AI Regulation Tracker / Authority designation
Malta Named Its AI Act Authorities by Legal Notice
Two legal notices in 2025 gave Malta a named lead market surveillance authority, a named notifying authority, and a second supervisor for law enforcement AI. If you need a competent authority for the Maltese market, the MDIA page names one.
Bottom line. Malta has a complete, named AI Act supervisory structure. Legal Notice 226 of 2025 makes the Malta Digital Innovation Authority the lead market surveillance authority and single point of contact; Legal Notice 227 of 2025 adds the Information and Data Protection Commissioner as a market surveillance authority for law enforcement AI.
Who this affects. Providers and deployers placing AI systems on the Maltese market, US firms using Malta as an EU entry point, and anyone maintaining a per-market register of AI Act competent authorities.
Effective date. The AI Act became generally applicable on August 2, 2026. The Digital Omnibus moved high-risk duties to December 2, 2027 and August 2, 2028, with watermarking and transparency from December 2, 2026.
What changed. Malta named its authorities by legal notice rather than waiting for a general implementing act, and split the mandate: MDIA for the general market, the IDPC for law enforcement AI, and the National Accreditation Board for the Article 28 assessment of conformity assessment bodies.
Anthony's analysis. For a compliance team this is the useful shape: you can name the regulator, name the law enforcement route, and know who assesses the notified bodies.
Primary sources. MDIA, Artificial Intelligence, which sets out both legal notices and the Article 77 list.
Key facts
- Jurisdiction
- Malta (EU Member State)
- Lead market surveillance authority
- Malta Digital Innovation Authority (MDIA)
- Single point of contact
- MDIA
- Notifying authority
- MDIA, with Article 28(1) assessment and monitoring carried out by the National Accreditation Board (Malta)
- Second market surveillance authority
- Information and Data Protection Commissioner (IDPC), in particular for AI systems in the law enforcement domain
- Designating instruments
- Legal Notice 226 of 2025 (Artificial Intelligence Regulations) and Legal Notice 227 of 2025
- AI regulatory sandbox
- MDIA is the sole national competent authority responsible for its establishment and functioning
- Article 77 rights bodies
- Ten authorities published, including the IDPC, the Malta Competition and Consumer Affairs Authority and the Office of the Ombudsman
Regulatory briefing
- Instrument
- Legal Notice 226 of 2025 (Artificial Intelligence Regulations) and Legal Notice 227 of 2025, implementing Regulation (EU) 2024/1689
- Authority
- Malta Digital Innovation Authority (MDIA); Information and Data Protection Commissioner (IDPC); National Accreditation Board (Malta)
- Jurisdiction
- Malta, within the EU single market
- Status
- In force. The AI Act applies generally from August 2, 2026
- Bindingness
- Binding law. The designations are made by legal notice
- Effective date
- August 2, 2026 for general application. High-risk duties follow on December 2, 2027 and August 2, 2028 under the Digital Omnibus
- Primary source
- MDIA, Artificial Intelligence
What Malta actually designated
Malta has published a complete set of AI Act authorities, and the detail is worth reading because it shows what a finished designation actually contains.
The MDIA states the position directly:
By virtue of Legal Notice 226 of 2025 (Artificial Intelligence Regulations), the MDIA is designated as Malta's lead market surveillance authority, the single point of contact, and the sole national competent authority responsible for the establishment and functioning of a national AI regulatory sandbox under the AI Act.Malta Digital Innovation Authority, Artificial Intelligence, accessed August 3, 2026
A second instrument does the law enforcement half. Legal Notice 227 of 2025 empowers the Information and Data Protection Commissioner as a market surveillance authority, specifically for AI systems in the law enforcement domain. That split matters practically: the law enforcement AI file sits with the data protection commissioner rather than with the general market supervisor.
The notifying authority question is answered too, and answered carefully. The MDIA is the notifying authority, but the assessment and monitoring work that Article 28(1) requires is carried out by the National Accreditation Board. So the body that designates conformity assessment bodies is not the same body that judges their competence. That is a sensible separation and it is not obvious that every member state will make it.
Why the instrument type is interesting
Malta did this by legal notice, which is secondary legislation, rather than through a full AI implementing act.
The practical difference is speed. A designation is a narrow thing: it says who the authority is and what it may do. Bundling that into a large implementing law means the designation waits for everything else in the bill. Malta separated the two, so its designation was published and in force well before the Act became generally applicable.
I would not oversell it. A legal notice designating an authority does not, on its own, tell you how aggressively that authority will supervise, how it is resourced, or how quickly it will act on a complaint. Naming a regulator and having an effective one are different achievements, and only the first is verifiable today.
What this means if you sell into Malta
The immediate benefit is that your compliance register has real entries for Malta: the MDIA as lead and single point of contact, the IDPC where the system touches law enforcement, and a clear answer on who assesses notified bodies.
The second point is routing. If your Maltese exposure is an ordinary commercial AI product, MDIA is your counterpart. If it is a system deployed in a policing or law enforcement context, read Legal Notice 227 before you assume the same door. Sending a serious incident report to the wrong supervisor is the kind of procedural error that colours everything that follows.
Third, the sandbox. MDIA is the sole national competent authority for establishing and running Malta's AI regulatory sandbox. For a firm that wants controlled testing inside the Union, a named sandbox owner is a genuine practical advantage.
What I would not do is treat Malta as a shortcut around the Act. Designation is about supervision, not about substance. The obligations on a provider or deployer are the Regulation's obligations wherever you place the system, and a well-organised supervisor is if anything more likely to notice a gap than an absent one.
| Function | Body | Instrument or basis |
|---|---|---|
| Lead market surveillance authority | Malta Digital Innovation Authority | Legal Notice 226 of 2025 |
| Single point of contact | Malta Digital Innovation Authority | Legal Notice 226 of 2025 |
| AI regulatory sandbox | Malta Digital Innovation Authority, sole competent authority | Legal Notice 226 of 2025 |
| Market surveillance, law enforcement AI | Information and Data Protection Commissioner | Legal Notice 227 of 2025 |
| Notifying authority | Malta Digital Innovation Authority | As published by MDIA |
| Article 28(1) assessment and monitoring | National Accreditation Board (Malta) | As published by MDIA |
| Article 77 fundamental-rights bodies | Ten authorities, incl. IDPC, MCCAA, Ombudsman | As published by MDIA |
Malta named its AI Act authorities by legal notice in 2025 rather than waiting on a comprehensive implementing act, so it entered general application with a lead market surveillance authority, a single point of contact, a notifying authority and a separate supervisor for law enforcement AI. Record MDIA as your Maltese counterpart, note the IDPC route for law enforcement systems, and do not mistake a well-organised supervisor for a lighter one.
- Primary source
- Malta Digital Innovation Authority, Artificial Intelligence, which sets out Legal Notice 226 of 2025 and Legal Notice 227 of 2025, the notifying-authority arrangement with the National Accreditation Board, and the Article 77 list.
- Corroborating
- Office of the Information and Data Protection Commissioner. EU-level context at the Commission's market surveillance authorities page and Article 113 for the application dates.
- How to verify
- Open the MDIA page and read the National competent authorities section. It names Legal Notice 226 of 2025 for the MDIA designation, Legal Notice 227 of 2025 for the IDPC, and states that the Article 28(1) assessment and monitoring is carried out by the National Accreditation Board.
Last verified: August 3, 2026 against the primary sources listed above.
Frequently asked
Who is Malta's AI Act market surveillance authority?
The Malta Digital Innovation Authority. Legal Notice 226 of 2025, the Artificial Intelligence Regulations, designates the MDIA as Malta's lead market surveillance authority, the single point of contact, and the sole national competent authority responsible for the national AI regulatory sandbox. Legal Notice 227 of 2025 additionally empowers the Information and Data Protection Commissioner as a market surveillance authority, in particular for AI systems in the law enforcement domain.
Who is the notifying authority in Malta?
The MDIA is designated as the notifying authority for the purposes of Regulation (EU) 2024/1689, with the assessment and monitoring referred to in Article 28(1) carried out by the National Accreditation Board (Malta). That separates designating conformity assessment bodies from judging their competence.
Does designating an authority change my obligations in Malta?
No. The obligations come from the Regulation and apply wherever you place an AI system on the Union market. Designation determines who supervises, who receives notifications, and who acts on complaints. A named supervisor changes the procedure you follow, not the substance of what you owe.
Which Maltese bodies are listed under Article 77?
Ten are published by the MDIA, including the Office of the Information and Data Protection Commissioner, the Malta Competition and Consumer Affairs Authority, the National Commission for the Promotion of Equality, the Commission for the Rights of Persons with Disability, the Office of the Ombudsman, the Department for Industrial and Employment Relations, the Public Service Commission, the Malta Broadcasting Authority, a child protection directorate, and the Electoral Commission.