Skip to main content
FromNine
Menu

Government & Public Entities

Services the public can hold to account.

For Government ministries, departments and public entities we design, build and operate digital services that meet accessibility law, are secure from the first release, connect cleanly to shared Government systems and come with documentation the next team can rely on. 600+ public-sector projects across the EU, including in Malta, have formed our way of working.

For Government ministries, departments, public entities, regional authorities and local councils in Malta and Gozo that serve every resident in both official languages, under Maltese and EU law together.

Start a conversationSee the matching solutions
Modern public building with a façade of stone panels and glass in a geometric pattern

  1. 28 June 2025

    EAA requirements in application

    In Malta through S.L. 627.03: key private services now carry accessibility duties too, next to the rules the public sector already applies.

    SourceDirective (EU) 2019/882 (opens external site)

  2. 24 December 2026

    Digital identity wallets due

    Malta, like every Member State, must provide at least one wallet, and Government services that ask for login must accept it.

    SourceRegulation (EU) 2024/1183 (opens external site)

  3. 2 December 2027

    High-risk AI duties begin

    This includes the fundamental rights impact assessment for public deployers, on the timetable amended in 2026.

    SourceRegulation (EU) 2024/1689 (opens external site)

600+public-sector projects across the EU

  • Government ministries and public entities in EU Member States

Credentials

  • ISO/IEC 27001 certifiedA certified information security management system
  • Summit Partner · SalesforceOn platforms that many administrations already use
  • Gold Partner · SAP and OdooOn platforms that many administrations already use

Public bodies we work with

  • Infrabel BE
  • Skeyes BE
  • Bundesimmobiliengesellschaft (BIG) AT
  • Austro Control AT
  • Bulgarian Ports Infrastructure Company BG
  • HŽ Infrastruktura HR
  • Cyprus Ports Authority CY
  • Správa železnic CZ
  • DPP Prague CZ
  • Naviair DK
  • Energinet DK
  • Elering EE
  • Fintraffic FI
  • Fingrid FI
  • RATP Group FR
  • EYDAP GR
  • HungaroControl HU
  • EirGrid IE
  • ANAS IT
  • Augstsprieguma tīkls (AST) LV
  • Lithuanian Airports LT
  • Litgrid LT
  • LuxAirport LU
  • Indis Malta MT
  • TenneT NL
  • PANSA PL
  • Infraestruturas de Portugal PT
  • Transelectrica RO
  • NDS SK
  • Enaire ES

What is shifting for Maltese public entities

  1. EU digital law arrives in one wave

    Malta has already transposed much of it: the NIS2 Order has been in force since 23 January 2026, and Legal Notices 226 and 227 of 2025 designate the MDIA and the IDPC under the AI Act. eIDAS 2, the Interoperable Europe Act and the Data Act fall on the same Government estates, each with its own records and reporting, and calls for tenders on ePPS now ask suppliers to explain how they support those duties.

    SourceEU digital rulebook overview

  2. Residents want a single entry point

    People expect to submit an application on servizz.gov or a service site, check its progress and receive the outcome online, without handing in the same document twice. Under Article 5 of the Constitution anyone may address the administration in Maltese or English and receive a reply in that language, and for key cross-border procedures the once-only principle is already binding.

    SourceRegulation (EU) 2018/1724

  3. Experience is walking out of the door

    Senior public officers and the developers who understand older systems retire sooner than successors can be trained. Their know-how has to be written into documented services and tools that a new generation of staff can pick up.

  4. AI that must survive public questions

    AI can cut waiting lists and backlogs, yet a ministry or entity has to explain each outcome, name the officer responsible and be open about the systems it runs. Those demands shape the design of an AI service, not just the way it is procured.

Where public entities get stuck, and what we do

  1. The challenge

    Case systems date back decades, so each change in the law turns into a risky release.

    Our response

    We replace them gradually behind stable interfaces: services are lifted out one by one, data is migrated and reconciled, and old modules are switched off individually. Residents never face a single overnight cut-over.

  2. The challenge

    Residents and businesses keep handing in documents the administration already holds.

    Our response

    We link services to the registers that own the data, so information is retrieved once, on a stated legal basis, and every retrieval leaves a log entry.

  3. The challenge

    Phone lines and service hubs field questions a good website would settle.

    Our response

    Service assistants that answer only from the entity’s published rules and procedures, pass the conversation to staff when needed and never reply from unapproved material.

  4. The challenge

    Officers spend hours opening, sorting and retyping incoming files.

    Our response

    Document intelligence sorts the files and pulls out key fields, an officer confirms anything uncertain, and the case system receives structured data with a complete audit trail.

  5. The challenge

    AI pilots get stuck at the legal and ethics review.

    Our response

    Review is planned for from the first workshop: risk classification under the AI Act, material for the data protection and fundamental rights impact assessments, logging, oversight by named officers and documentation that a transparency register can draw on.

  6. The challenge

    Circulars, procedures and policy notes sit on intranets, in PDFs and in people’s heads.

    Our response

    A knowledge search that respects permissions and quotes the circular, Legal Notice or procedure behind each answer, so officers can verify it first.

Dates Maltese public services are designed around

The dates behind today’s architecture and procurement choices. Maltese Legal Notices and EU implementing acts can set further dates.

  1. In application

    Interoperable Europe Act: Regulation in application

    Governance for interoperability across borders and for reuse of solutions built by the public sector.

  2. In application

    NIS2: Transposition deadline

    The EU date for national rules. Malta’s NIS2 Order came into force on 23 January 2026 and brings public administration entities in scope, with risk management and incident reporting.

  3. In application

    Interoperable Europe Act: Interoperability assessment mandatory

    Needed before a decision on a new or substantially changed trans-European digital public service.

  4. In application

    AI Act: Prohibitions take effect

    Social scoring by public authorities is among the banned practices. The AI literacy duty starts the same day.

  5. In application

    European Accessibility Act: Accessibility rules in application

    For key products and services; in Malta through S.L. 627.03.

  6. In application

    Data Act: Data Act in application

    Covers data requests by public bodies in exceptional need and the rules on switching cloud provider.

  7. In application

    AI Act: Transparency duties start

    Users must be informed when they deal with an AI system, and generated content must carry a marking.

  8. Status on 2 October 2026

  9. Upcoming

    eIDAS 2: Wallets must be offered

    Malta offers at least one wallet, and public services that ask for online identification must take it.

  10. Upcoming

    AI Act: High-risk duties start

    For stand-alone high-risk uses such as deciding on access to public services and benefits, on the timetable amended in 2026.

Laws and standards at a glance

The EU instruments and Maltese measures that most often define a public-sector specification, explained briefly, with the consequence for your programme.

This summary helps you plan; it is not legal advice. EU dates were reviewed on 2 October 2026 and the Maltese references on 4 November 2026.

EU AI ActScopeEU-wide

A risk-based regime for AI. Systems used to decide on access to essential public services and benefits, on migration, asylum and borders, or in justice and policing count as high-risk. In Malta, Legal Notice 226 of 2025 makes the MDIA the lead market surveillance authority, and Legal Notice 227 of 2025 gives the IDPC that role for certain high-risk uses in law enforcement, migration and justice.

A public deployer of a high-risk system must complete a fundamental rights impact assessment (Article 27), appoint people to oversee it and retain logs. With the 2026 amendment, these obligations start on 2 December 2027.

What it means for your entity

Each use case is classified in discovery, oversight and logging are part of the build, and your lawyers receive the technical documentation they ask for. Your own counsel makes the legal assessment.

SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)

NIS2ScopeEU-wide

The directive covers central government administrations and lets Member States extend it to regional and local ones. In Malta it is transposed by the NIS2 Order (L.N. 71 of 2025, S.L. 460.41), in force since 23 January 2026, with the CIP Department as competent authority and a national self-registration mechanism. The directive requires risk management, supply-chain security and incident reporting in stages, the first being an early warning within 24 hours.

What it means for your entity

Every contract will carry security clauses. We keep our controls documented, report incidents through the channel agreed with you and hand over the evidence you need for your own obligations towards the CIP Department.

SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)

eIDAS 2 and the EU Digital Identity WalletScopeEU-wide

By 24 December 2026 each Member State has to provide at least one EU Digital Identity Wallet, and online public services that require identification must accept it next to the national scheme. In Malta that scheme is Malta e-ID, operated by MITA, with the identity card notified at eIDAS assurance level High.

What it means for your entity

Login, sharing of attributes and e-signatures must work with the wallet as well as Malta e-ID. We build identity integration so that adding a credential type is a configuration change rather than a rebuild.

SourceRegulation (EU) 2024/1183, EUR-Lex (opens external site)

Interoperable Europe ActScopeEU-wide

In application since 12 July 2024. From 12 January 2025, a public body must run an interoperability assessment before it decides on a new or substantially changed trans-European digital public service, and it is encouraged to share and reuse solutions, open source among them.

What it means for your entity

We draft the assessment material together with you, build on components that already exist and document interfaces so that other entities can take over what you commission.

SourceRegulation (EU) 2024/903, EUR-Lex (opens external site)

Single Digital Gateway and once-onlyScopeEU-wide

From 12 December 2023, a user of a key cross-border procedure may ask authorities to exchange evidence directly through the Once-Only Technical System rather than uploading it personally.

What it means for your entity

The exchange must rest on consent, let the user preview the evidence and be logged. We build the once-only connectors and the national exchange into the flow of the service.

SourceRegulation (EU) 2018/1724, EUR-Lex (opens external site)

Web Accessibility Directive and EN 301 549ScopeEU-wide

Websites and mobile apps of the public sector have to meet EN 301 549, the harmonised standard based on WCAG, and carry an accessibility statement with a way to give feedback. Malta transposes the directive through S.L. 418.03.

What it means for your entity

We build to WCAG 2.2 level AA, test with screen readers and other assistive technology and help keep your accessibility statement correct.

SourceDirective (EU) 2016/2102, EUR-Lex (opens external site)

European Accessibility ActScopeEU-wide

In application since 28 June 2025 for key products and services such as banking, online shops, e-books and transport, and in Malta through S.L. 627.03, with the CRPD as market surveillance authority. It binds economic operators rather than public entities, yet calls for tenders borrow its requirements and services operated with private partners can fall within it.

What it means for your entity

Accessibility now covers every link in the delivery chain, so we write it into the acceptance criteria from the start instead of auditing at the end.

SourceDirective (EU) 2019/882, EUR-Lex (opens external site)

Data ActScopeEU-wide

In application since 12 September 2025. Public bodies may ask companies for data they hold when there is an exceptional need, and providers of data processing services must allow customers to switch, with switching charges removed by January 2027.

What it means for your entity

Cloud architectures get an exit plan and portable data from day one, so moving to another provider is a project you schedule, not an emergency.

SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)

Public procurement, call by call, lot by lot.

Government ministries and entities buy through open, restricted and negotiated procedures, competitive dialogue and framework agreements with mini-competitions. In Malta these follow the Public Procurement Regulations (S.L. 601.03), which transpose Directive 2014/24/EU, and calls for tenders are published on ePPS under the oversight of the Department of Contracts.

We work inside that procedure: we answer each criterion of the call for tenders, name the people on the team, set out prices transparently and submit a delivery plan an evaluation committee can score. Depending on the lot, we bid on our own or as part of a consortium.

  1. Market consultation

    We explain what can realistically be built without steering the specification, which lowers the risk of a call for tenders no one can deliver.

  2. Call for tenders and clarifications

    We test the specification against Maltese and EU law, the relevant standards and your current systems, and we raise questions only through the clarification route on ePPS.

  3. Tender submission

    A structured submission covering architecture, planning, team, security, accessibility and, from the outset, an exit plan.

  4. Award and start-up

    Once the standstill period ends: a named team, induction into your security rules and a first release agreed with you.

  5. Delivery and exit

    Reports against the contract indicators, a documented handover and return of your data, so the next procurement begins on a clean footing.

Control over data and security

Data location decided up front

Before any build, we agree with you on hosting regions, who controls the encryption keys and where support staff may work, and record it in the architecture.

An exit route from the start

Open standards, documented data models and infrastructure as code keep the cost of switching visible, which is what the Data Act aims for.

Open source where it makes sense

Reusable public components and open-source options are assessed first, consistent with the Interoperable Europe Act.

Certified information security

FromNine holds ISO/IEC 27001 certification. Our controls, supplier oversight and incident handling run within that certified management system.

Delivery aligned with the NIS2 Order

Each contract fixes incident channels, vulnerability handling and supply-chain transparency, so you can meet your duties under the NIS2 Order.

Connected services and once-only

Illustrative example
Resident or businessMalta e-ID or EUwalletOnline service portalAssistantCase management systemOfficer reviewAccess recordOnce-Only TechnicalSystemGovernment exchange layerAnother Member StateCivil and residencerecordsCompany recordsTax and socialsecurity data
The parts of a once-only service

Login, the service front end and the case system rest on an exchange layer that reads data from the registers that own it.

Read the diagram as text

A resident or business logs in to a service portal with Malta e-ID or an EU Digital Identity Wallet. An assistant answers questions and opens the correct form.

The portal hands the request to the case system, where an officer reviews exceptions and decides.

Both the portal and the case system obtain the data they need through a Government exchange layer. That layer reads from the registers that own the data, such as civil and residence records, company records and tax and social security data, and logs every access.

For procedures that cross borders, the exchange layer links to the Once-Only Technical System, which exchanges evidence with authorities of other Member States.

  • Data from the owning register

    A service reads information from the register responsible for it, through a Government exchange layer, rather than storing a copy of its own.

  • Standards before custom work

    Our interfaces follow the European Interoperability Framework, Government reference architectures and shared semantic standards.

  • A legal basis and a log for each exchange

    Each exchange has a stated legal basis and purpose, and leaves a record that residents and auditors can follow.

  • Prepared for other Member States

    Procedures within the Single Digital Gateway reach the Once-Only Technical System through the national access point.

Accessibility is a legal duty

  • WCAG 2.2 AA as the minimum

    EN 301 549 rests on WCAG. Designing and testing to WCAG 2.2 AA keeps services compliant with S.L. 418.03 today and ready for the next revision.

  • Checked by tools and by people

    Automated tests run in the pipeline, manual audits use screen readers and the keyboard, and usability sessions with disabled users take place whenever you can organise them.

  • Clear wording in both official languages

    Text is written around what the reader needs to do, and the English and Maltese versions are held to the same standard, with the Maltese text written or approved by your own officers.

  • An accessibility statement that stays correct

    As the service evolves, we help you keep its accessibility statement and feedback channel up to date.

View our accessibility statement

Login and digital identity

  • Malta e-ID now

    Integration with Malta e-ID, the national digital identity scheme operated by MITA, and with the schemes of other Member States such as the Belgian eID and itsme, DigiD, SPID and FranceConnect, through their official brokers.

  • The EU wallet alongside

    Wallet login and verifiable attestations are added next to the existing scheme, so residents can choose and the service does not split in two.

  • Minimum data, visible consent

    Only the attributes the service requires are requested, the resident sees what is shared and a record is kept.

  • Acting for someone else

    Representation of a company or another person, which most benefit, licence and permit procedures depend on.

Parts of Government we build for

  • Social security and employment

    Benefits, contributions and employment services, where decisions affect household income and each step has to be explained.

  • Local councils and regional authorities

    Permits, local services, resident contact and services shared between councils.

  • Justice and home affairs

    Case and document flows with tight access control, retention rules and logging of the chain of custody.

  • Education and research

    Student records, management of grants and services for research data.

  • Ministries and Government-wide services

    Shared platforms, registers and back-office systems used by several ministries and entities.

Illustrative use cases for Maltese public entities

Illustrative example

  1. Applications with supporting documents

    A public entity receives applications with attachments that are sorted and checked for missing items. Officers look at every flagged case before anything is decided.

    Document intelligence

  2. Resident assistant for a local council

    Residents ask how a council procedure works and get an answer drawn from approved council pages, with the page quoted, and a member of staff takes over whenever judgement is needed.

    Service assistance

  3. Search across circulars for public officers

    Officers look up circulars, procedures and Legal Notices from one search box. Access rights are respected and each answer points to the document it came from.

    Enterprise knowledge

  4. Licensing system replaced section by section

    A department’s ageing licensing application is rebuilt piece by piece behind a stable API, data is reconciled after each step and the old system is retired at the very end.

    Legacy modernisation

  5. Handling freedom-of-information requests

    Each request is registered, the documents concerned are found and redactions are proposed. Nothing is released until an officer approves it.

    Document intelligence

Two flows from start to finish

How the components cooperate day to day. Both flows are illustrative and do not describe a client.

Resident service, from first question to closed request

Illustrative workflow
  1. Step 01Log in

    The resident logs in with Malta e-ID or an EU Digital Identity Wallet, and the service asks only for the attributes it needs.

  2. Step 02Ask or submit

    An assistant replies from approved sources in the resident’s chosen official language, or opens the correct online application.

  3. Step 03Prefill

    Data the administration already holds is retrieved once from the owning register and shown to the resident for confirmation.

  4. Step 04Pass on with history

    The request lands with the responsible section together with what happened so far, so no one has to ask again.

  5. Step 05Officers decide

    Human checkpoint. Officers deal with exceptions and every matter that calls for judgement. The assistant has no say over rights or benefits.

  6. Step 06Notify

    The resident sees the status and the decision online, together with the way to object or appeal.

Case handling, from incoming file to a decision someone owns

Illustrative workflow
  1. Step 01Intake

    Files come in through the portal, by email or by post, and scanned post enters the same queue.

  2. Step 02Sort and extract

    Each document is classified and its key fields are read out with a confidence score.

  3. Step 03Completeness check

    Rules spot what is missing and prepare a draft request for the remaining information.

  4. Step 04Officer review

    Human checkpoint. An officer confirms uncertain fields and decides the case. Anything the system proposes is marked as a proposal.

  5. Step 05Register

    The case system and the audit log store the decision, the reasons for it and the data it relied on.

  6. Step 06Evaluate

    Each correction is added to the evaluation set, so accuracy is tracked from one release to the next.

Platforms used across the public administration

  • Salesforce

    Summit Partner

    Case handling, contact centres for residents and businesses and grant schemes, linked to back-office registers and to Malta e-ID.

  • SAP

    Gold Partner

    Finance, HR and procurement for ministries and departments, with SAP connected to case systems and data platforms while the core stays stable.

  • Odoo

    Gold Partner

    A practical back office for smaller public entities and local councils, where the open-source licensing options deserve a proper assessment.

The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.

Malta

Malta has put the EU digital rules in place

Malta’s public administration works on shared Government ICT: MITA is the Government’s ICT agency and operates Malta e-ID, servizz.gov is the single portal for online services, and Malta Diġitali sets the national digital strategy for 2022 to 2027. Calls for tenders appear on ePPS under the Public Procurement Regulations (S.L. 601.03).

The EU rules have already been given Maltese form. The NIS2 Order (S.L. 460.41) has applied since 23 January 2026 with the CIP Department as competent authority, Legal Notices 226 and 227 of 2025 designate the MDIA and the IDPC under the AI Act, and S.L. 418.03 and S.L. 627.03 carry the accessibility directives.

We design one architecture with the EU layer built in and the Maltese specifics, from Malta e-ID login to links with servizz.gov, held in configuration and documentation, and we reuse what Interoperable Europe already offers before building anything new.

Questions from public entities

What have you done for the public sector?

We have worked on 600+ public-sector projects across the EU, some completed and some still running. Public bodies are never named without their consent, and references are shared inside a procurement procedure on the terms the contracting authority lays down.

Can we contract you under a framework agreement we already use?

Let us know the framework agreement, lot or purchasing system concerned. We will tell you whether we can take part and on what basis, alone or with consortium partners.

How do you deal with the AI Act in Government services?

Classification happens in discovery. If a use case is high-risk, for instance a decision on access to benefits, oversight by officers, logging and documentation are designed in, and we supply material for your fundamental rights impact assessment. In Malta the MDIA leads market surveillance, and the IDPC covers certain high-risk uses in law enforcement, migration and justice.

Where will our data be kept?

Where you choose. Our designs keep data within the EU, and hosting locations, control of encryption keys and support locations are agreed with you before the build, with sovereign options where the case requires them, and recorded in the architecture.

Do your services meet Maltese accessibility law?

Yes. We design and test to WCAG 2.2 AA, the level EN 301 549 and S.L. 418.03 rely on, mix automated and manual tests and help you keep the accessibility statement current.

Can a service run in both Maltese and English?

Yes. Maltese and English are both official languages, and our interfaces, content structure, assistants and documentation carry both versions to the same standard. Our teams work in English, as well as Dutch, French, German, Spanish and Italian, so the Maltese text itself is written or approved by your officers.

Talk to us about your public-sector programme

Getting ready for a call for tenders on ePPS, a modernisation or an AI service under the AI Act? Speak to a team that knows public procurement, accessibility law and services in more than one official language.

Start a conversationRead the AI Act guide