ARTIFICIAL INTELLIGENCE REGULATIONS

SUBSIDIARY LEGISLATION 591.05

ARTIFICIAL INTELLIGENCE REGULATIONS

10th October, 2025 *

LEGAL NOTICE 226 of 2025.

(1)

The title of these regulations is the Artificial

Intelligence Regulations.

(2)

These regulations implement the requisites of Regulation

(EU) 2024/1689 of the European Parliament and of the Council of 13

June 2024 laying down harmonised rules on artificial intelligence and

amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU)

No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144

and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828

(Artificial Intelligence Act).

(3)

Regulations 4, 5, 6, 8, 9, and 10 shall come into force on

the 2nd of August 2026.

(1)

In these regulations, unless the context otherwise

requires

"Act" means the Malta Digital Innovation Authority Act;

"Malta Digital Innovation Authority" means the Malta

Digital Innovation Authority established by article 5 of the

Malta Digital Innovation Authority Act;

"Malta Financial Services Authority" means the Malta

Financial Services Authority established by article 3 of the

Malta Financial Services Authority Act;

"Regulation (EU) 2024/1689" means Regulation (EU)

2024/1689 of the European Parliament and of the Council of 13

June 2024 laying down harmonised rules on artificial

intelligence and amending Regulations (EC) No 300/2008,

(EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU)

2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU,

(EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence

Act);

"SME" means small and medium enterprises as defined

in Commission Recommendation 2003/361/EC of 6 May 2003

concerning the definition of micro, small and medium-sized

enterprises;

(2)

Any terms which are not defined in these regulations

*Regulations 4,5,6,8,9 & 10 are not in force.

ARTIFICIAL INTELLIGENCE

shall have the same meaning as assigned to them in Regulation (EU)

2024/1689

Provided that unless the context otherwise requires,

terms used in these regulations, which are not defined in Regulation

(EU) 2024/1689 and which are not defined herein, shall have the same

meaning as that assigned to them in the Act.

(1)

The Malta Digital Innovation Authority shall,

unless otherwise provided in these regulations or any other law, be

designated as a market surveillance authority for the purpose of

Regulation (EU) 2024/1689

Provided that

(a)

irrespective of the above, for the purposes of

regulation 9, the Malta Digital Innovation Authority shall be the

sole national competent Authority responsible for the

establishment and functioning of a national AI regulatory

sandbox;

(b)

for high-risk AI systems placed on the market, put

into service, or used by financial institutions regulated by

Union financial services law, coordination shall be ensured

between the Malta Digital Innovation Authority and the Malta

Financial Services Authority, and the Malta Digital Innovation

Authority shall seek to report any information identified in the

course of the market surveillance activities that may be of

potential interest for the prudential supervisory tasks of the

Malta Financial Services Authority and the Malta Financial

Services Authority shall provide any information requested by

the Malta Digital Innovation Authority for the purposes of

carrying out its responsibilities, duties, powers and functions as

market surveillance authority;

(c)

for high-risk AI systems related to products

covered by the Union harmonisation legislation listed in

Section A of Annex I of Regulation (EU) 2024/1689,

coordination shall be ensured between the Malta Digital

Innovation Authority and the relevant sectoral market

surveillance authorities responsible for the enforcement of the

Union harmonisation legislation listed in Section A of Annex I

of Regulation (EU) 2024/1689 shall provide any information

requested by the Malta Digital Innovation Authority for the

purposes of carrying out its responsibilities, duties, powers and

functions as a market surveillance authority;

(d)

without prejudice to any other law designating

any other body or person as a market surveillance authority for

the purposes of Regulation (EU) 2024/1689, the Minister may

by order in the Gazette designate other bodies or persons as a

market surveillance authority for different provisions and for

different purposes of these regulations and Regulation (EU)

2024/1689 as may be amended from time to time

Provided further, that where no market

surveillance authority has been designated for the purpose of

Regulation (EU) 2024/1689, the Malta Digital Innovation

Authority shall be automatically designated as the market

surveillance authority.

(2)

The Malta Digital Innovation Authority shall be

designated as the single point of contact for the purposes of Regulation

(EU) 2024/1689.

(3)

Without prejudice to any other law providing for the

responsibilities, duties, powers and functions of the Malta Digital

Innovation Authority, the Malta Digital Innovation Authority shall

have all the responsibilities, duties, powers and functions granted to

the market surveillance authorities by virtue of Regulation (EU) 2024/

1689. (4)

For the purpose of implementing the requisites of

Regulation (EU) 2024/1689, the Malta Digital Innovation Authority

shall facilitate coordination between market surveillance authorities

and other relevant national authorities or bodies which supervise the

application of Union harmonisation legislation listed in Annex I, or in

other Union law, that may be relevant for the high-risk AI systems

referred to in Annex III.

(5)

The Malta Digital Innovation Authority may call upon

experts of the scientific panel established under Article 68 of

Regulation (EU) 2024/1689 to support national enforcement activities

under Regulation (EU) 2024/1689.

*

(1)

For the purposes of Regulation (EU) 2024/1689,

the Malta Digital Innovation Authority shall publish a list of national

public authorities or bodies protecting fundamental rights on its

website, which list may be amended upon request or ex officio to keep

the list up to date.

(2)

For the supervision and enforcement of obligations under

Union law protecting fundamental rights, including the right to non-

discrimination, in relation to the use of high-risk AI systems referred

to in Annex III of Regulation (EU) 2024/1689, the national public

authorities or bodies protecting fundamental rights, including those

referred to in sub-regulation (1) shall have all the duties and powers of

an authority or body protecting fundamental rights as prescribed in

*Not yet in force.

Regulation (EU) 2024/1689 within their respective scope

Provided that the duties and powers referred to in this

regulation shall be without prejudice to any other law providing for the

responsibilities, duties, powers and functions of such authorities or

bodies.

*

For the purposes of Article 18(2) of Regulation (EU)

2024/1689, a provider or its authorised representative established in

Malta which becomes bankrupt or ceases its operation prior to the end

of the period established in Article 18(1) of Regulation (EU) 2024/

1689 shall nonetheless keep the documents referred to therein at the

disposal of the national competent authorities until the period of ten

(10) years elapses.

†

For the purpose of Article 23(6) of Regulation (EU)

2024/1689, importers shall provide the national competent authorities,

upon a reasoned request, with all the necessary information and

documentation, including that referred to in Article 23(5) of

Regulation (EU) 2024/1689, to demonstrate the conformity of a high-

risk AI system with the requirements stipulated in Section 2 of

Regulation (EU) 2024/1689 in either the Maltese or English Language.

(1)

The Malta Digital Innovation Authority shall be

designated as the Notifying Authority for the purpose of Regulation

(EU) 2024/1689

Provided that the assessment and monitoring referred to

in Article 28(1) of Regulation (EU) 2024/1689 shall be carried out by

the National Accreditation Board (Malta).

(2)

The Malta Digital Innovation Authority may only notify

conformity assessment bodies which have satisfied the requirements

laid down in Article 31 of Regulation (EU) 2024/1689.

(3)

The provisions of sub-article (1) and (2) of this

regulation shall apply notwithstanding any provision of law to

the contrary.

(4)

An appeal shall lie to the Notifying Authority against

decisions of the notified bodies, including on conformity certificates

issued in accordance with Article 44 of Regulation (EU) 2024/1689 in

the manner, as may be prescribed from time to time by the Malta

Digital Innovation Authority, by virtue of guidelines or other binding

documentation.

‡

The provider or, where applicable, the authorised

representative shall register high-risk AI systems referred to in point 2

*Not yet in force.

†Not yet in force.

of Annex III of Regulation (EU) 2024/1689 with the Malta Digital

Innovation Authority in the manner as may be prescribed from time to

time by the Malta Digital Innovation Authority, including by virtue of

guidelines or other binding documentation.

*

(1)

The Malta Digital Innovation Authority shall be

the national authority responsible for the establishment and

functioning of a national AI regulatory sandbox in terms of Article 57

of Regulation (EU) 2024/1689.

(2) Without prejudice to any other responsibilities, duties,

powers and functions that the Malta Digital Innovation Authority may

have in relation to the national AI regulatory sandbox, the Malta

Digital Innovation Authority shall, subject to the conditions provided

for in Article 62 and 70(8) of Regulation (EU) 2024/1689

(a)

provide SMEs, including start-ups, having a

registered office or a branch in the Union, with priority access

to the AI regulatory sandbox;

(b)

organise specific awareness raising and training

activities on the application of Regulation (EU) 2024/1689

tailored to the needs of SMEs including start-ups, deployers

and, as appropriate, local public authorities;

(c) utilise existing dedicated channels and where

appropriate, establish new ones for communication with SMEs

including start-ups, deployers, other innovators and, as

appropriate, local public authorities to provide advice and

respond to queries about the implementation of Regulation

(EU) 2024/1689 including as regards participation in AI

regulatory sandboxes; and

(d)

facilitate the participation of SMEs and other

relevant stakeholders in the standardisation development

process.

† Without prejudice to other administrative or judicial

remedies, any natural or legal person having grounds to consider that

there has been an infringement of the provisions of these regulations or

of Regulation (EU) 2024/1689 may submit a complaint to the Malta

Digital Innovation Authority. In accordance with Regulation (EU)

2019/1020, such complaints shall be taken into account for the purpose

of conducting market surveillance activities, and shall be handled in

line with the procedures established therefor by the market

surveillance authorities.

‡Not yet in force.

*Not yet in force.

†Not yet in force.

(1)

Without prejudice to the specific provisions on

penalties established under Chapter XII of Regulation (EU) 2024/

1689, any operator who commits an infringement of these regulations

or of Regulation (EU) 2024/1689 shall be liable to an administrative

penalty of up to three hundred and fifty thousand euro (€350,000) for

each infringement or, in the case where the offender is an undertaking,

up to one per cent (1%) of its total worldwide annual turnover for the

preceding financial year, whichever is higher.

(2)

Without prejudice to the specific provisions on penalties

established under Chapter XII of Regulation (EU) 2024/1689, the

Malta Digital Innovation Authority may, instead of, or in addition to

the administrative penalty referred to in sub-regulation (1) impose on

an operator who commits an infringement of these regulations or of

Regulation (EU) 2024/1689 a daily penalty of twelve thousand euro

(€12,000) for each day during which such infringement persists.

(3)

Unless otherwise specified in these regulations,

proceedings in relation to an infringement of these regulations and of

Regulation (EU) 2024/1689 shall be instituted by the Malta Digital

Innovation Authority and any administrative penalty imposed and, or

decision taken by the Malta Digital Innovation Authority shall be

subject to an appeal in accordance with Part IX of the Act.

(4)

When deciding whether to impose an administrative

penalty and in determining the amount of the administrative penalty in

each case, all relevant circumstances of the specific situation shall be

taken into account and, as appropriate, regard shall be given to the

following

(a)

the nature, gravity and duration of the

infringement and of its consequences, taking into account the

purpose of the AI system, as well as, where appropriate, the

number of affected persons and the level of damage suffered by

them;

(b)

whether administrative penalties have already

been applied by other market surveillance authorities to the

same operator for the same infringement;

(c)

whether administrative penalties have already

been applied by other authorities to the same operator for

infringements of other Union or national law, when such

infringements result from the same activity or omission

constituting a relevant infringement of these regulations and of

Regulation (EU) 2024/1689;

(d)

the size, the annual turnover and market share of

the operator committing the infringement;

(e)

any other aggravating or mitigating factor

applicable to the circumstances of the case, such as financial

benefits gained, or losses avoided, directly or indirectly, from

the infringement;

(f)

the degree of cooperation with the national

competent authorities, in order to remedy the infringement and

mitigate the possible adverse effects of the infringement;

(g)

the degree of responsibility of the operator taking

into account the technical and organisational measures

implemented by it;

(h)

the manner in which the infringement became

known to the national competent authorities, in particular

whether, and if so to what extent, the operator notified the

infringement;

(i)

the intentional or negligent character of the

infringement;

(j)

any action taken by the operator to mitigate the

harm suffered by the affected persons.

(5)

The Malta Digital Innovation Authority, as the case may

be, may, after giving due regard to the circumstances of the case

impose an administrative penalty on a public authority or body

Provided that such an administrative penalty shall not

exceed fifty thousand euro (€50,000) for each infringement and,

additionally, the Malta Digital Innovation Authority, as the case may

be, may impose a daily penalty of fifty euro (€50) for each day during

which such infringement persists.

(6)

At any stage of the proceedings in relation to an

infringement of these regulations and of Regulation (EU) 2024/1689,

the Malta Digital Innovation Authority may require any person or

public authority who has violated any provision of these regulations or

of Regulation (EU) 2024/1689 to undertake in writing to refrain from

such conduct and to take any remedial or other action as the Malta

Digital Innovation Authority may specify.

(7)

Without prejudice to sub-regulations (1),(2),(5) and (6),

the Malta Digital Innovation Authority may at any stage of the

proceedings in respect of any infringement of these regulations or of

Regulation (EU) 2024/1689, issue reprimands, warnings, or take any

other similar non-monetary disciplinary measures or any other

measures it may deem appropriate or necessary.

(8)

The Malta Digital Innovation Authority may establish

and publish policies and guidelines from time to time regarding the

measures referred to in sub-regulation (7).

(9)

The initiation of proceedings by the Malta Digital

Innovation Authority under these regulations shall be prescribed by

the lapse of two (2) years from the date on which the infringement is

alleged to have been committed.