L.S. 591.05 Regolamenti dwar Artificial Intelligence Parzjalment fis-Seħħ

(1)The title of these regulations is the Artificial Intelligence Regulations. Citation, scope and commencement.

(2)These regulations implement the requisites of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act).

(3)Regulations 4, 5, 6, 8, 9, and 10 shall come into force on the 2nd of August 2026. 2. requires:

(1)In these regulations, unless the context otherwise "Act" means the Malta Digital Innovation Authority Act; Interpretation. Cap. 591. "Malta Digital Innovation Authority" means the Malta Digital Innovation Authority established by article 5 of the Malta Digital Innovation Authority Act; "Malta Financial Services Authority" means the Malta Financial Services Authority established by article 3 of the Malta Financial Services Authority Act; "Regulation (EU) 2024/1689" means Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act); "SME" means small and medium enterprises as defined in Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises;

(2)Any terms which are not defined in these regulations *Regulations 4,5,6,8,9 & 10 are not in force.   Cap. 330. 2 [ S.L. 591.05 ARTIFICIAL INTELLIGENCE shall have the same meaning as assigned to them in Regulation (EU) 2024/1689: Provided that unless the context otherwise requires, terms used in these regulations, which are not defined in Regulation (EU) 2024/1689 and which are not defined herein, shall have the same meaning as that assigned to them in the Act. Designation of market surveillance authority and single point of contact. 3.

(1)The Malta Digital Innovation Authority shall, unless otherwise provided in these regulations or any other law, be designated as a market surveillance authority for the purpose of Regulation (EU) 2024/1689: Provided that: (

1. a)irrespective of the above, for the purposes of regulation 9, the Malta Digital Innovation Authority shall be the sole national competent Authority responsible for the establishment and functioning of a national AI regulatory sandbox; (
2. b)for high-risk AI systems placed on the market, put into service, or used by financial institutions regulated by Union financial services law, coordination shall be ensured between the Malta Digital Innovation Authority and the Malta Financial Services Authority, and the Malta Digital Innovation Authority shall seek to report any information identified in the course of the market surveillance activities that may be of potential interest for the prudential supervisory tasks of the Malta Financial Services Authority and the Malta Financial Services Authority shall provide any information requested by the Malta Digital Innovation Authority for the purposes of carrying out its responsibilities, duties, powers and functions as market surveillance authority; (
3. c)for high-risk AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I of Regulation (EU) 2024/1689, coordination shall be ensured between the Malta Digital Innovation Authority and the relevant sectoral market surveillance authorities responsible for the enforcement of the Union harmonisation legislation listed in Section A of Annex I of Regulation (EU) 2024/1689 shall provide any information requested by the Malta Digital Innovation Authority for the purposes of carrying out its responsibilities, duties, powers and functions as a market surveillance authority; (
4. d)without prejudice to any other law designating any other body or person as a market surveillance authority for the purposes of Regulation (EU) 2024/1689, the Minister may ARTIFICIAL INTELLIGENCE [ S.L. 591.05 3 by order in the Gazette designate other bodies or persons as a market surveillance authority for different provisions and for different purposes of these regulations and Regulation (EU) 2024/1689 as may be amended from time to time: Provided further, that where no market surveillance authority has been designated for the purpose of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority shall be automatically designated as the market surveillance authority.

(2)The Malta Digital Innovation Authority shall be designated as the single point of contact for the purposes of Regulation (EU) 2024/1689.

(3)Without prejudice to any other law providing for the responsibilities, duties, powers and functions of the Malta Digital Innovation Authority, the Malta Digital Innovation Authority shall have all the responsibilities, duties, powers and functions granted to the market surveillance authorities by virtue of Regulation (EU) 2024/ 1689.

(4)For the purpose of implementing the requisites of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority shall facilitate coordination between market surveillance authorities and other relevant national authorities or bodies which supervise the application of Union harmonisation legislation listed in Annex I, or in other Union law, that may be relevant for the high-risk AI systems referred to in Annex III.

(5)The Malta Digital Innovation Authority may call upon experts of the scientific panel established under Article 68 of Regulation (EU) 2024/1689 to support national enforcement activities under Regulation (EU) 2024/1689. 4.*

(1)For the purposes of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority shall publish a list of national public authorities or bodies protecting fundamental rights on its website, which list may be amended upon request or ex officio to keep the list up to date.

(2)For the supervision and enforcement of obligations under Union law protecting fundamental rights, including the right to nondiscrimination, in relation to the use of high-risk AI systems referred to in Annex III of Regulation (EU) 2024/1689, the national public authorities or bodies protecting fundamental rights, including those referred to in sub-regulation

(1)shall have all the duties and powers of an authority or body protecting fundamental rights as prescribed in *Not yet in force. Authorities protecting fundamental rights. 4 [ S.L. 591.05 ARTIFICIAL INTELLIGENCE Regulation (EU) 2024/1689 within their respective scope: Provided that the duties and powers referred to in this regulation shall be without prejudice to any other law providing for the responsibilities, duties, powers and functions of such authorities or bodies. Documentation. Language requirements. Designation of Notifying Authority. 5.* For the purposes of Article 18

(2)of Regulation (EU) 2024/1689, a provider or its authorised representative established in Malta which becomes bankrupt or ceases its operation prior to the end of the period established in Article 18

(1)of Regulation (EU) 2024/ 1689 shall nonetheless keep the documents referred to therein at the disposal of the national competent authorities until the period of ten

(10)years elapses. 6.† For the purpose of Article 23

(6)of Regulation (EU) 2024/1689, importers shall provide the national competent authorities, upon a reasoned request, with all the necessary information and documentation, including that referred to in Article 23

(5)of Regulation (EU) 2024/1689, to demonstrate the conformity of a highrisk AI system with the requirements stipulated in Section 2 of Regulation (EU) 2024/1689 in either the Maltese or English Language. 7.

(1)The Malta Digital Innovation Authority shall be designated as the Notifying Authority for the purpose of Regulation (EU) 2024/1689: Provided that the assessment and monitoring referred to in Article 28

(1)of Regulation (EU) 2024/1689 shall be carried out by the National Accreditation Board (Malta).

(2)The Malta Digital Innovation Authority may only notify conformity assessment bodies which have satisfied the requirements laid down in Article 31 of Regulation (EU) 2024/1689.

(3)The provisions of sub-article

(1)and

(2)of this regulation shall apply notwithstanding any provision of law to the contrary.

(4)An appeal shall lie to the Notifying Authority against decisions of the notified bodies, including on conformity certificates issued in accordance with Article 44 of Regulation (EU) 2024/1689 in the manner, as may be prescribed from time to time by the Malta Digital Innovation Authority, by virtue of guidelines or other binding documentation. High-risk AI systems registration. 8.‡ The provider or, where applicable, the authorised representative shall register high-risk AI systems referred to in point 2 *Not yet in force. †Not yet in force. ARTIFICIAL INTELLIGENCE [ S.L. 591.05 of Annex III of Regulation (EU) 2024/1689 with the Malta Digital Innovation Authority in the manner as may be prescribed from time to time by the Malta Digital Innovation Authority, including by virtue of guidelines or other binding documentation. 9.*

(1)The Malta Digital Innovation Authority shall be the national authority responsible for the establishment and functioning of a national AI regulatory sandbox in terms of Article 57 of Regulation (EU) 2024/1689. AI regulatory sandbox.

(2)Without prejudice to any other responsibilities, duties, powers and functions that the Malta Digital Innovation Authority may have in relation to the national AI regulatory sandbox, the Malta Digital Innovation Authority shall, subject to the conditions provided for in Article 62 and 70

(8)of Regulation (EU) 2024/1689: (

1. a)provide SMEs, including start-ups, having a registered office or a branch in the Union, with priority access to the AI regulatory sandbox; (
2. b)organise specific awareness raising and training activities on the application of Regulation (EU) 2024/1689 tailored to the needs of SMEs including start-ups, deployers and, as appropriate, local public authorities; (
3. c)utilise existing dedicated channels and where appropriate, establish new ones for communication with SMEs including start-ups, deployers, other innovators and, as appropriate, local public authorities to provide advice and respond to queries about the implementation of Regulation (EU) 2024/1689 including as regards participation in AI regulatory sandboxes; and (
4. d)facilitate the participation of SMEs and other relevant stakeholders in the standardisation development process. 10.† Without prejudice to other administrative or judicial remedies, any natural or legal person having grounds to consider that there has been an infringement of the provisions of these regulations or of Regulation (EU) 2024/1689 may submit a complaint to the Malta Digital Innovation Authority. In accordance with Regulation (EU) 2019/1020, such complaints shall be taken into account for the purpose of conducting market surveillance activities, and shall be handled in line with the procedures established therefor by the market surveillance authorities. ‡Not yet in force. *Not yet in force. †Not yet in force. Right to submit a complaint. 5 6 [ S.L. 591.05 Administrative penalties. ARTIFICIAL INTELLIGENCE 11.

(1)Without prejudice to the specific provisions on penalties established under Chapter XII of Regulation (EU) 2024/ 1689, any operator who commits an infringement of these regulations or of Regulation (EU) 2024/1689 shall be liable to an administrative penalty of up to three hundred and fifty thousand euro (€350,000) for each infringement or, in the case where the offender is an undertaking, up to one per cent (1%) of its total worldwide annual turnover for the preceding financial year, whichever is higher.

(2)Without prejudice to the specific provisions on penalties established under Chapter XII of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority may, instead of, or in addition to the administrative penalty referred to in sub-regulation

(1)impose on an operator who commits an infringement of these regulations or of Regulation (EU) 2024/1689 a daily penalty of twelve thousand euro (€12,000) for each day during which such infringement persists.

(3)Unless otherwise specified in these regulations, proceedings in relation to an infringement of these regulations and of Regulation (EU) 2024/1689 shall be instituted by the Malta Digital Innovation Authority and any administrative penalty imposed and, or decision taken by the Malta Digital Innovation Authority shall be subject to an appeal in accordance with Part IX of the Act.

(4)When deciding whether to impose an administrative penalty and in determining the amount of the administrative penalty in each case, all relevant circumstances of the specific situation shall be taken into account and, as appropriate, regard shall be given to the following: (

1. a)the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them; (
2. b)whether administrative penalties have already been applied by other market surveillance authorities to the same operator for the same infringement; (
3. c)whether administrative penalties have already been applied by other authorities to the same operator for infringements of other Union or national law, when such infringements result from the same activity or omission constituting a relevant infringement of these regulations and of Regulation (EU) 2024/1689; (
4. d)the size, the annual turnover and market share of the operator committing the infringement; ARTIFICIAL INTELLIGENCE [ S.L. 591.05 (
5. e)any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement; (
6. f)the degree of cooperation with the national competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (
7. g)the degree of responsibility of the operator taking into account the technical and organisational measures implemented by it; (
8. h)the manner in which the infringement became known to the national competent authorities, in particular whether, and if so to what extent, the operator notified the infringement; (
9. i)the intentional or negligent character of the infringement; (
10. j)any action taken by the operator to mitigate the harm suffered by the affected persons.

(5)The Malta Digital Innovation Authority, as the case may be, may, after giving due regard to the circumstances of the case impose an administrative penalty on a public authority or body: Provided that such an administrative penalty shall not exceed fifty thousand euro (€50,000) for each infringement and, additionally, the Malta Digital Innovation Authority, as the case may be, may impose a daily penalty of fifty euro (€50) for each day during which such infringement persists.

(6)At any stage of the proceedings in relation to an infringement of these regulations and of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority may require any person or public authority who has violated any provision of these regulations or of Regulation (EU) 2024/1689 to undertake in writing to refrain from such conduct and to take any remedial or other action as the Malta Digital Innovation Authority may specify.

(7)Without prejudice to sub-regulations

(1),

(2),

(5)and

(6), the Malta Digital Innovation Authority may at any stage of the proceedings in respect of any infringement of these regulations or of Regulation (EU) 2024/1689, issue reprimands, warnings, or take any other similar non-monetary disciplinary measures or any other measures it may deem appropriate or necessary.

(8)The Malta Digital Innovation Authority may establish 7 8 [ S.L. 591.05 ARTIFICIAL INTELLIGENCE and publish policies and guidelines from time to time regarding the measures referred to in sub-regulation

(7).

(9)The initiation of proceedings by the Malta Digital Innovation Authority under these regulations shall be prescribed by the lapse of two

(2)years from the date on which the infringement is alleged to have been committed.