Skip to main content
FromNine
Menu

Healthcare & Life Sciences

Lighter paperwork, and the clinician still decides.

Private clinics, care homes, health insurers and pharmaceutical manufacturers in Malta come to us for three things: data exchange on open standards, AI that handles admin and leaves clinical judgement alone, and validated systems an inspector can examine without surprises.

For private clinics, care homes, health insurers and pharmaceutical manufacturers in Malta whose data and products also have to work across EU health systems.

Start a conversationSee the matching solutions
Laboratory flasks and tubes lined up in a neat grid

  1. 25 March 2025

    EHDS Regulation in force

    Patients’ access to their data, exchange between Member States and secondary use of health data, introduced in phases.

    SourceRegulation (EU) 2025/327 (opens external site)

  2. 2 August 2028

    AI Act rules for AI in devices

    Obligations for high-risk AI built into regulated products, following the 2026 change to the timetable.

    SourceRegulation (EU) 2024/1689 (opens external site)

  3. 26 March 2029

    EHDS exchange and secondary use start

    Cross-border exchange of patient summaries and ePrescriptions begins, and access bodies take their first research requests.

    SourceRegulation (EU) 2025/327 (opens external site)

What is shifting in Maltese healthcare and pharma

  1. Health data starts to travel

    Under the European Health Data Space, patients gain electronic access to their records and exchange follows common formats. Health data access bodies will open regulated access for research and policy work, inside secure processing environments.

    SourceRegulation (EU) 2025/327

  2. Paperwork crowds out patient time

    Notes, coding, referrals and insurer pre-approvals consume hours that belong to patients and residents. Assistance with clear limits can give some of that time back, provided the clinician remains the author of the record.

  3. Where the device line falls

    Under the MDR, software that supports diagnosis or treatment may qualify as a medical device, and AI within it is high-risk under the AI Act. Deliberately keeping administrative AI outside that line is a design choice made at the start.

    SourceRegulation (EU) 2017/745

  4. Care providers count as essential

    Healthcare providers fall under NIS2, which Malta applies through the NIS2 Order with the CIP Department as competent authority. Ransomware attacks have shown the cost of untested recovery, so segmentation and resilience have to be part of the architecture.

Where care and pharma teams get stuck, and what we build

  1. The challenge

    Doctors finish their notes long after the clinic has closed.

    Our response

    A documentation aid prepares letters and summaries from structured data and notes. The clinician corrects and signs them, and nothing unsigned enters the record.

  2. The challenge

    Referrals and admission forms come in every possible format.

    Our response

    Intake that sorts referrals, picks out the clinical question and marks gaps for staff to fill, keeping a full audit trail.

  3. The challenge

    Clinical and administrative systems cannot understand each other.

    Our response

    Integration built on HL7 FHIR, IHE profiles and shared terminology such as SNOMED CT, ready to connect to national and European eHealth services rather than relying on one-off interfaces.

  4. The challenge

    Researchers wait months before they receive data they can use.

    Our response

    Pipelines with pseudonymisation, recorded lineage and access control, prepared for secure processing environments and for requests to a health data access body.

  5. The challenge

    At a pharma plant, validation slows down every change to a GxP system.

    Our response

    Risk-based computerised system validation along GAMP 5 lines: automated tests and traceable requirements, so each release produces its own validation evidence instead of waiting for it.

  6. The challenge

    Medical, quality and regulatory know-how is spread over thousands of documents.

    Our response

    Search across SOPs, labelling and correspondence with regulators that always quotes the controlled version of the source.

Three separate zones on a shared data layer

Administrative support, clinical decision support and secondary use are kept apart by design, each with its own rules, approvals and evidence, all resting on a single interoperability layer.

Illustrative example
ADMINISTRATIVE SUPPORT ZONECLINICAL DECISION SUPPORT ZONESECONDARY USE UNDER THE EHDSDraft notes and lettersCoding and intake of referralsSigned by the clinicianSeparate devicevalidation: MDR route,high-risk AIPermit from a health data accessbodySecure processing environmentResearch and registriesInteroperability layer with HL7 FHIR, IHE profiles and SNOMED CTHealth record and clinical systems
Keeping administrative AI, clinical decision support and secondary use apart

The assistance described on this page covers only the administrative zone. Clinical decision support goes through a medical-device route.

Read the diagram as text

The picture has three zones resting on a common exchange layer (HL7 FHIR, IHE profiles, SNOMED CT) that is wired to the patient record and the other clinical applications.

In the administrative support zone are documentation drafts and coding and referral intake. All of it needs a clinician’s signature before it enters the record.

Decision support for clinicians is fenced off in a zone of its own, because that kind of software needs MDR validation as a device and counts as high-risk AI.

Research use sits in its own zone under the EHDS rules: nothing happens without a permit from a health data access body, processing takes place inside a secure processing environment, and only the results go on to researchers and registries.

  • The clinician signs

    No draft or suggestion is written to the record until a named clinician has approved it.

  • A visible device line

    A feature that starts shaping diagnosis or treatment is taken onto the regulated device track, never shipped quietly in a normal release.

  • Standards rather than custom links

    FHIR resources, IHE profiles and shared terminology replace point-to-point connections built for one case.

  • Research use only with a permit

    Research data only leaves care systems pseudonymised, with a permit, and goes nowhere except a secure processing environment.

Key dates for health and pharma in Malta

The dates behind health data platforms, AI and validated systems. Several of them depend on implementing acts that are not yet final.

  1. In application

    MDR: Medical Device Regulation in application

    This includes the rules for software as a medical device.

  2. In application

    NIS2: Transposition deadline

    Healthcare providers are covered; in Malta through the NIS2 Order, in force since 23 January 2026.

  3. In application

    EHDS: EHDS Regulation in force

  4. In application

    EU GMP: Drafts of revised Annex 11 and new Annex 22 released

    The consultation has closed; the final texts had not been adopted on the status date.

  5. Status on 2 October 2026

  6. Upcoming

    EHDS: Regulation applies in general

    Implementing acts fix the detailed formats and requirements.

  7. Upcoming

    MDR: First deadline for legacy devices

    Applies to class III devices and implantable class IIb ones, while EU institutions debate a focused MDR revision.

  8. Upcoming

    AI Act: Rules for AI in regulated products start

    Applies to AI in medical devices, on the timetable amended in 2026.

  9. Upcoming

    EHDS: First priority categories exchanged, secondary use opens

    Patient summaries and ePrescriptions; health data access bodies in operation.

  10. Upcoming

    EHDS: Second set of priority categories

    Medical imaging, lab results and discharge reports.

Laws and standards at a glance

The instruments that most often sit behind a specification in Maltese healthcare or pharmaceutical manufacturing, and their effect on delivery.

This summary is meant for planning and is not legal, regulatory or clinical advice. EU dates were reviewed on 2 October 2026 and the Maltese references on 4 November 2026.

GDPR: health data as special-category dataScopeEU-wide

Health and genetic information belong to the special categories of Article 9. You need a specific legal ground to process them, and a DPIA is expected once the processing reaches scale. Supervision in Malta lies with the IDPC, and the national rules sit in the Data Protection Act (Cap. 586).

What it means for your organisation

Access limits, pseudonymisation and retention are settled before the build starts, and we provide the technical material for your DPIA.

SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)

European Health Data SpaceScopeEU-wide

Patients get electronic access to their own records, electronic health record systems get common requirements and one European exchange format, and research use is channelled through health data access bodies. The provisions phase in between 2027 and 2031.

What it means for your organisation

A system built today should publish data in standard formats and log access in a way that meets the EHDS later without being rebuilt.

SourceRegulation (EU) 2025/327, EUR-Lex (opens external site)

Medical Device Regulation (MDR)ScopeEU-wide

If the manufacturer’s stated purpose is to diagnose, prevent, monitor or treat, software can fall within the device definition, and the software classification rule then tends to place it in class IIa or higher. Legacy devices received longer transition periods through Regulation (EU) 2023/607.

What it means for your organisation

Intended purpose is written down early. Administrative tools are designed to remain outside the device definition, and device software follows a regulated lifecycle.

SourceRegulation (EU) 2017/745, EUR-Lex (opens external site)

EU AI ActScopeEU-wide

When AI is itself the device, or acts as its safety component, the Act treats it as high-risk. After the 2026 amendment those obligations bite from 2 August 2028 and run in parallel with MDR conformity assessment. Legal Notice 226 of 2025 gives the MDIA the lead surveillance role in Malta.

What it means for your organisation

Where the AI and device regimes overlap, we prepare a single body of technical documentation that answers both.

SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)

EU GMP Annex 11 and GAMP 5ScopeEU-wide

Computerised systems in a GMP setting must meet Annex 11, while GAMP 5 remains the reference guide on validating them in proportion to risk. In July 2025 the Commission published drafts of a reworked Annex 11 and of Annex 22, a new text on AI.

What it means for your organisation

Validation sits inside the delivery pipeline: requirements linked to tests, evidence produced for each release, and AI use cases checked against the draft Annex 22.

SourceEudraLex Volume 4, European Commission (opens external site)

NIS2 for healthcareScopeEU-wide

Care providers, EU reference laboratories and producers of specific medical products are all within scope, with obligations on risk, incidents and suppliers. Malta gives effect to it through the NIS2 Order (S.L. 460.41), which has applied since 23 January 2026.

What it means for your organisation

Network segmentation, backups and recovery that has been practised are part of the design, and as a supplier we support your incident reporting.

SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)

Illustrative use cases in health and pharma

Illustrative example

  1. Drafting discharge letters at a private clinic

    A draft built from structured data and notes, which the treating doctor corrects and signs.

    Document intelligence

  2. Admission requests at a care home

    Incoming requests and referrals are sorted and checked, and missing details are asked for before the care team assesses them.

    Document intelligence

  3. Adverse event intake

    Reports of side effects become structured cases; a safety specialist assesses and decides on each one.

    Document intelligence

  4. SOP search at a pharma plant

    Answers drawn from controlled SOPs and quality documents, always referring to the version currently approved.

    Enterprise knowledge

  5. Service for patients and policyholders

    An assistant for bookings, cover and practical questions that passes anything medical to a member of staff.

    Service assistance

Platforms in health and pharma

  • Salesforce

    Summit Partner

    Patient and policyholder service, sales representatives and partner schemes, without copying clinical data out of the systems that hold it.

  • SAP

    Gold Partner

    Supply chain, batch handling and finance for a pharmaceutical plant in Malta reporting to its European group, linked to quality and validation.

The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.

Malta

EU health rules, applied in Malta

The EHDS, the MDR, the AI Act and the GDPR give Maltese providers and manufacturers the same European frame as everyone else, while Maltese law fills in the national side: the IDPC supervises health data under the Data Protection Act (Cap. 586), the NIS2 Order brings healthcare providers under the CIP Department, and the MDIA leads AI Act market surveillance.

A pharmaceutical plant in Malta that exports to the rest of the EU and reports to a European group needs GxP systems that satisfy group quality standards as well as inspections. We build health data flows and validated systems on European standards first, then connect them to the national services each system needs.

Questions from care providers and manufacturers

Could an AI assistant turn our system into a regulated device?

Not by default: what counts is the purpose you declare. We keep note-taking, coding and intake tools on the administrative side, with every output approved by a clinician. If a feature drifts towards diagnosis or treatment, you hear it from us early, together with a plan for the regulated device route.

Where will patient data be processed?

Wherever your legal basis and internal policies permit, usually in your own environment or an EU cloud region with encryption keys you control, so data is kept within the EU. Data flows, retention and access are recorded before the build, ready for the IDPC if it asks.

Can you connect to national eHealth services?

Yes, because we build on HL7 FHIR and IHE profiles: the same interfaces then serve national eHealth services and the coming European exchange format, with no proprietary connectors to maintain.

How do you approach validation at a GxP site?

Proportionate to risk, in the GAMP 5 way: each requirement is traced to an automated test, every release produces its own evidence pack, and your quality unit approves changes through a process it can audit.

And when the AI makes a mistake?

It will, now and then. For that reason no draft is filed without a signature, uncertain extractions are marked for review, and quality is measured against agreed test sets before and after every release.

Talk to us about your health or pharma project

Easing the documentation load, preparing for the EHDS or renewing a validated system? We begin with the workflow and the rules that govern it.

Start a conversationExplore enterprise knowledge