Malta

(a) What is the NIS2 implementation status?

Malta has officially transposed the NIS2 Directive into national law. The transposition occurred via Legal Notice 71 of 2025, which introduced Subsidiary Legislation 460.41 - the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025.

(b) What is the envisaged NIS2 implementation timeline?

The implementing legal framework (SL 460.41) was formally adopted on 8 March 2025, entered into force on 8 April 2025, and is fully in effect as of now.

(c) What does the NIS2 mean for other national cybersecurity legislation?

There is no one specific law in Malta governing cybersecurity. Rather, there are several laws, including primary and secondary legislation, which regulate different aspects of cybersecurity on a national level.

The legislation which may potentially be impacted the most is the Criminal Code (Chapter 9 of the Laws of Malta), specifically Subtitle V of Chapter IX of Part II of the First Book of the Criminal Code, entitled “Of Computer Misuse” . This was incorporated into the Criminal Code in 2001 and was amended in 2010 and 2015.

This Subtitle V provides, inter alia, definitions for relevant terms such as “computer”, “computer data”, “computer software” and “information system” and also caters for specific offences relating to the misuse of a computer system, such as, unauthorised acts involving the use of a computer or any other device or equipment to access any data, software or supporting documentation held in that computer or on any other computer, or the unauthorised use, copying, or modification of any such data, software, or supporting documentation.

Subsection V of Chapter 9 of the Criminal Code may pose the most significant issue to the effective implementation of the NIS2 Directive in Malta in that the legislative framework currently in place is rudimentary, such that a major overhaul will be necessitated to allow for effective implementation of EU legislation in the field of cyber, most notably with regard to the NIS2 Directive.

(d) Who will be the supervisory authority and how are they preparing the market?

In Malta, the general relevant supervising authority is the ‘Critical Information Infrastructure Protection Unit’ (CIIP Unit).

It is also worth noting that there exist sector-specific authorities, notably in the gaming and financial services sectors, which possess certain powers relating to licensing and issuing fines in the cybersecurity context. For example, there is the “Maltese Gaming Authority” (MGA ) and the “Malta Financial Services Authority” (MFSA).

The CIIP Unit is currently working on a “schedule of competent authorities” to delegate certain control to authorities who may be more expertly equipped to deal with specific issues.

(e) What should you be doing/on the lookout for?

Businesses should assess whether they fall within the scope of S.L. 460.41 as an essential or important entity and, if so, ensure compliance with the applicable cybersecurity requirements. This includes:

• implementing appropriate cybersecurity risk-management measures, including incident handling, business continuity, supply-chain security, vulnerability management and access controls;
• ensuring appropriate management oversight and cybersecurity training;
• complying with incident-reporting obligations, including the 24-hour early warning and 72-hour incident notification requirements for significant incidents;
• complying with applicable registration and information requirements; and
• being prepared for regulatory supervision, audits and potential administrative penalties for non-compliance.

Businesses should also monitor guidance and requirements issued by the relevant Maltese competent authorities as the NIS2 framework is implemented and enforced.