1. General Legal Framework
1.1 General Legal Background
Whilst recognising the impact that AI is having on a range of economic sectors and establishing the Malta Digital Innovation Authority (MDIA) to spearhead initiatives and drive necessary changes around AI, Malta generally continues to rely on its existing legal frameworks – including civil, commercial and criminal laws – and harmonised EU legislation to manage AI-related matters.
Malta's legal system is "mixed" one, where its civil, commercial and criminal laws are principally based on civil law, whilst the main source of its public and administrative laws is common law. These legal systems are still influential on the interpretation of Malta's laws and it is expected that any decisions of the Italian, French and English courts in relation to AI will have an influence on the interpretation of Malta's civil, commercial and public laws.
Contractual and Tortious Lability
General principles of contract and tort law would continue to apply to the use of artificial intelligence in Malta. These are covered by the Civil and Commercial Codes (Chapters 16 and 13, respectively) of the Laws of Malta.
Acting in good faith (in the manner of a bonus paterfamilias) is one of the underpinning principles of both contract law and tort law. The use of AI would be generally deemed to be a tool and the user of such "tool" remains ultimately responsible for damage caused by it or through its use. The principle of culpable negligence under Article 1033 of the Civil Code, whereby "any person who with or without intent to injure, voluntarily or through negligence, imprudence, or want of attention, is guilty of any act or omission constituting a breach of the duty imposed by law, shall be liable for any damage resulting therefrom", is particularly relevant to damages resulting from the use of AI. As with any technology, the use of AI brings with it the duty of care towards others. This applies both where the use of the technology is a private one, as well as where it is used in a professional context. The user is not able to rely on ignorance of the effects of the use of the technology or the "black box" phenomenon.
IP, Data Protection and Consumer Affairs
Apart from its domestic laws, as an EU member state, Malta's laws adopt harmonised EU legislation in most of the areas that are relevant to AI, be they copyright and IP, data protection, use of medical devices, product safety or consumer protection law. The domestic laws that have transposed the EU Directives or support EU Regulations in these fields, most notably the Copyright Act (Chapter 415 of the Laws of Malta), the Data Protection Act (Chapter 586 of the Laws of Malta), the Consumer Affairs Act (Chapter 378 of the Laws of Malta) and the Medical Devices Regulations (Subsidiary Legislation 427.44) have not been modified to cater for AI specificities. Neither has Transport Malta (the authority for transport in Malta) updated its Highway Code or introduced any specific provisions related to the use of automated vehicles in Malta. The use of personal data for AI in the health sector has been dealt with in the Processing of Personal Data (Secondary Processing) (Health Sector) Regulations (Subsidiary Legislation 528.10), which is discussed in further detail in 8.2 Data Protection and Generative AI and 14.3 Healthcare.
In summary, all relevant public authorities and bodies are keeping a watchful eye on developments in their areas of interest whilst, at the same time, waiting for more concrete signs of the need to change the status quo of the legal frameworks they are responsible for. Naturally, the discussions being held at pan-European level and at inter-supervisory authority level, will determine how the responsible authorities and the legislature will behave going forward.
Maltese Regulators
The MDIA was set up as a public authority in 2018 to lead and advise the government on developments and initiatives in the innovative technology space, including AI. It has developed and is revising a national AI strategy for Malta (the "Malta AI Strategy and Vision 2030") and is also spearheading legislative change that will allow for proper regulation, in accordance with the EU's AI Act.
In 2019 the MDIA launched what it described as "the world's first national AI certification programme aiming for AI solutions to be developed in an ethically aligned, transparent and socially responsible manner". The AI Innovative Technology Arrangement (AI ITA) scheme laid out a certification programme similar to that found in today's EU AI Act through which, according to the risks envisaged in the use of the technology, developers and deployers could attain certification through a technology systems auditor licensed by the MDIA who would certify that the technology met pre-set objectives and criteria. In 2022, the MDIA also issued programme guidelines for a Technology Assurance Sandbox.
Inevitably, Malta's regulators, in particular the Malta Financial Services Authority (MFSA) and Malta Gaming Authority (MGA), have been following and commenting on developments in the use of technology, including AI, within their sectors of focus. Other legislation that is being harmonised at EU level will have an impact on the use of AI in certain sectors. In this vein, the MFSA has issued Guidelines on DORA (the EU's Digital Operational Resilience Act), which update its Guidelines on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements, for public consultation. Similarly, the Network and Information Security 2 (NIS 2) Directive has been recently transposed into Maltese law. These are the key aspects of Maltese regulation that impact the use of AI within financial services and other sectors deemed to be essential or important.
EU Regulators
The Guidance of the European Central Bank (ECB) and the European supervisory authorities – the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) – on the use of AI, cyber-risk and digital resilience, will continue to be key to developments in Malta regulating the use of technology, including AI, in the financial sector, where, save for harmonised standards at EU level, one would expect regulation to come in the form of directives issued by sectoral regulators. This approach is likely to be followed in other sectors, including transport, health and education.
2. Commercial Use of AI
2.1 Industry Use
AI is pervasive in the industries that form the basis of Malta's economic activity. In particular, large-scale use of AI is known to take place in the financial services (banking, insurance and investments), gaming (both i-gaming and video gaming) and health sectors, amongst others. The uses range from predictive AI (for instance in risk and credit worthiness checks, as well as in medical prognosis) to generative AI (in content and software development, as well as customer support and compliance).
Transport
In the public sector, the government has expressed the need to revert to AI to solve Malta's traffic problems. From press releases that were published it seems that the government and relevant authorities are in fact investing in intelligent management systems. A pilot project was launched, under the leadership of Transport Malta, with the following goals:
- to reduce congestion and emissions;
- to identify patterns in transport behaviours;
- to deliver insights to enable intelligent journey-planning and scheduling of public transport;
- to create intelligent private journey routing (in conjunction with third-party applications); and
- to assist with monitoring, policing, and enforcement.
Health and Education
The health sector is also relying on AI to assist with the procurement and effective management of medicines. The Central Procurement and Supplies Unit (CPSU) has launched a pilot project for a forecasting application that will be a decisionmaking tool used by the CPSU to help in budgeting, planning the procurement process (tendering, quotations, etc) and planning the ordering process. This application would attempt to predict future outcomes based on past events and management insight. It is intended to provide CPSU management and procurement personnel with an insight and the baseline tools and techniques to help better manage and react to fluctuations in demand.
Additionally, in February 2025, Malta secured funding from the EU4Health programme to participate in the four-year "BreastScan" project. This initiative aims to integrate AI into radiology, enhancing the accuracy and efficiency of breast cancer screenings.
n education, in May 2024, the Ministry for Education, Sport, Youth, Research, and Innovation adopted the Digital Education Strategy 2024– 2030. This strategy emphasises the importance of digital literacy as a fundamental 21st-century skill and outlines a clear path to drive excellence in digital transformation within the education sector. The strategy is structured around four key pillars.
- Nurturing Digital Global Citizens: Introducing ICT and digital literacy in primary schools, ensuring that learners achieve digital competencies as a core entitlement through ICT in secondary schools, and promoting digital citizenship empowerment and eSafety awareness.
- Empowering Educators for the 21st Century: Fostering a digital school culture that integrates technologies and 21st-century skills, consolidating and promoting professional development opportunities for all educators in digital literacy and technology-enhanced learning, and developing digital competencies of prospective educators before entry into the profession.
- Community Engagement and Collaboration: Empowering guardians and carers to support learners' digital competencies and effective learning, and creating strong relationships and strategic alliances with experts to enrich digital education through their expertise and knowledge.
- Enriching Digital Resources: Unleashing the potential of every learner through digital integration with the provision of tablets in primary classrooms and laptops in secondary classrooms, providing resources and space for the development and strengthening of digital skills and competencies, and promoting the online corporate presence of the Ministry for Education, Youth, Research, and Innovation (MEYR) and sustainability in the procurement of digital software.
Tourism and Utilities
The Malta Tourism Authority is also reported to be launching a Digital Tourism Platform to allow for more meaningful use of tourist data.
In a pilot project owned by the Ministry for Energy, Enterprise and Sustainable Development, AI algorithms will be used to collect, organise, and analyse current data to discover patterns and other useful information relating to water and energy usage. The solution will deploy largescale analytics and machine learning on customer data to help the utility companies to maximise resources and subsequently provide responsive real-time customer service management. Concurrently, they can make real-time adjustments to attain optimised generation efficiency.
Predictive maintenance models and scenarios will also be developed.
This project is expected to drive better efficiency, resilience and stability across Malta's energy and water networks, and lay the foundation for the next evolution of its smart grid network.
2.2 Involvement of Governments in AI Innovation
The Malta AI Strategy and Vision 2030
The Malta AI Strategy and Vision 2030 contains 22 action points in its education and workforce section, six dealing with legal and ethical issues, and 11 in the part focussing on ecosystem infrastructure. These are being rolled out by the MDIA in conjunction with other public entities.
The objectives in the education and workforce space are:
- understand and plan for the impact of technology and automation on the Maltese labour market;
- equip the workforce with stronger digital competencies and new skills;
- build awareness amongst the general population of what AI is and why it is important;
- build awareness of AI amongst students and parents;
- foster and embrace the adoption of AI in education;
- develop teachers' knowledge and awareness of AI in education;
- equip all students enrolled in higher education programmes in Malta with AI skills; and
- increase the number of graduates and postgraduates with AI-related degrees.
The legal and ethical objectives are:
- establish an ethical AI framework towards trustworthy AI;
- launch the world's first national AI certification framework;
- appoint a technology regulation advisory committee to advise on legal matters; and
- set up a regulatory sandbox for AI and a data sandbox for AI.
The objectives related to ecosystem infrastructure are:
- investment in Maltese language resources;
- incentivise further investment in data centres
- establish a digital innovation hub (DIH) with a focus on AI;
- increase the extent of the open data availability to support AI use cases;
- provide cost-effective access to compute capacity;
- expand Malta's data economy through 5g and the "internet of things" (IoT); and
- identify best practices for securing national AI solutions.
The MDIA is currently leading efforts to revise Malta's national AI strategy, with a realignment process scheduled for completion in 2025. This has been prompted by various factors including:
- 80% of the objectives outlined in the 2019 Strategy having been established, and partially or fully executed;
- new areas having gained relevance, while others have become obsolete since the strategy's inception, necessitating a reassessment;
- Malta adapting its regulations to align with international frameworks in the field of AI including the EU's AI Act; and
- the emergence of new challenges and opportunities has prompted a need to adjust the strategy to address evolving societal dynamics
Other Initiatives
In addition to that mentioned above, the MDIA, together with the Ministry for the Economy and other constituted bodies, such as TechMT (an industry/public partnership), have been playing a central role in the promotion of AI initiatives. From the launch of sandboxes (such as MDIA's technology assurance sandbox), to the setting up of business incubators (such as the Digital Innovation Hub – DIH) and the making available of grants for digital innovation and grants for AI research, as well as seed funds, this network of bodies has been supporting technology development and innovation, including the development and adoption of AI.
Moreover, under a project to be funded by the EU, the MDIA, Malta Council for Economic and Social Development (MCESD) and University of Malta have created a hub (the Malta – EDIH) wherein the complete set of services of a European Digital Innovation Hub are provided on an open, transparent, and non-discriminatory basis and targeted towards SMEs, small mid-caps, and public sector organisations. Within the Hub public workshops are organised to facilitate twoway dialogue between AI experts and industry.
3. AI-Specific Legislation and Directives
3.1 General Approach to AI-Specific Legislation
The MDIA was established in 2018 through the Malta Digital Innovation Authority Act (Chapter 591 of the Laws of Malta) with the aim of regulating innovative technology through the issuing of compliance certificates (both mandatory and voluntary). Originally focused mainly on the regulation of distributed ledger technology (DLT), its remit was quickly expanded to other forms of innovative technology, including AI, through amendments that came into force in 2024. The MDIA has been designated as Malta's cybersecurity certification authority and as the competent authority for data intermediation services and for the registration of data altruism organisations under the Data Governance Act.
Initially, Malta took a proactive and innovative approach to the regulation of AI within its jurisdiction. In October 2019, Malta issued the Malta AI Strategy and Vision 2030. This strategy outlined the policy that the country set out to adopt within the following years in order to "gain a strategic competitive advantage in the global economy as a leader in the AI field". The basis of the strategy's overall vision is three-fold. Firstly, it focuses on building an infrastructure that promotes the investment in AI applications and R&D. Secondly, it explores how these AI applications can be deployed in the private sector. And, thirdly, it promotes adoption of AI in the public sector so as to maximise the overall benefit that can be derived from this innovative technology. This strategy is constantly being updated and a revision, taking into account the various recent developments, is expected to be issued soon.
From a regulatory perspective, the strategy included an ethical AI framework as well as a national AI certification programme. A Technology Regulation Advisory Committee was also founded to act as a point of reference for matters relating to the laws and regulation of AI, as well as assisting on the creation of regulatory and data sandboxes.
The AI Sandbox programme, which ensures that AI systems are developed in line with technology-driven control objectives, is one of the cornerstones of the 2030 vision.
The laws regulating the functions and scope of the MDIA are also currently being revised to better equip the Authority to meet its obligations and aims, going forward. In particular, the revisions make way for the introduction of local legislation required to complement the AI Act.
To date, the regulatory approach remains an optional one where developers are encouraged to make use of regulatory sandboxes to test whether their technology will live up to the scrutiny of mandatory regulation once this comes into force, in the shape and form of harmonised EU laws and standards.
Apart from those legislative developments mentioned elsewhere in this chapter, to date, no specific, local AI laws have been drafted, nor have laws relating to intellectual property, data protection or other areas that are central to AI been amended to cater for the challenges posed by the technology. This said, regulatory authorities are expected to spearhead developments in this space, in particular in the field of financial services and insurance.
3.2 Jurisdictional Law
No AI-specific legislation has been enacted in Malta. Preparatory legislative work is underway to allow for the introduction of the AI Act, which will have direct effect in Malta.
3.3 Jurisdictional Directives
Back in October 2019, an ethical AI framework for the development of safe and trustworthy AI was published as part of the Malta AI Strategy and Vision 2030. This non-binding AI framework was essentially a set of AI governance and control practices which were based on four guiding principles. Firstly, AI systems must allow humans to maintain full autonomy whilst using them. Secondly, AI systems must not harm humans, the natural environment, or any other living beings. Thirdly, the development, deployment and use of AI systems must always be in alignment with the principle of fairness. Finally, one must be able to understand and challenge the operations and outputs of AI systems.
This AI framework reflected the Maltese policymakers' aspirations to strike a balance between endorsing the uptake of AI technology, whilst also ensuring its safe deployment within the relevant industries.
3.4 EU Law
3.4.1 Jurisdictional Commonalities
Even though the AI Act has been directly applicable across all EU member states (including Malta) from June 2024, Malta enacted the Malta Digital Innovation Authority (Amendment) Act (Act No XIX of 2024) to cater for broader powers of the MDIA, whilst removing restrictions that previously hindered its functioning. The MDIA is leading Malta's implementation of the EU AI Act and is working with key stakeholders to ensure an effective and supportive regulatory framework.
3.4.2 Jurisdictional Conflicts
Malta is currently in the process of aligning its national framework with the requirements of the EU's AI Act, with the MDIA playing a pivotal role in this alignment. The MDIA's voluntary certification frameworks and sandboxes apply to AIbased solutions, aiming to promote ethical and transparent AI development in line with the EU AI Act. These efforts are part of Malta's broader strategy to integrate the EU AI Act's provisions into its national regulatory environment. In line with Malta's wider strategy, any process which is inconsistent with these harmonised rules will be disapplied.
3.5 US State Law
This is not applicable in Malta.
3.6 Data, Information or Content Laws
As outlined in 3.4.2 Jurisdictional Conflicts), any processes that would be inconsistent with the EU's harmonised rules will be disapplied.
3.7 Proposed AI-Specific Legislation and Regulations
Following the amendments to the Malta Digital Innovation Authority Act mentioned in 3.4.1 Jurisdictional Commonalities, subsidiary legislation is expected to be introduced to iron out any legislative inconsistencies that may hinder the proper operation of the AI Act and any other EU technology-specific legislation. As an EU member state Malta will adopt all other EU laws that may impact the take up of AI.
With the increasing relevance of generative AI, it is also possible that IP laws could be modified to allow for the creation of certain ownership rights in AI-generated works. This would be particularly relevant to the i-gaming and e-gaming development sectors that are relevant to Malta's economy. Although there have been discussions and proposals in this regard, it is too early to say what position might be adopted by the government.
To view the full article, click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
