI Is Supervised From Brussels

As across the EU, providers of general-purpose AI models are supervised directly by the EU AI Office in Brussels, not by the MDIA or IDPC. Maltese foundation-model developers should follow the GPAI Code of Practice (published July 2025) and the AI Office's guidance.

---

National Strategy

Malta launched its national AI strategy, "Malta — The Ultimate AI Launchpad: A Strategy and Vision for Artificial Intelligence in Malta 2030," in October 2019 — one of the earliest national AI strategies in the EU, governed through the MDIA. It is being realigned toward a societal-wellbeing and sustainability framing. The strategy is policy, not law; the enforcement designation is the Legal Notices above.

---

The EU AI Act Timeline as It Applies in Malta

Two points for Maltese businesses.

First, the high-risk deadline is no longer 2 August 2026. Under the Digital Omnibus — the Commission's amendment package, adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — stand-alone high-risk Annex III systems are deferred to 2 December 2027 and product-embedded systems to 2 August 2028. The Digital Omnibus was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026, so the deferral dates are settled. Plan to 2 December 2027 for stand-alone high-risk Annex III.

Second, although Malta's authorities are designated, most of the local provisions take effect alongside the Act's general application from 2 August 2026. The authorities are real now; the bulk of high-risk enforcement bites then.

---

Penalties: What Maltese Companies Face

Two layers operate in Malta, and it is worth being exact.

The primary ceilings come from Article 99 of the Regulation — directly applicable, three tiers, no national variation in the figures:

• €35,000,000 or 7% of total worldwide annual turnover (whichever is higher) — for the Article 5 prohibitions. Art 99(3).
• €15,000,000 or 3% — for most other obligations: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency. Art 99(4).
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to authorities or notified bodies. Art 99(5).

For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed sum or the percentage. The third tier is 1%, never 1.5%.

On top of these, Legal Notice 226 of 2025 adds a domestic administrative penalty layer under the MDIA Act — administrative fines up to €350,000 or 1% of worldwide annual turnover (whichever is higher), plus daily penalties up to €12,000 for continuing infringements. This is a lighter domestic enforcement mechanism that sits alongside — not in place of — the EU Article 99 ceilings. GPAI model providers face a separate instrument still: up to €15 million or 3% under Article 101, imposed by the Commission.

---

Worked Example: A Maltese Recruitment-Tech Deployer

Consider Valletta Talent Ltd, a fictional Maltese HR-tech company — about 45 employees, ~€6M turnover — that deploys an AI tool to rank job applicants for client companies.

CV-ranking for recruitment is an Annex III employment use case. Valletta Talent is a deployer under Article 26: human oversight under Article 14, adherence to the provider's instructions, logging, and — because the tool profiles candidates — no escape via the Article 6(3) filter, since profiling of natural persons is always high-risk. In Malta, the relevant market surveillance authority here is the MDIA, not the IDPC (recruitment AI is not in the IDPC's biometric/law-enforcement/justice bucket). Two practical notes: an MDIA voluntary technology certificate would not substitute for meeting these high-risk duties; and if Valletta Talent customised the tool heavily on its own data and crossed into substantial modification, it could flip to provider obligations under Article 25. The Article 6 classification and the role analysis are the first things to nail down.

---

How Confir Helps

Maltese teams have named authorities and a domestic penalty layer to track, on top of the EU obligation set. Confir is an EU-hosted compliance tool built for this work. Its classification engine is deterministic and rule-based — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake yields the same finding with a human-readable explanation of which rule fired. It builds the AI inventory, derives the provider/deployer role, generates the Annex IV technical documentation and the Article 27 FRIA, and runs a structured assessment across risk classification, data robustness, transparency and human oversight, and post-market monitoring — so a Maltese company can show its file to whichever of the MDIA or IDPC is in frame.

---

What Maltese Companies Should Do Now

Immediately: Audit for Article 5 prohibited practices — social scoring, untargeted facial-image scraping, biometric categorisation by sensitive traits, workplace or education emotion recognition. These bind today; the GPAI layer is enforced from Brussels.

Before 2 August 2026: Prepare for Article 50 transparency — label chatbots, mark synthetic content, disclose deepfakes. This date was not deferred, and most of Malta's local provisions take effect here.

Through 2026–2027: Build the AI inventory, classify each system, apply the Article 6(3) filter, assign roles, and start the high-risk documentation. Plan against 2 December 2027. For biometric, law-enforcement, migration, or justice systems, the IDPC is your market surveillance authority; for everything else, the MDIA.

Ongoing: Follow MDIA guidance on the AI Act and the regulatory sandbox, and keep the voluntary certification scheme mentally separate from your mandatory obligations.

---

Related guides

• EU AI Act fundamentals
• Compliance for small businesses
• Article 5: prohibited practices
• Article 99 penalties explained
• Regulatory sandboxes explained
• The Digital Omnibus, defined
• Market surveillance authority, defined