INNOVATIVE TECHNOLOGY ARRANGEMENTS AND SERVICES (ITAS) CERTIFICATION REGULATIONS (itas)

SERVICES (ITAS) CERTIFICATION

SUBSIDIARY LEGISLATION 591.01

INNOVATIVE TECHNOLOGY ARRANGEMENTS

AND SERVICES (ITAS) CERTIFICATION

REGULATIONS

14th June, 2024

LEGAL NOTICE 132 of 2024.

(1)

The short title of these regulations is the

Innovative Technology Arrangements and Services (ITAS)

Certification Regulations.

(2)

The scope of these regulations is to provide for a

voluntary recognition framework for innovative technology

arrangements and services and for innovative technology service

providers, as shall be determined by the Authority for the purposes

established in the Act, from time to time.

(1)

In these regulations, unless the context otherwise

requires

"the Act" means the Malta Digital Innovation Authority

Act;

"the Authority" means the Malta Digital Innovation

Authority established by article 5 of the Act;

"innovative technology arrangements" means any

applications and, or solutions or parts thereof which include

software, code, computer protocols and other architectures

which are used in the context of innovative technology;

''innovative technology services'' means those services in

relation to innovative technology arrangements which the

Authority may, from time to time, define, authorize or regulate;

"officer" means an officer or any person who is

appointed to carry out representative and fiduciary functions in

the control and administration of a legal person or a legal

organisation having separate legal personality, and any person

who carries out such functions even if under another name,

including a director, manager or company secretary;

"service provider" or "innovative technology service

provider" means a natural or legal person that renders

innovative technology services, including a technical expert;

(2) Words and expressions used in these regulations which

are also used in the Act but which are not defined herein shall have the

SERVICES (ITAS) CERTIFICATION

same meaning as assigned to them in the Act.

Any person who intends to obtain recognition for any

innovative technology arrangements or any innovative technology

service may apply to the Authority by making use of the relevant

prescribed forms issued by the Authority for such purpose and

accessible through the website of the Authority, or in the absence of a

prescribed form, by an application in writing providing the information

required by the Authority for such purpose with reference to the subject

matter of the application.

The Authority shall act in an open and transparent manner

when considering applications and shall seek to provide reasonable

information on the progress of an application to the applicant and, in

case of refusal, the reasons for refusing to accept an application under

these regulations shall be communicated in writing to the applicant.

Without prejudice to the forms of recognition that the

Authority may issue in accordance with the Act, there shall be a form

of recognition to be issued by the Authority known as "innovative

technology arrangements certification" or "ITA certification".

(1)

The Authority shall, from time to time, and taking

into account international and European Union legislation, determine

the types of technologies and innovative technology arrangements to

which the innovative technology arrangements certification shall apply.

(2)

The Authority may determine different types and classes

of innovative technology arrangements certification, including

certification based on self-assessment methodologies, and set the levels

of certification and elements to be assessed.

(3)

The Authority may issue innovative technology

arrangements certification to different innovative technology

arrangements for one or more specific criteria with particular reference

to: purposes, qualities, features, attributes, behaviours or aspects, as

may be determined by the Authority, and which shall be specified in the

ITA certification.

(4)

An innovative technology arrangements certification for

one or more specific purposes, qualities, features, attributes, behaviours

or other aspects shall neither operate as a certification for different

purposes, qualities, features, attributes, behaviours or other aspects, nor

shall it bar other certifications or recognitions for other purposes,

qualities, features, attributes, behaviours or other aspects.

(5)

ITA certification may be issued on an in principle or

conditional basis subject to the innovative technology arrangements

satisfying the conditions or obligations imposed by the Authority.

(6)

ITA certification issued under these regulations shall

SERVICES (ITAS) CERTIFICATION

specify the details of how the innovative technology arrangements are

identified and the innovative technology arrangements certification

shall be given a unique number for purposes of such identification.

(7)

The holder of the certified innovative technology

arrangements shall post the innovative technology arrangements

certification on the arrangement, in a specific location which shall be

notified to the Authority, in an easily accessible and legible format in

order that it can be viewed by all users of the innovative technology

arrangements.

(8)

When an innovative technology arrangements

certification is issued in favour of an innovative technology

arrangements, without specifying any elements as provided for in sub-

regulation (3), it shall be presumed to refer to all parts of the

innovative technology arrangements which are described as

constituting the arrangement in the application, unless expressly stated

otherwise, in which case it shall refer only to the specific criteria

designated as the subject of the certification.

(9)

Subject to the right of appeal provided for in the Act, it

shall be the sole discretion of the Authority to determine whether

innovative technology arrangements qualify for innovative technology

arrangements certification under these regulations.

(10)

The Authority may designate and make public, any

international or other standards of recognition it may rely on when

issuing certification under these regulations accessible through the

website of the Authority.

(11)

An applicant or holder of an innovative technology

arrangements certification shall pay to the Authority such fees as may

be prescribed by the Minister or the Authority in accordance with their

powers at law in such manner as the said Minister or Authority may

determine, from time to time, with the original application and

subsequently upon renewal, and which shall be accessible through the

website of the Authority

Provided that, the Authority reserves the right not to

prescribe any fees in terms of this sub-regulation.

(1)

Any person to whom an innovative technology

arrangements certification has been issued following an application

under these regulations shall not effect any material changes to the

certified innovative technology arrangements without having obtained

the prior written approval by the Authority of any such amendment or

substitution;

(2)

The term "material changes" in sub-regulation (1) shall

include

SERVICES (ITAS) CERTIFICATION

(a)

any alterations to any innovative technology

arrangements or parts thereof including, software, code or

computer protocol to which the ITA certification applies, save for

upgrades, maintenance, innovative evolution or the mere

replacement of any supporting software which do not materially

change the functionality, or have a material impact on the users

of the innovative technology arrangements, or are not in breach

of the regulatory principles of the Act or of the ITA certification;

(b)

any development altering the rights of users;

(c)

any changes introducing new risks, increasing any

existing risks, or which may interfere with any risk mitigation

mechanism in place;

(d)

any development altering the rights, authorisation

and powers of the Authority or any person authorised by the

Authority;

(e)

any alterations to the general purposes of the

certified innovative technology arrangements or to matters on

which the Authority has received assurances in connection with

the issuing of the ITA certification;

(f)

any alterations to matters which the Authority, in

the ITA certification or documentation leading to the issuing of

the ITA certification, specifically lists as requiring its

authorisation prior to any changes being effected; or

(g)

any other alterations that may be specified by the

Authority and accessible through its website, from time to time.

(3)

In addition to the above, in those circumstances in which

an innovative technology service provider is, on a request of the

Authority, providing services in relation to the process of the issuing of

an ITA certification, the said service provider shall specify whether any

envisaged substitution or amendment consists of a material change, in

accordance with the meaning attributed to it in sub-regulation (2), or

may have material impact on the users of the innovative technology

arrangements or third parties, or affects the content of their review,

assurances or declarations provided to the Authority for the purposes of

the certification of the relevant innovative technology arrangements

Provided that, to the extent that the changes result in

additional elements which have not been reviewed and do not fall within

the parameters of existing assurances and declarations issued by the said

service provider, the said service provider shall carry out a review of the

said additional elements, and provide the Authority with the relative

assurances that the changes do not affect his previous declarations and

evaluations of the certified innovative technology arrangements.

SERVICES (ITAS) CERTIFICATION

(4)

The Authority may, prescribe mandatory notification in

general or give directions as it may deem fit in the circumstances of

the case.

Where prior authorisation to any envisaged changes is not

required according to these regulations, the person to whom an

innovative technology arrangements certification has been issued

following an application under these regulations shall provide the

Authority with the details of any changes in the certified innovative

technology arrangements, or to the information that had been provided

to the Authority in the application process provided for in terms of these

regulations, within thirty (30) days of such changes materializing.

(1)

All certificates under these regulations shall be

valid for the period as established by the Authority and shall be

presumed to expire on the first day after the lapse of the period of

validity indicated on the certificate, unless renewed by the Authority

in accordance with these regulations, in which case the expiry date

shall be extended by the renewal period and the innovative technology

arrangements certification shall lapse on the day after the said

extended expiry date.

(2) It shall be the duty of the innovative technology

arrangements certification holder to ensure that the said certification is

valid and effective throughout the duration period and that subject to

the confirmation by the Authority, the innovative technology

arrangements certification shall be renewed at least within the last

three (3) months of its duration period and in any case prior to expiry.

(1)

The Authority shall be empowered to register

persons providing innovative technology services for purposes that the

Authority shall, from time to time, define and publish through

guidelines and which shall be accessible through the website of the

Authority setting out the functions and obligations of such registered

innovative technology service providers within the framework of

innovative technology recognition and certification.

(2)

The registration of an innovative technology service

provider may be made in relation to natural or legal persons, or legal

organisations having separate legal personality, as the Authority may

determine.

(3)

The Authority shall determine the means of application

for the purposes of registering innovative technology service

providers, and the general and specific requirements for registration,

including requirements relating to "fit and proper" tests that the

innovative technology service providers must satisfy whether they are

natural or legal persons, or legal organisations having separate legal

personality.

(4)

The Authority shall establish rules on the manner in

SERVICES (ITAS) CERTIFICATION

which innovative technology services are to be provided by natural or

legal persons, or legal organisations having separate legal personality,

including where necessary, rules on the internal segregation of functions

and on the responsibility for the recognised functions and which shall be

accessible through the website of the Authority.

(5)

The Authority may designate and make public and

accessible through its website any international or other standards of

service it may rely on when considering a registration of innovative

technology service providers under these regulations.

(6)

Without prejudice to the other requirements that may be

published by the Authority through guidelines accessible through its

website, the Authority shall not recognise an innovative technology

services provider if the circumstances referred to in article 28 of the

Act arise.

(7)

The Authority shall grant the registration to recognised

innovative technology service providers which shall specify the official

name and surname, if applicable, and registered address and have a

unique number for identification purposes and a list of the classes of

services which the applicant has been registered to provide.

(8)

The registered innovative technology service provider

shall post the registration issued to it by the Authority on its website, if

applicable, as well as on any innovative technology arrangements to

which it renders its services in a specific location, as may be further

specified by the Authority. Said posting of the registration, which shall

be in an easily accessible and legible format in order that it can be

viewed and clearly understood by all users of the innovative

technology arrangements, shall be notified to the Authority.

(9)

When an innovative technology service provider is a legal

person, or a legal organisation having separate legal personality the

registration shall be issued in the name of the legal person or the legal

organisation and where the service is carried out personally by such

service provider, the registration shall be issued in the official name

and surname of the said service provider.

(10) Innovative technology service providers registered under

the provisions of these regulations shall be considered to be

professionals who act as fiduciaries in relation to the information

submitted to them by any customers and shall also be bound by the

provisions of the Professional Secrecy Act and shall act accordingly.

(11) The Authority shall be empowered to require innovative

technology arrangements that are seeking to be, or may have been

certified by the Authority, to engage the services of registered

innovative technology service providers to carry out specific functions

in relation to the innovative technology arrangements certification or

SERVICES (ITAS) CERTIFICATION

review process, as shall be specified by the Authority in its published

guidelines accessible through its website.

(1)

Registrations issued to innovative technology

service providers under these regulations shall be valid for a period of

three (3) years and shall expire accordingly unless renewed in terms of

regulation 11(2), provided that the Authority may issue a registration

for a different period, as it may deem reasonable.

(2)

It shall be the duty of the innovative technology service

provider to ensure that the registration is valid and effective

throughout the period of duration, and subject to the confirmation by

the Authority, the registration shall be renewed at least within the last

three (3) months of its period of duration and, in any case, prior to

expiry.

(1)

When an applicant for an innovative technology

arrangements certification to be issued by the Authority is not

habitually resident in Malta, it may be required by the Authority to

appoint, a resident agent who

(a)

is habitually resident in Malta;

(b)

is not interdicted or incapacitated or is an

undischarged bankrupt;

(c)

has not been convicted of any of the crimes

affecting public trust or of theft or of fraud or money laundering

or of knowingly receiving property obtained by theft or fraud;

and

(d)

has satisfied the Authority that he is a person

capable of carrying out the functions provided for in terms of

these regulations.

(2)

A legal person and a legal organisation having a separate

legal personality shall be considered as not being habitually resident in

Malta for the purposes of this regulation if none of

(a)

the members of its board of administrators or

secretary; and

(b)

its senior officers, being the chief executive

officer, the chief operations officer or its chief technology

officer;

are habitually resident in Malta.

(3)

Notices of the appointment, including the terms of

engagement, resignation or removal of the resident agent shall be filed

with the Authority in the prescribed form, and until such form is issued

SERVICES (ITAS) CERTIFICATION

by the Authority, by means of a notification in writing and, where a

notice of appointment is given, it shall be accompanied by the

acceptance in writing of the resident agent of such appointment.

(4)

The Authority may, at any time, refuse or reject any

notice of an appointment which it considers is not in compliance with

these regulations, and in such case, the innovative technology

recognition holder or applicant, as the case may be, shall immediately

propose another resident agent.

(1)

It shall be the function of the resident agent on

behalf of the innovative technology certification applicant or holder to

(a)

act as the channel of communication between the

innovative technology recognition holder or applicant and the

Authority and other Maltese government departments and

authorities;

(b)

sign and file with the Authority and other Maltese

government departments and authorities all declarations and

forms as may be required in terms of Maltese law; and

(c)

act as the legal representative of the innovative

technology recognition holder or applicant for judicial

proceedings in Malta, and any notice whether by the Authority

or any other authority, that is sent to the resident agent at his last

registered address with the Authority, shall be deemed to have

been duly received by and notified to the innovative technology

recognition holder or applicant.

(2)

The resident agent shall not be held personally liable for

non-compliance by the innovative technology recognition holder or

applicant with any law, nor for any misrepresentation made in any

submissions or documents issued by the innovative technology

recognition holder or applicant, even if authenticated by the resident

agent for the purposes of the application, certification, recognition or

any other law, unless the resident agent has personally undertaken such

liability for the compliance in writing or has himself wilfully or

negligently made a false declaration.

(3)

The resident agent shall neither be responsible for any

court fees, legal expenses, or any related expenses in the event of any

judicial proceedings filed against him in his capacity as legal

representative of the innovative technology recognition holder or

applicant or any of its officers, by whosoever they may have been filed.

(1)

Without prejudice to the express powers entrusted

to the resident agent by an innovative technology recognition holder or

applicant in the said engagement, the resident agent shall have the

power on behalf of the innovative technology certification holder or

SERVICES (ITAS) CERTIFICATION

applicant, to

(a)

sign and file applications, declarations, notices,

returns and any other document that may be required in terms of

Maltese law;

(b)

apply for the recognition or certification of an

innovative technology arrangement or for the registration of an

innovative technology service provider under these regulations

and for the revocation or cancellation of a recognition or

certification or registration, and to perform any ancillary act in

relation thereto;

(c)

pay all relative fees and taxes payable in terms of

Maltese law;

(d)

do all other things as may be considered

conducive or ancillary for the certification or other form of

recognition or registration under the Act, these regulations or

for the maintenance of such recognition or registration;

(e)

authenticate documents issued by the innovative

technology recognition holder or applicant; and

(f)

receive formal notification on behalf of the

innovative technology recognition holder or applicant when

notifications are required under the provisions of these

regulations or any other law or any agreement

Provided that it shall not be lawful for the certification of

an innovative technology arrangements or the registration of an

innovative technology service provider to be issued in the name of the

resident agent, even if he is formally authorised for such purpose.

(2)

The resident agent shall be deemed to have all the

necessary powers to enter into binding undertakings with the

Authority on matters relating to the recognition by the Authority on

behalf of the innovative technology recognition holder or applicant

and the Authority is authorised to act accordingly

Provided that nothing in this Act shall imply any power

of a resident agent to execute any document relating to an undertaking

involving liability unless expressly authorised to do so in writing.

(3)

The innovative technology recognition holder or

applicant may restrict any of the above powers of the resident agent

Provided that where the innovative technology

recognition holder or applicant limits such powers, it shall file with the

Authority a declaration to that effect in the prescribed form issued by

the Authority and accessible through its website and such limitation

SERVICES (ITAS) CERTIFICATION

shall not have effect with regard to third parties until it is so filed and

recorded in the register of recognitions published by the Authority.

(4)

Unless expressly prohibited from doing so in terms of his

engagement, the resident agent may delegate and specifically appoint

in writing another person to act in specific matters on his behalf

provided that in so doing the resident agent shall not in any manner be

relinquishing any of the functions, powers and responsibilities

conferred on him under these regulations.

(1)

A resident agent may resign from his position as a

resident agent by giving at least thirty days’ (30) notice, or such other

shorter period as the innovative technology arrangements certification

holder, or the Authority may consent to in writing.

(2)

The innovative technology arrangements certification

holder or applicant may remove the resident agent by giving at least

thirty days’ (30) notice, or such other shorter period as the Authority

may consent to in writing.

(3)

The Authority shall have the power to appoint, on a

limited and temporary basis, a resident agent on behalf of the

innovative technology arrangements certification holder in case the

post of a resident agent is vacant for more than five (5) working days

and the innovative technology arrangements certification holder has

failed to fill that vacancy within said time. Such resident agent shall

seek to establish contact with the persons who have duties in relation to

the governance of the innovative technology arrangements in order that

they shall appoint a resident agent of their choice

Provided that in such case as provided in sub-regulation

(4), the appointee shall be an advocate with a warrant to practice law in

Malta.

(4)

Where the ITA certification holder or applicant is in

default of his obligations under these regulations in that the position of

a resident agent is vacant and the Authority, pursuant to sub-regulation

(3), did not appoint a temporary resident agent within the period

stipulated in the guidelines accessible through the website of the

Authority, the said Authority may, without prejudice to any other action

that may be taken under these regulations, apply to the Civil Court,

First Hall for the appointment of a curator to act as resident agent until

such time as another resident agent is appointed by the Court or the

innovative technology arrangements certification ceases to have effect.

The provisions of Part IX of the Act shall apply to

decisions taken by the Authority pursuant to these regulations.

Unless expressly stated in the Act or any European Union

legislation or any other law, nothing in these regulations shall be

SERVICES (ITAS) CERTIFICATION

considered as exempting any innovative technology arrangements or

any innovative technology service provider from the provisions of any

other law, including other regulatory laws requiring authorisations or

approvals

Provided that, in the event that a requirement under these

regulations is similar in scope to that under another law and has been

satisfactorily satisfied by an applicant, the Authority may, if necessary

with the written consent of the applicant, co-ordinate with the other

national competent authorities and rely on the submissions and

processes being carried out by the other authorities in carrying out its

duties under these regulations.