The AI Act in Malta: what ministries and public entities should prepare by December 2027

01The AI Act in Malta as of November 2026

The AI Act (opens external site), Regulation (EU) 2024/1689, took effect on 1 August 2024 and comes into application in phases. In July 2026 the Union adopted the Digital Omnibus on AI, Regulation (EU) 2026/1744 (opens external site), which delayed the high-risk obligations and amended several other articles. It entered into force on 27 July 2026, days before the high-risk date it replaced.

Malta designated its authorities in 2025. Legal Notice 226 of 2025 makes the Malta Digital Innovation Authority (MDIA) the lead market surveillance authority, the single point of contact and the authority for the regulatory sandbox. Legal Notice 227 of 2025 makes the Information and Data Protection Commissioner (IDPC) (opens external site) the market surveillance authority for certain Annex III systems, in law enforcement, migration and the administration of justice, and an authority for the protection of fundamental rights. A Maltese public entity therefore already knows whom it will deal with.

So some duties bind you today, a few more start at the end of 2026, and the heaviest ones for public deployers arrive in December 2027.

The Omnibus also rewrote Article 4. Providers and deployers must now take measures that support their staff’s AI literacy, where the earlier text required them to ensure a sufficient level of it. The obligation stays, but the proof expected of you is different. Training matched to each role, with a record of who followed it, remains the sensible response.

02Provider or deployer: which one is your entity?

Most ministries, departments and public entities are deployers, meaning they use an AI system under their own authority. An entity becomes a provider when it develops an AI system, or has one developed, and puts it into service under its own name. That covers a system built by your own staff or by a contractor to your specification.

Roles can change. Article 25 turns a deployer into a provider when it makes a substantial change to a high-risk system, or alters its intended purpose so that it becomes high-risk. State the intended roles in the call for tenders and in the contract, so that they are settled before an audit, not discovered during one.

03Which of your use cases are high-risk?

Annex III names the areas where AI systems count as high-risk. For Maltese ministries, departments, public entities and local councils, these weigh most:

• Essential public services and benefits: checking who is eligible, and granting, cutting, withdrawing or recovering benefits and services.
• Law enforcement, migration, asylum and border control and the administration of justice, the areas in which the IDPC acts as market surveillance authority in Malta.
• Education and vocational training: admissions, assessing what learners achieved, supervising exams.
• Employment: recruitment, promotion, allocating work and monitoring staff. A public entity is also an employer.
• Critical infrastructure: safety components in running digital infrastructure, road traffic and utilities.

Falling in an Annex III area does not settle the question. Article 6(3) takes a system out of the high-risk category when it poses no significant risk of harm, for instance when it carries out a narrow procedural task, improves the outcome of work a person has finished, spots patterns without replacing a human assessment, or does preparatory work. Profiling of individuals always keeps a system high-risk. If you rely on the exception, write down why.

Plenty of valuable tools are not high-risk: help with drafting, search across internal circulars and procedures, translation between Maltese and English, summaries. The GDPR and the transparency rules still apply to them; the high-risk regime does not.

04Duties of a public entity that deploys a high-risk system

As of 2 December 2027, a ministry, department or public entity using an Annex III high-risk system is bound by Article 26 (opens external site). In summary:

• Operate the system according to the provider’s instructions for use, backed by suitable technical and organisational measures.
• Give human oversight to staff who have the competence, training and authority it needs, and support them in it.
• Check that the input data you control is relevant to the intended purpose and representative enough for it.
• Watch how the system performs, and tell the provider and the authorities promptly about risks and serious incidents.
• Retain the logs the system generates automatically for six months or more, unless other EU or national law sets a different period.
• Before using a high-risk system at work, inform staff representatives and the employees concerned.
• Being a public authority, record your use of the system in the EU database before it goes live (Article 26(8) and Article 49). A system that is not registered may not be used.
• Tell people when a high-risk system makes, or helps make, decisions about them (Article 26(11)). They may also ask for an explanation of an individual decision (Article 86).

The fundamental rights impact assessment

Article 27 (opens external site) requires bodies governed by public law, and private firms that deliver public services, to assess the impact on fundamental rights before first using most Annex III systems; critical infrastructure systems are the exception. The assessment sets out:

1. 01the processes in which the system will serve its intended purpose;
2. 02for how long and how often it will be used;
3. 03which categories of people and groups it is likely to affect;
4. 04the particular risks of harm to them;
5. 05how human oversight is organised;
6. 06what will happen if a risk materialises, internal governance and complaint routes included.

The outcome is notified to the market surveillance authority, in Malta the MDIA or, for the areas it covers, the IDPC. The assessment sits next to a data protection impact assessment under Article 35 of the GDPR and can reuse it, so carry out the two in one exercise. Under Article 27(5) the AI Office is to supply a template questionnaire; see whether it is available before you build your own.

05Transparency rules already in force

Article 50 has applied since 2 August 2026. Providers must build systems that talk to people in such a way that those people learn they are dealing with AI, unless that is plain, and must mark synthetic content in a machine-readable form. Deployers must disclose deepfakes, and also AI-generated or manipulated text published to inform the public on matters of public interest, unless a person has reviewed it and someone carries editorial responsibility.

For a Maltese public entity the usual case is a chat assistant on its website or in a service channel linked from servizz.gov. Say plainly that it is an AI system, explain which questions it can and cannot handle, and give an easy way to reach a member of staff.

06A plan for the rest of 2026 and for 2027

1. 01Build the inventory now. Record every AI system in use or being procured, AI features in platforms you already license included, with its owner, purpose, provider, the data it uses and the people it affects.
2. 02Classify early in 2027. Prohibited, high-risk (with the Article 6(3) reasoning on file), transparency duties only, or minimal risk, and note for each whether you are provider or deployer.
3. 03Put contracts right during 2027. Require instructions for use, conformity documentation and access to logs, and make help with your impact assessment and incident reporting a contractual duty.
4. 04Organise oversight. Name the roles, train the people, give them the power to overrule and a route to escalate, and design against automation bias; our article on where AI agents need a person’s approval shows how.
5. 05Set up logs and monitoring. Keep logs for six months or longer, and agree what a serious incident is and who reports it to the MDIA or the IDPC.
6. 06Before go-live. Complete the fundamental rights impact assessment together with the DPIA, register in the EU database, and inform staff and the people affected.
7. 07Keep AI literacy alive. Training by role for users, reviewers and decision-makers, refreshed when systems change, with a record of who attended.

07Penalties and enforcement

Each Member State sets the penalty rules. Under Article 99(8) it decides whether, and to what extent, administrative fines may be imposed on public authorities and bodies established on its territory; check the Maltese position with your legal adviser. That is no reason to hold back. The MDIA and the IDPC can still require corrective action, and a public decision is only legitimate if it can be explained and challenged.

08What to follow next

• The Commission’s guidelines on classifying high-risk systems (Article 6(5)), alongside its published guidelines on prohibited practices (opens external site).
• Harmonised standards for the high-risk requirements, which providers will rely on to demonstrate conformity.
• Guidance from the MDIA and the IDPC for public deployers, and the MDIA’s plans for the regulatory sandbox.
• The AI Office template for the fundamental rights impact assessment.

The European Commission’s AI Act Service Desk (opens external site) maintains the official timeline and explains the Act article by article. Keep it at hand, and put a date on every internal note you write about the Act, because the text is still changing.