Malta's MiCA Act: Now Enacted

Malta has published Legal Notice 238 of 2026, establishing the national regulatory framework for the EU's Cyber Resilience Act and designating the Malta Digital Innovation Authority as the central enforcement body. With vulnerability reporting obligations already in effect since September 11, 2026, manufacturers of digital products must now navigate new compliance requirements ahead of the regulation's full application in December 2027.

DAC8 is the eighth amendment to the EU Directive on Administrative Cooperation in Direct Taxation (DACs) and is set to introduce mandatory reporting of crypto-asset transactions from 1st January 2026.

The EU Commission has surprisingly withdrawn the proposed AI Liability Directive from consideration. This was announced in the Commission's 2025 work programme, adopted on the 11 February 2025.

The European Union has reached a compromise on the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR), introducing sweeping changes to harmonise payment rules across Member States. The package addresses fragmentation under PSD2 by migrating conduct-of-business rules into directly applicable regulations, while introducing new provisions on cash access, cryptocurrency payment services, fraud liability, and open banking.

As the European Union's landmark AI Act nears its enforcement date of 2 August 2025, the European Commission has released long-awaited guidelines clarifying the scope of obligations for providers of general-purpose AI (GPAI) models.

The Council of the European Union has reached a provisional agreement on the Digital Omnibus Regulation, introducing significant amendments to the EU AI Act that will reshape compliance timelines and expand prohibited practices. Key changes include postponing high-risk AI system obligations to December 2027, accelerating transparency requirements for AI-generated content, and introducing new bans on non-consensual intimate imagery generation.

The OECD Crypto Asset Reporting Framework, commonly abbreviated to CARF, introduced the concept of standardised due diligence requirements that Reporting Crypto Asset Service providers...

The Markets in Crypto-Assets Act (Fees) Regulations (the "MiCA Fees Regulations"), which are the first set of regulations to have been published under The Markets in Crypto-Assets Act.

Recent legislative changes in Malta have fundamentally transformed cybersecurity from a technical IT concern into a critical matter of corporate governance and legal liability. With the introduction of Legal Notice 89 of 2026 and the rise of AI-enabled cyber threats, organizations now face direct enforcement mechanisms and heightened expectations for cyber-risk management that can expose both companies and their directors to significant consequences.

According to a news report from CoinDesk, the EU has finalized the legal text for the Markets in Crypto Assets regulation.

The EU AI Act's Article 50 introduces age-dependent disclosure requirements for AI-powered NPCs in video games, creating a new compliance framework where the same generative character may require explicit labeling in one context but not another. This provision intersects with emerging consumer protection regulations and child safety standards, fundamentally changing how gaming studios must assess their AI implementations based on actual player demographics rather than abstract user models.

The EU AI Act's transparency obligations became enforceable on 2 August 2026, requiring providers and deployers of AI systems to clearly disclose AI-generated content, inform users of AI interactions, and label deepfakes. Organizations must now navigate new compliance requirements including disclosure obligations for emotion recognition systems and content on matters of public interest, while facing potential fines of up to €15 million or 3% of global turnover for non-compliance.

The EU Commission has surprisingly withdrawn the proposed AI Liability Directive from consideration. This was announced in the Commission's 2025 work programme, adopted on the 11 February 2025.

The Water Services Corporation has issued a major tender for the design, construction and commissioning of a new reverse osmosis desalination plant in Pembroke, Malta, with a nominal capacity of 11,200 m³ per day. The procurement follows EU Directive 2014/25/EU procedures and requires the existing plant to remain operational throughout the project's 100-week completion period. Economic operators must navigate extensive technical requirements covering reverse-osmosis systems, electrical infrastructure,

The European Union has reached a compromise on the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR), introducing sweeping changes to harmonise payment rules across Member States. The package addresses fragmentation under PSD2 by migrating conduct-of-business rules into directly applicable regulations, while introducing new provisions on cash access, cryptocurrency payment services, fraud liability, and open banking.

On 24 July 2025, the Maltese Citizenship (Amendment) Act (Act XXI of 2025) ("Citizenship Amendment Act") came into force, marking the end of the granting of Maltese citizenship by naturalisation for exceptional services by direct investment.

The Romanian regulatory framework for gaming was reformed in 2015–16. This created a gambling market that can be generally characterised...

The United Arab Emirates ("UAE") has become the leading FinTech hub in the Middle East. Through bold regulation, access to global capital, and strategic free zones...

In a landmark ruling delivered yesterday by the Court of Justice of the European Union (‘CJEU'), Decision 2016/1250 on the adequacy of the protection provided by the European Union (‘EU') ...

The European Commission is preparing its proposal for the Digital Fairness Act ("DFA"), a legislative initiative intended to strengthen consumer protection in digital environments.