Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (Legal Notice 227 of 2025 under the Data Protection Act, Cap. 586)

Record MT-02 · L.N. 227 of 2025 (Government Gazette Supplement No. 21,519, 10 October 2025)

Issued by: Minister responsible for data protection, after consultation with the Information and Data Protection Commissioner
Jurisdiction: Malta
Level · region: National · Europe
Published / adopted: 2025-10-10
In force: 2025-10-10
Language: English, Maltese
Official identifier: L.N. 227 of 2025 (Government Gazette Supplement No. 21,519, 10 October 2025)

Summary

Companion regulations designating Malta's Information and Data Protection Commissioner as market surveillance authority under the EU AI Act for high-risk AI systems used in law enforcement, border and migration management, asylum, justice and democratic processes, emergency-call triage, and biometric identification, categorisation and emotion recognition. The Commissioner also enforces the prohibitions on profiling-based crime risk assessment, facial-image scraping, sensitive biometric categorisation and real-time remote biometric identification, which for law enforcement needs a Magistrate's prior authorisation, and is the Article 77 fundamental-rights authority for data protection.

Safety topics

prohibited practiceshuman oversightrisk-based classificationaccountability & liability

Status notes

Made under article 33 of the Data Protection Act and published in Government Gazette No. 21,519 of 10 October 2025, together with Legal Notice 226 of 2025 (the Artificial Intelligence Regulations, 2025), under which the MDIA is the default market surveillance authority, single point of contact and notifying authority. Regulation 1(3) deferred regulations 5 to 7 and 9 to 12 (fundamental-rights authority, real-time and post-remote biometric identification, documentation, language requirements, registry, complaints) to 2 August 2026; the designations, the notified-body role and the penalty provisions are not deferred. The Commissioner acts as notified body for high-risk systems put into service by law-enforcement, immigration or asylum authorities and keeps a registry of the high-risk systems it supervises. Post-remote biometric identification needs a Magistrate's authorisation, requested ex ante or within 48 hours. Penalties on a public authority or body are capped at EUR 50,000 per infringement plus EUR 50 a day; appeals lie to the Information and Data Protection Appeals Tribunal, and proceedings are time-barred after two years.

Sources

Open the official source https://legislation.mt/eli/ln/2025/227/eng/pdf

Secondary source: https://legislation.mt/eli/ln/2025/227/eng

Local copy

Archived. Last attempt 2026-10-17 20:42:35 UTC

Official source (third-party copy, not published) archive/MT-02/2026-10-12/official.pdf

Retrieved 2026-10-12 04:36:42 UTC

SHA-256 98233f4153e210ce101cc5f402ad71ef9b1257a869e5fb6cf85a4862ce6952f4

Secondary source (third-party copy, not published) archive/MT-02/2026-10-17/secondary.html

Retrieved 2026-10-17 19:20:18 UTC

SHA-256 d679e2ae03c97c2953bcf107dce17ebe0072807be0629110a9dd8cb78830c127

Verification

The instrument's own official text, or an official register, was stored and confirms the title, date and status. checked 2026-10-17 · official-url-fetched

Stored and read in this run: the English text of the legal notice as published (legislation.mt PDF, 10 pages), which gives the title, the enabling power, the commencement rule in regulation 1(3) and regulations 2 to 13 but does not print the Gazette header; the Maltese text (legislation.mt PDF, 10 pages), whose first page carries the header 'Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 21,519, 10 ta’ Ottubru, 2025' and the same commencement rule; and the legislation.mt ELI page, stored again on 17 October 2026 (its legal content is unchanged; only the site's list of latest updates differs), which gives the Gazette number and date. The ELI page's metadata (in the stored HTML, not in its text) gives 10 October 2025 as first date of entry into force.

Second check: Independent check by Claude Code (claude-sonnet-5-5), 2026-10-17: 7 field(s) supported.

History

2026-10-17notes: Made under article 33 of the Data Protection Act and published on 10 October 202 → Made under article 33 of the Data Protection Act and published in Government Gaz — rewritten from the legal notice (regulations 1, 7, 8, 11 and 13 added: deferred provisions, post-remote biometric authorisation, notified body, registry, penalties, appeals and prescription)2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17date_last_updated: 2026-08-02 → – — set to null: 2 August 2026 is the commencement of regulations 5 to 7 and 9 to 12 under regulation 1(3), a partial commencement that belongs in the notes, not an amendment or new version; no amending legal notice is shown2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)

Related records

EU AI Act European Union · Partially in force

Malta AI Regulations 2025 (LN 226/2025) Malta · In force

Citation

Minister responsible for data protection, after consultation with the Information and Data Protection Commissioner. Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (Legal Notice 227 of 2025 under the Data Protection Act, Cap. 586) [L.N. 227 of 2025 (Government Gazette Supplement No. 21,519, 10 October 2025)]. 2025-10-10. https://legislation.mt/eli/ln/2025/227/eng/pdf. Status: In force; verified 2026-10-17 (level A). Local copy archive/MT-02/2026-10-12/official.pdf retrieved 2026-10-12 04:36:42 UTC, SHA-256 98233f4153e210ce101cc5f402ad71ef9b1257a869e5fb6cf85a4862ce6952f4. Every AI Policy Ever, version 1.18 (snapshot 2026-10-18), record MT-02.

Improve this record

Know of an amendment, a status change or an error? Report news or an error on GitHub; the form opens with this record filled in.