Malta: Cybersecurity

Malta has published Legal Notice 238 of 2026, establishing the national regulatory framework for the EU's Cyber Resilience Act and designating the Malta Digital Innovation Authority as the central enforcement body. With vulnerability reporting obligations already in effect since September 11, 2026, manufacturers of digital products must now navigate new compliance requirements ahead of the regulation's full application in December 2027.

For founders and international businesses, losing access to Meta platforms has evolved from a technical inconvenience into a critical business continuity and reputational risk. This publication examines the legal and strategic considerations surrounding Meta account disputes, including platform governance, executive impersonation, GDPR implications, and the importance of coordinated escalation strategies in an increasingly platform-dependent digital economy.

The Malta Financial Services Authority has issued new ICT circulars highlighting critical deficiencies in digital operational resilience among financial firms, particularly in authorisation applications and DORA compliance.

On 20 January 2026, the European Commission proposed a new EU Cybersecurity Package, a legislative designed to strengthen the European Union's long-term resilience against increasingly frequent...

On 28 January 2026, ESMA issued its Guidelines on the assessment of knowledge and competence under MiCA. For crypto-asset service providers ("CASPs") and applicants currently preparing their authorisation files...

On 20 January 2026, the Proposal for a Regulation for the EU Cybersecurity Act (‘The Cybersecurity Act 2') was published by the European Commission to update and replace Regulation...

The European Securities and Markets Authority (ESMA) has issued two decisive reports in July 2025, to reinforce the implementation of the Markets in Crypto-Assets Regulation (MiCA).

The EU Cyber Resilience Act (CRA) is one of the most significant upcoming regulations for manufacturers, software vendors, and businesses placing connected products on the EU market.

Deadline: Submit within 1 month from the accounting reference date. Contents: Includes audited financial statements, signed representation sheet, and auditor's management letter.