Certification Regulations, 2024

Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 21,266, 14 ta’ Ġunju, 2024 B 801

L.N. 132 of 2024

MALTA DIGITAL INNOVATION AUTHORITY ACT

(CAP. 591)

Innovative Technology Arrangements and Services (ITAS)

Certification Regulations, 2024

IN EXERCISE of the powers conferred by article 58 of the Malta

Digital Innovation Authority Act, the Minister responsible for digital

economy, acting on the advice of the Malta Digital Innovation

Authority, has made the following regulations:-

(1) The short title of these regulations is the Innovative Citation and

Technology Arrangements and Services (ITAS) Certification scope.

Regulations, 2024.

(2) The scope of these regulations is to provide for a voluntary

recognition framework for innovative technology arrangements and

services and for innovative technology service providers, as shall be

determined by the Authority for the purposes established in the Act,

from time to time.

(1)

In these regulations, unless the context otherwise Interpretation.

requires

"the Act" means the Malta Digital Innovation Authority Cap. 591.

Act;

"the Authority" means the Malta Digital Innovation

Authority established by article 5 of the Act;

"innovative technology arrangements" means any

applications and, or solutions or parts thereof which include

software, code, computer protocols and other architectures

which are used in the context of innovative technology;

''innovative technology services'' means those services in

relation to innovative technology arrangements which the

Authority may, from time to time, define, authorize or regulate;

"officer" means an officer or any person who is appointed

to carry out representative and fiduciary functions in the control

and administration of a legal person or a legal organisation

having separate legal personality, and any person who carries out

such functions even if under another name, including a director,

manager or company secretary;

"service provider" or "innovative technology service

provider" means a natural or legal person that renders innovative

technology services, including a technical expert;

(2) Words and expressions used in these regulations which are

also used in the Act but which are not defined herein shall have the

same meaning as assigned to them in the Act.

Any person who intends to obtain recognition for any

innovative technology arrangements or any innovative technology

service may apply to the Authority by making use of the relevant

prescribed forms issued by the Authority for such purpose and

accessible through the website of the Authority, or in the absence of a

prescribed form, by an application in writing providing the

information required by the Authority for such purpose with reference

to the subject matter of the application.

The Authority shall act in an open and transparent manner

when considering applications and shall seek to provide reasonable

information on the progress of an application to the applicant and, in

case of refusal, the reasons for refusing to accept an application under

these regulations shall be communicated in writing to the applicant.

Without prejudice to the forms of recognition that the

Authority may issue in accordance with the Act, there shall be a form

of recognition to be issued by the Authority known as "innovative

technology arrangements certification" or "ITA certification".

(1)

The Authority shall, from time to time, and taking

into account international and European Union legislation, determine

the types of technologies and innovative technology arrangements to

which the innovative technology arrangements certification shall

apply.

(2) The Authority may determine different types and classes of

innovative technology arrangements certification, including

certification based on self-assessment methodologies, and set the levels

of certification and elements to be assessed.

(3) The Authority may issue innovative technology

arrangements certification to different innovative technology

arrangements for one or more specific criteria with particular reference

to: purposes, qualities, features, attributes, behaviours or aspects, as

may be determined by the Authority, and which shall be specified in

the ITA certification.

(4) An innovative technology arrangements certification for

one or more specific purposes, qualities, features, attributes,

behaviours or other aspects shall neither operate as a certification for

different purposes, qualities, features, attributes, behaviours or other

aspects, nor shall it bar other certifications or recognitions for other

purposes, qualities, features, attributes, behaviours or other aspects.

(5) ITA certification may be issued on an in principle or

conditional basis subject to the innovative technology arrangements

satisfying the conditions or obligations imposed by the Authority.

(6) ITA certification issued under these regulations shall

specify the details of how the innovative technology arrangements are

identified and the innovative technology arrangements certification

shall be given a unique number for purposes of such identification.

(7) The holder of the certified innovative technology

arrangements shall post the innovative technology arrangements

certification on the arrangement, in a specific location which shall be

notified to the Authority, in an easily accessible and legible format in

order that it can be viewed by all users of the innovative technology

arrangements.

(8) When an innovative technology arrangements certification

is issued in favour of an innovative technology arrangements, without

specifying any elements as provided for in sub-regulation (3), it shall

be presumed to refer to all parts of the innovative technology

arrangements which are described as constituting the arrangement in

the application, unless expressly stated otherwise, in which case it

shall refer only to the specific criteria designated as the subject of the

certification.

(9) Subject to the right of appeal provided for in the Act, it

shall be the sole discretion of the Authority to determine whether

innovative technology arrangements qualify for innovative technology

arrangements certification under these regulations.

(10) The Authority may designate and make public, any

international or other standards of recognition it may rely on when

issuing certification under these regulations accessible through the

website of the Authority.

(11) An applicant or holder of an innovative technology

arrangements certification shall pay to the Authority such fees as may

be prescribed by the Minister or the Authority in accordance with their

powers at law in such manner as the said Minister or Authority may

determine, from time to time, with the original application and

subsequently upon renewal, and which shall be accessible through the

website of the Authority

Provided that, the Authority reserves the right not to

prescribe any fees in terms of this sub-regulation.

(1) Any person to whom an innovative technology

arrangements certification has been issued following an application

under these regulations shall not effect any material changes to the

certified innovative technology arrangements without having obtained

the prior written approval by the Authority of any such amendment or

substitution;

(2)

The term "material changes" in sub-regulation (1) shall

include

(a) any alterations to any innovative technology

arrangements or parts thereof including, software, code or

computer protocol to which the ITA certification applies, save for

upgrades, maintenance, innovative evolution or the mere

replacement of any supporting software which do not materially

change the functionality, or have a material impact on the users

of the innovative technology arrangements, or are not in breach

of the regulatory principles of the Act or of the ITA certification;

(b)

any development altering the rights of users;

(c) any changes introducing new risks, increasing any

existing risks, or which may interfere with any risk mitigation

mechanism in place;

(d) any development altering the rights, authorisation and

powers of the Authority or any person authorised by the

Authority;

(e) any alterations to the general purposes of the certified

innovative technology arrangements or to matters on which the

Authority has received assurances in connection with the issuing

of the ITA certification;

(f) any alterations to matters which the Authority, in the

ITA certification or documentation leading to the issuing of the

ITA certification, specifically lists as requiring its authorisation

prior to any changes being effected; or

(g) any other alterations that may be specified by the

Authority and accessible through its website, from time to time.

(3) In addition to the above, in those circumstances in which an

innovative technology service provider is, on a request of the

Authority, providing services in relation to the process of the issuing of

an ITA certification, the said service provider shall specify whether

any envisaged substitution or amendment consists of a material

change, in accordance with the meaning attributed to it in sub-

regulation (2), or may have material impact on the users of the

innovative technology arrangements or third parties, or affects the

content of their review, assurances or declarations provided to the

Authority for the purposes of the certification of the relevant innovative

technology arrangements

Provided that, to the extent that the changes result in

additional elements which have not been reviewed and do not fall

within the parameters of existing assurances and declarations issued by

the said service provider, the said service provider shall carry out a

review of the said additional elements, and provide the Authority with

the relative assurances that the changes do not affect his previous

declarations and evaluations of the certified innovative technology

arrangements.

(4) The Authority may, prescribe mandatory notification in

general or give directions as it may deem fit in the circumstances of

the case.

Where prior authorisation to any envisaged changes is not Duty to notify

required according to these regulations, the person to whom an changes.

innovative technology arrangements certification has been issued

following an application under these regulations shall provide the

Authority with the details of any changes in the certified innovative

technology arrangements, or to the information that had been provided

to the Authority in the application process provided for in terms of these

regulations, within thirty (30) days of such changes materializing.

(1) All certificates under these regulations shall be valid Renewals of

for the period as established by the Authority and shall be presumed to certifications

and

expire on the first day after the lapse of the period of validity indicated registrations.

on the certificate, unless renewed by the Authority in accordance with

these regulations, in which case the expiry date shall be extended by

the renewal period and the innovative technology arrangements

certification shall lapse on the day after the said extended expiry date.

(2) It shall be the duty of the innovative technology

arrangements certification holder to ensure that the said certification is

valid and effective throughout the duration period and that subject to

the confirmation by the Authority, the innovative technology

arrangements certification shall be renewed at least within the last

three (3) months of its duration period and in any case prior to expiry.

(1) The Authority shall be empowered to register persons

providing innovative technology services for purposes that the

Authority shall, from time to time, define and publish through

guidelines and which shall be accessible through the website of the

Authority setting out the functions and obligations of such registered

innovative technology service providers within the framework of

innovative technology recognition and certification.

(2) The registration of an innovative technology service

provider may be made in relation to natural or legal persons, or legal

organisations having separate legal personality, as the Authority may

determine.

(3) The Authority shall determine the means of application for

the purposes of registering innovative technology service providers,

and the general and specific requirements for registration, including

requirements relating to "fit and proper" tests that the innovative

technology service providers must satisfy whether they are natural or

legal persons, or legal organisations having separate legal personality.

(4) The Authority shall establish rules on the manner in which

innovative technology services are to be provided by natural or legal

persons, or legal organisations having separate legal personality,

including where necessary, rules on the internal segregation of functions

and on the responsibility for the recognised functions and which shall

be accessible through the website of the Authority.

(5) The Authority may designate and make public and

accessible through its website any international or other standards of

service it may rely on when considering a registration of innovative

technology service providers under these regulations.

(6) Without prejudice to the other requirements that may be

published by the Authority through guidelines accessible through its

website, the Authority shall not recognise an innovative technology

services provider if the circumstances referred to in article 28 of the

Act arise.

(7) The Authority shall grant the registration to recognised

innovative technology service providers which shall specify the official

name and surname, if applicable, and registered address and have a

unique number for identification purposes and a list of the classes of

services which the applicant has been registered to provide.

(8) The registered innovative technology service provider shall

post the registration issued to it by the Authority on its website, if

applicable, as well as on any innovative technology arrangements to

which it renders its services in a specific location, as may be further

specified by the Authority. Said posting of the registration, which shall

be in an easily accessible and legible format in order that it can be

viewed and clearly understood by all users of the innovative

technology arrangements, shall be notified to the Authority.

(9) When an innovative technology service provider is a legal

person, or a legal organisation having separate legal personality the

registration shall be issued in the name of the legal person or the legal

organisation and where the service is carried out personally by such

service provider, the registration shall be issued in the official name

and surname of the said service provider.

(10) Innovative technology service providers registered under

the provisions of these regulations shall be considered to be

professionals who act as fiduciaries in relation to the information

submitted to them by any customers and shall also be bound by the

provisions of the Professional Secrecy Act and shall act accordingly. Cap. 377.

(11) The Authority shall be empowered to require innovative

technology arrangements that are seeking to be, or may have been

certified by the Authority, to engage the services of registered

innovative technology service providers to carry out specific functions

in relation to the innovative technology arrangements certification or

review process, as shall be specified by the Authority in its published

guidelines accessible through its website.

(1) Registrations issued to innovative technology service Renewals of

providers under these regulations shall be valid for a period of three registrations.

(3) years and shall expire accordingly unless renewed in terms of

regulation 11(2), provided that the Authority may issue a registration

for a different period, as it may deem reasonable.

(2) It shall be the duty of the innovative technology service

provider to ensure that the registration is valid and effective

throughout the period of duration, and subject to the confirmation by

the Authority, the registration shall be renewed at least within the last

three (3) months of its period of duration and, in any case, prior to

expiry.

(1) When an applicant for an innovative technology Appointment of

arrangements certification to be issued by the Authority is not resident agent.

habitually resident in Malta, it may be required by the Authority to

appoint, a resident agent who

(a)

is habitually resident in Malta;

(b) is not interdicted or incapacitated or is an

undischarged bankrupt;

(c) has not been convicted of any of the crimes affecting

public trust or of theft or of fraud or money laundering or of

knowingly receiving property obtained by theft or fraud; and

(d) has satisfied the Authority that he is a person capable

of carrying out the functions provided for in terms of these

regulations.

(2) A legal person and a legal organisation having a separate

legal personality shall be considered as not being habitually resident in

Malta for the purposes of this regulation if none of

(a) the members of its board of administrators or

secretary; and

(b) its senior officers, being the chief executive officer,

the chief operations officer or its chief technology officer;

are habitually resident in Malta.

(3) Notices of the appointment, including the terms of

engagement, resignation or removal of the resident agent shall be filed

with the Authority in the prescribed form, and until such form is issued

by the Authority, by means of a notification in writing and, where a

notice of appointment is given, it shall be accompanied by the

acceptance in writing of the resident agent of such appointment.

(4) The Authority may, at any time, refuse or reject any notice

of an appointment which it considers is not in compliance with these

regulations, and in such case, the innovative technology recognition

holder or applicant, as the case may be, shall immediately propose

another resident agent.

(1) It shall be the function of the resident agent on behalf

of the innovative technology certification applicant or holder to

(a) act as the channel of communication between the

innovative technology recognition holder or applicant and the

Authority and other Maltese government departments and

authorities;

(b) sign and file with the Authority and other Maltese

government departments and authorities all declarations and

forms as may be required in terms of Maltese law; and

(c) act as the legal representative of the innovative

technology recognition holder or applicant for judicial

proceedings in Malta, and any notice whether by the Authority or

any other authority, that is sent to the resident agent at his last

registered address with the Authority, shall be deemed to have

been duly received by and notified to the innovative technology

recognition holder or applicant.

(2) The resident agent shall not be held personally liable for

non-compliance by the innovative technology recognition holder or

applicant with any law, nor for any misrepresentation made in any

submissions or documents issued by the innovative technology

recognition holder or applicant, even if authenticated by the resident

agent for the purposes of the application, certification, recognition or

any other law, unless the resident agent has personally undertaken such

liability for the compliance in writing or has himself wilfully or

negligently made a false declaration.

(3) The resident agent shall neither be responsible for any court

fees, legal expenses, or any related expenses in the event of any

judicial proceedings filed against him in his capacity as legal

representative of the innovative technology recognition holder or

applicant or any of its officers, by whosoever they may have been

filed.

(1) Without prejudice to the express powers entrusted to Powers of

the resident agent by an innovative technology recognition holder or resident agent.

applicant in the said engagement, the resident agent shall have the

power on behalf of the innovative technology certification holder or

applicant, to

(a) sign and file applications, declarations, notices,

returns and any other document that may be required in terms of

Maltese law;

(b)

apply for the recognition or certification of an

innovative technology arrangement or for the registration of an

innovative technology service provider under these regulations

and for the revocation or cancellation of a recognition or

certification or registration, and to perform any ancillary act in

relation thereto;

(c) pay all relative fees and taxes payable in terms of

Maltese law;

(d) do all other things as may be considered conducive or

ancillary for the certification or other form of recognition or

registration under the Act, these regulations or for the

maintenance of such recognition or registration;

(e) authenticate documents issued by the innovative

technology recognition holder or applicant; and

(f) receive formal notification on behalf of the

innovative technology recognition holder or applicant when

notifications are required under the provisions of these

regulations or any other law or any agreement

Provided that it shall not be lawful for the certification of

an innovative technology arrangements or the registration of an

innovative technology service provider to be issued in the name of the

resident agent, even if he is formally authorised for such purpose.

(2) The resident agent shall be deemed to have all the

necessary powers to enter into binding undertakings with the Authority

on matters relating to the recognition by the Authority on behalf of the

innovative technology recognition holder or applicant and the

Authority is authorised to act accordingly

Provided that nothing in this Act shall imply any power of a

resident agent to execute any document relating to an undertaking

involving liability unless expressly authorised to do so in writing.

(3) The innovative technology recognition holder or applicant

may restrict any of the above powers of the resident agent

Provided that where the innovative technology recognition

holder or applicant limits such powers, it shall file with the Authority a

declaration to that effect in the prescribed form issued by the Authority

and accessible through its website and such limitation shall not have

effect with regard to third parties until it is so filed and recorded in the

register of recognitions published by the Authority.

(4) Unless expressly prohibited from doing so in terms of his

engagement, the resident agent may delegate and specifically appoint

in writing another person to act in specific matters on his behalf

provided that in so doing the resident agent shall not in any manner be

relinquishing any of the functions, powers and responsibilities

conferred on him under these regulations.

(1) A resident agent may resign from his position as a

resident agent by giving at least thirty days’ (30) notice, or such other

shorter period as the innovative technology arrangements certification

holder, or the Authority may consent to in writing.

(2) The innovative technology arrangements certification

holder or applicant may remove the resident agent by giving at least

thirty days’ (30) notice, or such other shorter period as the Authority

may consent to in writing.

(3) The Authority shall have the power to appoint, on a limited

and temporary basis, a resident agent on behalf of the innovative

technology arrangements certification holder in case the post of a

resident agent is vacant for more than five (5) working days and the

innovative technology arrangements certification holder has failed to

fill that vacancy within said time. Such resident agent shall seek to

establish contact with the persons who have duties in relation to the

governance of the innovative technology arrangements in order that

they shall appoint a resident agent of their choice

Provided that in such case as provided in sub-regulation

(4), the appointee shall be an advocate with a warrant to practice law in

Malta.

(4) Where the ITA certification holder or applicant is in default

of his obligations under these regulations in that the position of a

resident agent is vacant and the Authority, pursuant to sub-regulation

(3), did not appoint a temporary resident agent within the period

stipulated in the guidelines accessible through the website of the

Authority, the said Authority may, without prejudice to any other

action that may be taken under these regulations, apply to the Civil

Court, First Hall for the appointment of a curator to act as resident

agent until such time as another resident agent is appointed by the

Court or the innovative technology arrangements certification ceases

to have effect.

The provisions of Part IX of the Act shall apply to Right to an

effective

decisions taken by the Authority pursuant to these regulations.

judicial remedy.

Unless expressly stated in the Act or any European Union No exemption

legislation or any other law, nothing in these regulations shall be from other laws.

considered as exempting any innovative technology arrangements or

any innovative technology service provider from the provisions of any

other law, including other regulatory laws requiring authorisations or

approvals

Provided that, in the event that a requirement under these

regulations is similar in scope to that under another law and has been

satisfactorily satisfied by an applicant, the Authority may, if necessary

with the written consent of the applicant, co-ordinate with the other

national competent authorities and rely on the submissions and

processes being carried out by the other authorities in carrying out its

duties under these regulations.

€0.54