Malta does not have a standalone domestic statutory definition of “artificial intelligence.” The operative definition is supplied by the directly applicable Artificial Intelligence Act (Regulation (EU) 2024/1689) (“AI Act”), which defines an “AI system” as: “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.” This definition has effectively been adopted in Maltese law, namely the Artificial Intelligence Regulations (Subsidiary Legislation 591.05), which implements the local requirements of the AI Act in Malta, which refers to and incorporates the AI Act’s key definitions.

Yes. The Malta Digital Innovation Authority (“MDIA”), which is a public body charged with advising and assisting the Maltese government on advancements in cutting-edge technology, launched a national AI strategy in 2019 titled “Malta: The Ultimate AI Launchpad – A Strategy and Vision for Artificial Intelligence in Malta 2030”. This strategy includes 22 action points related to education and the workforce, 6 dedicated to legal and ethical considerations, and 11 concerning ecosystem infrastructure. The strategy covers a wide range of initiatives – from equipping students and educators with AI-related competencies to establishing ethical frameworks and regulatory structures that encourage the trustworthy development and deployment of AI systems. Notably, by late 2025 the government reported that 80% of the proposals in the strategy had been implemented.

Malta has recently moved to update its national AI policy. In November 2025, the MDIA and the Ministry for the Economy, Enterprise and Strategic Projects published a realigned National AI Strategy (2025–2030) for public consultation. This realigned strategy proposes 83 measures to adapt Malta’s approach to the rapidly evolving AI landscape. It focuses on three key pillars: enhanced data availability and infrastructure; leveraging of AI to support and increase the effectiveness of business operations and processes, and to facilitate the creation of new ones; and fostering the advancement of AI technology through financial incentives and strategic support. The consultation ran up to February 2026, and the Outcome Report was published thereafter.

Yes. Malta adopted AI-specific laws in 2025 to implement the local requirements of the AI Act and establish a domestic governance framework. The key instruments are the Artificial Intelligence Regulations, 2025 (Subsidiary Legislation 591.05), issued under the MDIA Act (Chapter 591 of the Laws of Malta), and the Artificial Intelligence (Designation of the Information And Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations (Subsidiary Legislation 586.14), under the Data Protection Act (Chapter 586 of the Laws of Malta).

S.L. 591.05 designates the MDIA as the primary market surveillance authority (“MSA”) and national contact point for the AI Act, tasking it with supervising and enforcing AI Act compliance in Malta (including authorising conformity assessors, operating an AI regulatory sandbox, and taking enforcement action). The MDIA gained powers to conduct inspections, require information, impose administrative fines, and coordinate with sector regulators (e.g. the financial services regulator for AI in finance).

S.L. 586.14 complements this by appointing the Information and Data Protection Commissioner (“IDPC”) as the co-regulator for certain sensitive or high-impact AI systems (e.g. biometric identification, law enforcement-related AI), and as the national Fundamental Rights Authority under the AI Act responsible for privacy and fundamental rights in AI contexts. It also sets out procedural safeguards for the use of real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, including prior authorisation by a Magistrate and notification to the Commissioner, reflecting the strict approach under the AI Act

These were preceded by Legal Notice 225 of 2025, which added the AI Act to the list of EU consumer laws covered by the Representative Actions (Consumers) Act (Chapter 635 of the Laws of Malta). The Representative Actions (Consumers) Act aims to protect the collective interests of consumers and facilitate bringing collective legal actions against traders violating EU consumer law. The AI Act’s inclusion means that breaches of consumer facing obligations under the AI Act may give rise, at a local level, to representative actions aimed at protecting the collective interests of consumers.

In addition to the above, other local legislation also makes reference to AI. This includes the National Foreign Direct Investment Screening Office Act (Chapter 620 of the Laws of Malta), which imposes a prior notification obligation where a foreign direct investment affects, amongst other activities and sectors, critical technologies, including AI. The MDIA Act (Chapter 591 of the Laws of Malta) classifies AI as innovative technology. This classification brings AI within the remit of the MDIA’s purpose, functions and powers, and extends local regulatory oversight to AI as a category of innovative technology.

General laws continue to apply to AI use. Key frameworks include the Criminal Code (Chapter 9 of the Laws of Malta), whereby the unauthorised use of software, or use of software (which would include AI) to unlawfully access or render data inaccessible would constitute an offence of unlawful access to, or use of, information. Similarly, using AI to commit fraud or forgery would render a person liable to the relevant offences under the Criminal Code. Deep fakes that are defamatory could also render the perpetrator liable for a breach of the Media and Defamation Act (Chapter 579 of the Laws of Malta). Under the Civil Code (Chapter 16 of the Laws of Malta), persons are responsible for harm caused by the tools or technologies they use, while AI developers and deployers may accordingly be liable under negligence or contract principles. The Data Protection Act (Chapter 586 of the Laws of Malta) (implementing the General Data Protection Regulation (“GDPR”)) governs personal data processing in AI systems, including use of machine learning on personal datasets.

Beyond these regulations, Malta has voluntary AI guidelines and standards. In 2019 – as part of its first AI strategy – Malta unveiled a national AI Ethical Framework and Certification Programme, under the MDIA. This voluntary framework laid out four ethical AI principles (including fairness, transparency, accountability, and safety) and a certification scheme (the AI Innovative Technology Arrangement) whereby developers and deployers could seek MDIA accreditation for compliant AI systems. While voluntary, this ethical framework signalled Malta’s early commitment to trustworthy AI. The MDIA also developed an AI sandbox and Technology Assurance Sandbox Guidelines to facilitate innovation in a controlled environment, particularly in sectors like financial services. These initiatives are now being updated to align with the binding requirements of the AI Act.

There is no Maltese legislation governing AI transparency and the applicable requirements derive from directly applicable EU instruments. The principal source is Article 50 of the AI Act, which requires providers and deployers to ensure that natural persons are informed when they are interacting with an AI system, such as a chatbot, unless this is obvious from the circumstances, and that AI-generated or manipulated content – including deep fakes and other synthetic media – is disclosed and appropriately labelled as artificially generated. These obligations are supported by the EU Code of Practice on Transparency of AI-Generated Content, published  on 10 June 2026, which offers practical guidance on implementation measures such as watermarking and metadata tagging.

For high-risk AI systems, the AI Act imposes additional record-keeping, logging, technical documentation and conformity-assessment obligations that underpin auditability, supervised in Malta by the MDIA and, in respect of fundamental-rights-sensitive systems, the IDPC. The GDPR adds a further layer, entitling data subjects to be informed of how their personal data is processed and, where solely automated decision-making is involved, to meaningful information about the logic of the processing. In the consumer sphere, Article 5(1)(ea) of the Consumer Rights Regulations (Subsidiary Legislation 378.17 of the Laws of Malta) requires a trader to inform the consumer, prior to the conclusion of a distance or off-premises contract, where the price has been personalised on the basis of automated decision-making. There is no general obligation to disclose every use of AI to a customer or client; rather, disclosure duties are triggered by the specific context in question.

Yes. The principal requirements stem from the AI Act and, in respect of personal-data processing, the GDPR. For high-risk AI systems, the AI Act requires deployers and providers to ensure effective human oversight, designed so that a competent person is able to understand, monitor and, where necessary, intervene in or halt the operation of the system. This is of particular relevance in contexts such as employment, creditworthiness assessment and healthcare, all of which fall within the high-risk classification under Annex III of the AI Act.

The GDPR reinforces this position through Article 22, which affords individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, save where one of the limited exceptions applies. In practice, this requires meaningful human involvement in high-impact decisions.

As a matter of best practice, Malta’s voluntary AI Ethical Framework and Certification Programme places human oversight and accountability among its guiding principles, while the Malta Gaming Authority (“MGA”) has recently launched a public consultation on a proposed AI Gaming Charter on the Ethical and Responsible Use of AI – designed to complement existing legal and regulatory frameworks, while reflecting the specific operational context of the gaming industry.

There is no Maltese legislation that prescribes technical fairness standards or mandates bias testing for AI systems, and the matter is instead addressed through the AI Act. Notwithstanding, general Maltese non-discrimination rules continue to apply to AI-enabled decisions, particularly in employment, recruitment, creditworthiness assessment and consumer matters.

Algorithmic bias is among the most well-documented risks associated with AI, and the transparency, data-governance, risk-management and human-oversight obligations imposed by the AI Act on high-risk systems serve as the principal harmonised tools for mitigating it. Notably, the AI Act permits, subject to strict safeguards, the processing of special categories of personal data where this is strictly necessary to detect and correct bias in high-risk AI systems, although this allowance does not displace the conditions for processing such data under the GDPR.

Malta has not enacted a bespoke AI liability regime. Harm caused by AI is therefore addressed through the general principles of contract, tort and criminal law, supplemented by EU product-liability rules.

As AI is treated as a “tool” under these traditional law concepts and has no legal personality, liability cannot attach to the system itself but rather to the natural or legal persons within the chain. Typically, this will be the deployer who exercised control over the system at the material time, although the developer or manufacturer may be liable where the harm results from a defect in the technology itself, or where the law imposes strict liability.

The general principles of contract and tort law are enshrined in the Civil Code and the Commercial Code (Chapters 16 and 13 of the Laws of Malta, respectively), and rest on the obligation to act in good faith to the standard of the bonus paterfamilias. Article 1033 of the Civil Code, which establishes fault-based liability where a person causes damage through negligence, imprudence or want of attention, is of particular relevance and applies equally in personal and professional settings. A user cannot escape responsibility by invoking the “black box” character of a system or professing ignorance of its workings; the law expects reasonable steps to be taken to understand the risks and limitations of the technology deployed. Save where EU law imposes strict liability on the manufacturer, Maltese procedural principles mean that a person who suffers damage through a third party’s use of an AI system would ordinarily proceed against that third party rather than the manufacturer.

As regards the burden of proof, under Article 1033 of the Civil Code (Chapter 16 of the Laws of Malta) a victim seeking compensation must establish:

1. the existence of actual damage;
2. a direct causal link between the operation of the AI system and the damage suffered;
3. fault – whether negligence, imprudence or want of attention – on the part of a natural or legal person involved in the AI system’s lifecycle; and
4. the identity of the party most closely connected to the cause of the harm, typically the deployer in operational control at the relevant time.

From a criminal-law perspective, a non-human entity cannot bear criminal liability under Maltese law: both the actus reus (the act) and mens rea (the intent) must be established, and while the latter element is necessarily tied to a human actor (typically the developer, operator or user), the former element may in some cases be preferable to the AI system. Responsibility is accordingly expected to rest with the persons who deploy or use AI systems.

At EU level, the new Product Liability Directive (Directive (EU) 2024/2853) (“New PLD”), expressly extends strict product liability to software and AI systems, whether stand-alone or embedded, broadens the categories of recoverable damage (including the loss or corruption of data and certain psychological harm), and widens the range of economic operators who may be held liable. Member States, including Malta, are required to transpose the Directive by 9 December 2026.

Once transposed, the New PLD will alleviate the burden of proof required by local legislation, by introducing rebuttable presumptions of defectiveness and causation, together with evidence-disclosure obligations, where the technical complexity of the system renders proof excessively difficult for the claimant.

Cybersecurity obligations applicable to AI systems in Malta do not stem from AI-specific cybersecurity legislation but from a layered EU framework operating alongside the AI Act. The AI Act itself requires high-risk AI systems to achieve appropriate levels of accuracy, robustness and cybersecurity throughout their lifecycle, including resilience against attempts to manipulate their use or performance through adversarial attacks, data poisoning or model-related vulnerabilities.

For financial entities, the Digital Operational Resilience Act (“DORA“) requires the detection, classification and reporting of major ICT-related incidents – including those involving AI components – to the competent authorities, alongside obligations relating to ICT risk management and the oversight of ICT third-party providers. The NIS 2 Directive, transposed into Maltese law through the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (Subsidiary Legislation 460.41 of the Laws of Malta), extends mandatory risk-management and incident-reporting obligations to a broader range of entities classified as essential or important. Where an AI-related incident gives rise to a personal-data breach, the breach-notification obligations under the GDPR are also engaged.

The Cyber Resilience Act (“CRA“) also intersects with the AI Act in respect of products with digital elements and its relevance depends on whether the AI is embedded in or constitutes a product within the CRA framework. Where such a product is also classified as a high-risk AI system and is subject to cybersecurity requirements, the conformity assessment procedure under the AI Act applies, so that compliance is assessed once rather than separately under each regime, thereby avoiding a duplication of conformity assessments.

Malta does not currently have a standalone statutory framework that mandates insurance for AI systems, nor is there a developed market in Malta for dedicated AI-specific cover

AI-related risk is, however, generally capable of being insured under existing cyber, technology errors and omissions, professional indemnity, product liability and directors’ and officers’ policies, depending on the nature of the insured’s activities and the policy wording.

No. Under the Patents and Designs Act (Chapter 417 of the Laws of Malta), the right to a patent vests in the “inventor”, who must be a natural person – with the rights passing to the employer where the invention is made in the course of employment. It follows that an AI system cannot be named as an inventor in its own right. This position is consistent with the approach of the European Patent Office, which has declined to recognise AI systems as inventors. There is no Maltese jurisprudence on this point, and no legislative proposal to extend inventorship to AI.

This matter has not been decided upon by our Courts and there is no reply in legislation. However, based on the entrenched European and Maltese principles of copyright law, whether copyright attaches to content generated through or with the use of AI depends on the role that the AI system plays. If such a system merely provides a basis for a work which is then substantially modified so as to still give rise to the human author’s creative choices, copyright could arise.

Under the Copyright Act (Chapter 415 of the Laws of Malta) an “author” is defined as the natural person, or group of natural persons, who created a work eligible for copyright protection. Consequently, AI-generated works would not qualify for copyright protection unless a natural person can evidence, if challenged, that he or she did substantively participate in the creation process.

By contrast, AI software and underlying code may be protected under the Copyright Act, subject to the requirement of originality, while databases compiled for the purpose of training an AI model may attract sui generis database protection under Article 25, where substantial investment in obtaining, verifying or presenting their contents can be demonstrated.

Malta has not enacted standalone legislation regulating the use of AI in the workplace, with the area instead being governed by the AI Act, the GDPR and other applicable legislation. Under the AI Act, AI systems used for the recruitment, selection, performance evaluation and termination of workers are classified as high-risk under Annex III, and are accordingly subject to obligations relating to transparency, human oversight, data governance and risk management. The AI Act additionally prohibits the use of emotion-recognition systems in the workplace, subject only to narrow medical or safety-related exceptions. Under Article 22 of the GDPR, fully automated decisions producing legal effects or similarly significant impacts on individuals – such as the automated shortlisting or dismissal of employees – are restricted unless a lawful exception applies.

While no Maltese employment statute refers expressly to AI, the Digital Platform Delivery Wages Council Wage Regulation Order (Subsidiary Legislation 452.127 of the Laws of Malta) is notable in regulating the conditions of couriers and delivery personnel operating through digital platforms and subject to algorithmic management, the latter being defined as the use by digital labour platforms of automated systems.

At policy level, Malta’s National AI Strategy promotes ethical AI adoption and workforce readiness, with action points directed at equipping workers with digital skills, anticipating the impact of automation on the labour market, and raising AI awareness across all levels of education.

AI development and use give rise to significant data-protection considerations, governed in Malta by the directly applicable GDPR. Training datasets, which are frequently scraped from online sources, often contain personal data, raising questions as to the lawful basis for processing – most commonly legitimate interests under Article 6(1)(f), subject to a balancing test, or consent, which is difficult to obtain and manage at scale – as well as questions of purpose limitation and data minimisation under Article 5, given that AI training rarely corresponds to the purpose for which the data was originally collected. Unlawful processing at the training stage may, in turn, taint the outputs subsequently generated by the system. Special categories of personal data may be processed only where a condition under Article 9 is satisfied. The AI Act’s narrow allowance for processing such data to monitor bias in high-risk systems does not displace these requirements.

Anonymisation remains an important safeguard, since data that is genuinely anonymised falls outside the scope of the GDPR; to qualify, however, the anonymisation must be irreversible in practice. Pseudonymised data, by contrast, continues to fall within the GDPR’s scope.

Data subjects retain the full suite of rights under the GDPR, including the rights of access, rectification, erasure and objection, and Article 22 restricts solely automated decision-making producing legal or similarly significant effects – Malta not having legislated under Article 22(2)(b) to permit such decisions. A data protection impact assessment under Article 35 is mandatory in respect of high-risk processing, and most high-risk AI systems under the AI Act will trigger this requirement.

The IDPC has, to date, generally aligned itself with positions adopted at European level rather than issuing its own AI-specific guidance.

Data scraping for the purpose of AI training raises distinct considerations across three regimes. From an intellectual property perspective, Malta has transposed the text and data mining (“TDM”) exceptions contained in the Digital Single Market Directive (Directive (EU) 2019/790) through the Copyright and Related Rights in the Digital Single Market Regulations (Subsidiary Legislation 415.08 of the Laws of Malta). These comprise a TDM exception for the purposes of scientific research and a general TDM exception, the latter of which may be overridden by a rightsholder through an appropriate, machine-readable reservation of rights in respect of content made publicly available online. The exception applies only where it does not conflict with the normal exploitation of the work and does not unreasonably prejudice the legitimate interests of the rightsholder. The AI Act reinforces this framework by requiring providers of general-purpose AI models to put in place copyright-compliance policies and to respect such opt-out mechanisms.

From a privacy perspective, the scraping of personal data engages the full range of controller obligations under the GDPR, including the need for a valid lawful basis (typically legitimate interests), transparency, data minimisation, accuracy, storage limitation and respect for data-subject rights. From a competition perspective, scraping raises particular concerns where it is used to obtain economically sensitive information from a competitor’s platforms. It may distort competition and, in some cases, facilitate collusion – including unintentionally, where AI systems set prices on the basis of scraped market data, since pricing driven by a common algorithmic input can converge on similar levels and dampen competition. Such conduct would fall to be assessed by the Office for Competition within the Malta Competition and Consumer Affairs Authority (“MCCAA”) under EU and national competition law.

There is, as yet, no Maltese precedent addressing the legality of scraping for AI training, and the courts would be expected to look to EU and other foreign jurisprudence for guidance.

There is currently no guidance from the Maltese courts on this question. It is expected that a clear, machine-readable reservation of rights would satisfy the opt-out mechanism contemplated under the Digital Single Market Regulations (Subsidiary Legislation 415.08 of the Laws of Malta), and that a website which requires users to accept its terms and conditions before being granted access, would be more likely to support an enforceable prohibition. In the absence of such an evident limitation, it would be considerably more difficult to argue that terms of use which are merely posted on a website bind those who visit it.

Malta’s lead authority for AI is the MDIA, which under S.L. 591.05 , acts as the principal MSA for AI systems, the national single point of contact, the notifying authority responsible for the bodies that will certify high-risk AI systems, and the operator of Malta’s AI regulatory sandbox. Its enforcement toolkit includes the power to conduct inspections, to require the provision of information, to impose corrective measures and to levy administrative fines.

Under S.L. 586.14, the IDPC is designated as the MSA for certain fundamental-rights-sensitive high-risk AI systems – including those concerning biometric identification, law enforcement, migration and the administration of justice under Annex III – and as Malta’s Fundamental Rights Authority for the purposes of the AI Act.

The sectoral regulators retain their respective remits: the Malta Financial Services Authority (“MFSA”) in respect of licensed financial entities, the MGA in respect of gaming, Transport Malta in respect of autonomous vehicles and drones, and the MCCAA in respect of competition and consumer matters.

The adoption of AI in Malta is increasing across both the public and private sectors, and while quantitative data on adoption levels remains limited, Malta has nonetheless been ranked as the EU’s leading user of generative artificial intelligence. According to the European Commission’s Digital Decade Eurobarometer Report for February to March 2026, 38% of Maltese respondents use generative AI daily in their personal lives – almost double the EU average of 20%.

In the private sector, financial services and iGaming are among the most active adopters, deploying AI for credit scoring, fraud detection, anti-money-laundering monitoring and compliance.

In the public sector, the Central Procurement and Supplies Unit (“CPSU”) has piloted an AI-based forecasting tool to support pharmaceutical inventory management and procurement planning, and Malta participates in the EU4Health-funded BreastScan project, a four-year programme applying AI in radiology to improve the accuracy and speed of breast-cancer diagnosis.

Transport Malta is also piloting an AI-driven traffic-management system which combines machine-learning models with real-time data analytics. In addition, Malta Public Transport, along with Transport Malta, has unveiled an autonomous bus which is set to be tested on public road.

The education sector remains at an earlier stage of adoption but is being advanced through the Digital Education Strategy 2024–2030, which sets a national path for integrating AI and digital tools into schools.

Tourism and utilities are likewise adopting AI: the Malta Tourism Authority is pursuing data-driven initiatives, while the Ministry for Energy, Enterprise and Sustainable Development has launched a pilot project using AI algorithms to monitor and optimise consumption patterns across the water and energy sectors.

AI is used by Maltese lawyers and in-house counsel principally for legal research, drafting support, contract analysis and administrative tasks. This being said, neither the Chamber of Advocates nor the Committee for Advocates and Legal Procurators has issued AI-specific guidance, with the result that the use of AI is governed by existing professional-ethics rules, the Code of Ethics, the Professional Secrecy Act (Chapter 377 of the Laws of Malta) and the Code of Organisation and Civil Procedure (Chapter 12 of the Laws of Malta), together with data-protection law. The Council of the Chamber of Advocates for the 2026–2029 term has, however, recognised the transformative impact of technology on the profession and the courts. It has accordingly set, as one of its main aims for the coming term, the promotion of the responsible and ethical use of digital tools, including artificial intelligence, while ensuring that appropriate professional standards and safeguards remain in place.

AI is regarded as a useful, but not risk-free, tool that in no way diminishes a lawyer’s professional responsibilities. The principal concerns are the preservation of professional secrecy and client confidentiality when using cloud-based or third-party tools; the risk of “hallucinations” and fabricated citations, of which there are well-publicised examples in foreign jurisdictions; and the lawyer’s continuing duty to exercise independent professional judgment and to verify the outputs generated. In the absence of local regulation, practitioners look to foreign guidance, such as that issued by the UK Bar Council, in order to inform the responsible use of AI.

AI presents both significant challenges and significant opportunities for the legal profession in Malta, these may be summarised as follows:

Five key challenges:

1. The use of third-party AI tools risks exposing client information, in tension with the lawyer’s duty of professional secrecy.
2. Generative tools may fabricate authorities or misstate the law, while the lawyer remains accountable for any reliance placed upon their outputs.
3. The “black box” nature of many systems makes their outputs difficult to explain or justify, complicating professional accountability.
4. Bias present in training data may be replicated in outputs, producing skewed or discriminatory results.
5. Educating young lawyers not to over-rely on AI systems and to avoid cognitive offloading.

Five key opportunities:

1. The rapid analysis of large document sets, the identification of key documents and the extraction of relevant information.
2. The acceleration of first drafts of agreements, memoranda and correspondence for subsequent refinement by the lawyer.
3. The scope to deliver legal services more efficiently.
4. The AI Act, data-protection and digital-resilience regimes generate advisory and compliance demand in and of themselves
5. AI-assisted review can strengthen due diligence, contract analysis and the early identification of legal risk.

The next 12 months are expected to be formative for the regulation of AI in Malta. The MDIA’s updated National AI Strategy (2025–2030) is expected to be implemented during 2026, reorienting national policy around enhanced data availability and infrastructure, the deployment of AI to improve business operations, and the advancement of AI technology through financial incentives and strategic support. In addition, Malta is also required to transpose the New PLD by 9 December 2026, which will reshape the rules on liability and the burden of proof in respect of AI and software. The MGA’s proposed AI Gaming Charter, currently under public consultation is also expected to take shape during this period, while, more generally, national regulators are expected to issue further guidance. At EU-level, further developments are expected to flow from the EU’s Digital Omnibus proposals in the run up to the implementation of the High Risk AI obligations.