Terms used in AI, software and EU and Maltese digital law.

Software in which a language model decides on and carries out a series of steps to reach a goal: looking up a record, filling a form, calling an API. It works only with the tools and rights it has been given, and every step it takes can be logged.

Combines two ideas. Like a data lake, it stores everything cheaply in object storage using open file and table formats; like a warehouse, it offers transactions, schemas, access control and SQL on top. Formats such as Apache Iceberg or Delta Lake make the combination possible.

A dataset run the way a product is run: someone is named as its owner, its schema is documented, its quality figures are published, its access rules are clear and its refresh times are agreed, so that other teams can use it without having to ask how it was put together.

A disciplined way of checking an AI system: a reference collection of questions or documents is run through it and scored on criteria agreed beforehand, for instance whether answers are right, backed by sources, complete, and withheld when the system does not know. It happens before launch and is repeated after every change of model, prompt or data.

The safety rails around a language model: input and output checks, restricted topics, masking of personal data, a check of rights before any tool is called, and approval before actions with consequences.

Output from an AI that sounds certain but has no support in the sources or the facts. It can be reduced, though never removed entirely, by basing answers on retrieved sources, insisting on citations, allowing the system to admit it does not know and tracking how often it happens during evaluation.

Nothing an AI proposes takes effect until someone has reviewed, corrected or approved it: that is the whole idea. For high-risk systems the AI Act makes this a legal duty, and the people doing the oversight must be competent and empowered to intervene.

Software that reads application forms, invoices, certificates or scanned letters, decides what each one is and lifts the data out, combining text recognition, layout analysis and language models. A confidence score accompanies every value, and low-scoring values are routed to a member of staff.

Put simply, a model that has read enormous quantities of text and learnt to guess the following word. That lets it draft, summarise, sort and pull information out of text in many languages, English included. What it lacks is a reliable memory of facts, so without your own sources behind it, a polished answer may still be wrong.

The working methods that keep machine learning and language model systems dependable once live: version control of models, prompts and data, automatic evaluation, deployment pipelines, and tracking of quality, running cost and response time.

Two steps: first the system fetches the relevant passages from sources you have approved (circulars, procedures, case files), then the language model writes its answer from those passages alone. Answers can name the document and section they rely on, and whoever is asking only ever sees passages their access rights allow.

Finding text by what it means rather than by the words it uses. Passages and questions are converted into numeric vectors (embeddings), and passages lying near the question count as matches. Keyword search usually runs alongside, because Cap. and S.L. numbers, names and reference codes must be matched letter for letter.

A way of working where the interface of a system is designed and agreed before it is built, normally as an OpenAPI or AsyncAPI specification. Other systems, partners and user interfaces then connect through APIs that are documented and versioned, not by reaching into the database.

A cloud environment made ready in advance, with its account or subscription structure, identity, network, policies, logging and security baseline set up before any workload moves in. Later projects start faster, and controls stay the same across them.

Three IEC standard families (IEC 61970, IEC 61968 and IEC 62325) describing power networks, their assets and market messaging in one common data model, so a grid operator’s planning, operational and market systems speak the same language about the network.

Software that mirrors a real asset, process or network and stays synchronised with it through live data. Operators use it to watch condition, rehearse a change before carrying it out and schedule maintenance. Without a live data feed, a 3D model is just a model, not a twin.

An architecture where systems post events, that is facts such as “application submitted” or “payment confirmed”, to a broker, and other systems respond to them when they are ready. Systems are therefore loosely coupled: one can be changed or can fail while the rest carry on.

An open standard for exchanging BIM data, maintained by buildingSMART and published as ISO 16739-1. With version 4.3 it also covers infrastructure (railways, roads, ports, waterways, bridges), so asset information can travel from design through construction to operation without retyping.

A platform in the cloud for building and operating integrations, which brings ready-made connectors, data mapping, orchestration and monitoring together. SAP Integration Suite and MuleSoft are two such platforms.

The national digital identity, free for holders of a Maltese ID card, with three levels of assurance. The ID card is notified at eIDAS level High. Identità issues the cards and MITA operates the system, which online services use for secure login.

The Government’s portal for online services, backed by physical service hubs. The national Digital Decade roadmap plans a redeveloped portal. New online services for residents and businesses are usually reached through it.

An inventory, in SPDX or CycloneDX format, of every component and dependency inside a software product. When a new vulnerability is published, it shows at once whether you are affected. The Cyber Resilience Act obliges manufacturers to keep one for their products.

Cloud services for which three things stay under European or national control: where the data sits, who runs the service and which jurisdiction governs it. Definitions vary, and some national schemes in the EU go further, with explicit protection against laws from outside the Union.

Retiring a legacy application piece by piece. A facade goes in front of it; behind that facade, functions are moved across to new services one at a time; once no request is routed to the old application, it can be switched off. There is never one big, risky changeover weekend.

A manufacturing pattern built on one central event broker that always holds the plant’s current state, structured by site, area, line and machine. Systems publish and subscribe there instead of being linked to each other in pairs.

Network location earns no trust here. Users, devices and services are all checked on every request: who they are, the state of the device and the context, before access is granted, and then only to the extent the task needs.

EU law that regulates AI according to risk. Certain practices are prohibited outright; high-risk systems must satisfy requirements on data, documentation, human oversight and accuracy; some others must be transparent about being AI. Dates: prohibitions from 2 February 2025, transparency from 2 August 2026, and Annex III high-risk duties from 2 December 2027 as amended in 2026. Malta designated the MDIA as lead market surveillance authority.

This directive targets resilience beyond cyber: the physical and organisational ability of critical entities to keep going. It spans eleven sectors, energy, transport, health, drinking water and digital infrastructure among them. Member States had to identify their critical entities by 17 July 2026; those entities must then analyse risks and adopt resilience measures.

EU law on cybersecurity for products with digital elements, hardware and software alike, placed on the EU market. Manufacturers must manage vulnerabilities throughout the support period and, from 11 September 2026, report those actively exploited; most other obligations begin on 11 December 2027.

EU law, applicable since 12 September 2025, on who may access and use data. Users of connected products get the data those products generate, moving between cloud and data processing providers becomes easier, and unfair contract terms on data sharing are curbed.

The EU regulation on the digital operational resilience of financial firms, applicable since 17 January 2025. It deals with ICT risk management, reporting of incidents, resilience testing and oversight of ICT third-party providers, including contract terms and a register of information. In Malta the MFSA supervises it.

EU law requiring certain products and services to be usable by persons with disability, for example e-commerce, consumer banking, e-books and the websites, apps and e-tickets of passenger transport. National laws have applied it since 28 June 2025; Malta’s is S.L. 627.03.

Under the revised eIDAS Regulation, each Member State must offer at least one wallet app. Citizens use it to store identity data and attestations, a degree or a licence for example, to disclose no more than a service requires, and to sign. Many public and private services will be obliged to accept it.

EU law on personal data, applicable since 25 May 2018. Principles like purpose limitation and data minimisation, rights for individuals and obligations for controllers and processors, including impact assessments for risky processing, all flow from it. Malta adds the Data Protection Act (Cap. 586), and the IDPC supervises.

The platform at etenders.gov.mt where Maltese contracting authorities publish calls for tenders and receive tender submissions, under the Public Procurement Regulations (S.L. 601.03). The Department of Contracts oversees it.

A series of international standards on securing industrial automation and control systems. It splits a site into zones linked by conduits, defines security levels and shares out responsibilities between asset owners, system integrators and product suppliers.

EU law on making public-sector services work together across borders. When a trans-European digital public service is created or changed, the public body responsible has to assess the interoperability impact, and solutions can be shared and reused through a common portal.

The international standard for information security management systems. A certified organisation runs an audited system to identify security risks, select controls and keep improving them. FromNine holds ISO/IEC 27001 certification.

The instrument through which subsidiary legislation, amendments and commencement dates are published in the Government Gazette. A Legal Notice is cited by number and year, for example Legal Notice 71 of 2025, which made the NIS2 Order.

A firm licensed by the Malta Financial Services Authority (MFSA), such as a credit institution, insurer or investment services firm. Under DORA, licence holders report major ICT incidents to the MFSA through the Licence Holder Portal.

EU cybersecurity law for essential and important entities, covering sectors from energy, transport and health to digital infrastructure and public administration. Entities must manage risk, secure their supply chain and report incidents: early warning inside 24 hours, notification inside 72 hours. Being a directive, it works through national law, which for Malta means the NIS2 Order.

The Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (Legal Notice 71 of 2025, S.L. 460.41), which transposes NIS2. It has been in force since 23 January 2026 and was amended by Legal Notice 89 of 2026. The Critical Infrastructure Protection Department (CIP Department) is the competent authority and runs national self-registration.

Created under the Single Digital Gateway Regulation, this EU system lets authorities in different Member States swap official evidence when a citizen or business explicitly requests it, so people are not asked again for papers the administration already has. Obligations have applied since 12 December 2023.

A network of certified access points, with shared specifications, used worldwide to exchange structured documents like invoices and orders. Malta’s Government opted for Peppol and accepts EN 16931 e-invoices in the Peppol BIS Billing 3.0 format on contracts above EU thresholds. There is no legal duty on suppliers to send them, though some calls for tenders require it.

Rules made under a Chapter of the Laws of Malta (Cap.) and numbered after it, such as S.L. 601.03 for the Public Procurement Regulations or S.L. 460.41 for the NIS2 Order. Most EU directives reach Malta in this form.

The W3C guidelines for accessible web content, set out as success criteria at levels A, AA and AAA. Procurement and legislation normally aim at level AA. The current version is WCAG 2.2, and the European standard EN 301 549 is based on these guidelines.