AI Regulation ReferenceArtificial Intelligence Regulations 2025
Obligations Covered
Provisions (2)
AI System Classification and Market Surveillance #
Malta's dual-authority model (MDIA for market surveillance, IDPC for fundamental rights) creates a practical enforcement structure that other small EU member states may follow. The early classification requirement means deployers must proactively assess whether their AI systems fall under Annex III high-risk categories before placing them on the Maltese market — not wait for a regulator to classify them.
Requirements
| Requirement | Details |
|---|---|
| Early classification | Deployers must proactively classify AI systems to determine if they fall under Annex III high-risk categories |
| MDIA notification | Market surveillance notifications to MDIA for AI systems placed on the Maltese market |
| Sandbox participation | MDIA operates a national AI regulatory sandbox for testing and development |
| Notified body designation | MDIA serves as notifying authority for conformity assessment bodies |
High-Risk AI Oversight and Biometric Controls #
Requirements
| Requirement | Details |
|---|---|
| IDPC supervision | Information and Data Protection Commissioner supervises high-risk AI systems (Annex III) and prohibited practices |
| High-risk AI registry | IDPC maintains a registry of high-risk AI systems |
| Biometric authorization | Real-time remote biometric identification in public spaces for law enforcement requires prior Magistrate authorization |
| IDPC notification | Law enforcement must notify IDPC of biometric identification use (excluding sensitive data) |
| Corrective powers | IDPC can issue warnings, impose corrective measures, and order withdrawal of non-compliant AI systems |