Intelligence

EU's AI Regulation entered into force in August 2024 and has been applied gradually, with significant transparency requirements taking effect on August 2, 2026. The Digital Omnibus amendments, finalized in summer 2026, introduce important changes including delayed implementation timelines for high-risk AI systems and new prohibitions on non-consensual intimate content generation.

The Cyber Resilience Act (Regulation (EU) 2024/2847)1 (“CRA”) establishes horizontal cybersecurity requirements for products with digital elements (“PDEs”) placed on the European Union (“EU”) market. Reporting obligations took effect on 11 September 2026, with full application of the CRA from 11 December 2027.

In January 2026, the European Commission unveiled its plan to overhaul the EU's Cybersecurity Act, a proposal now known as CSA2. It's the natural next step in a story that began years earlier with the EU's 2020 "5G Security Toolbox" - a set of voluntary recommendations encouraging Member States to be cautious about certain telecom suppliers. That voluntary approach produced patchy results: by most accounts, fewer than half of EU countries had actually acted on those recommendations. It is worth asking whether the adoption levels were however a failure of design, or a reflection of Member States reaching different conclusions about their risk exposures.

The Malta Financial Services Authority has issued three significant regulatory updates addressing the intersection of artificial intelligence and cybersecurity threats, streamlined investment services requirements, and the modernisation of supervisory reporting through digital frameworks. These developments reflect a strategic shift toward enhanced operational resilience, proportionate regulation, and technology-driven compliance processes.

The EU Cyber Resilience Act introduces a comprehensive three-tier classification system for connected products sold in the European market, with compliance obligations scaling from self-certification for everyday devices to mandatory third-party assessment for critical infrastructure components.

Malta has published Legal Notice 238 of 2026, establishing the national regulatory framework for the EU's Cyber Resilience Act and designating the Malta Digital Innovation Authority as the central enforcement body. With vulnerability reporting obligations already in effect since September 11, 2026, manufacturers of digital products must now navigate new compliance requirements ahead of the regulation's full application in December 2027.