MaltaCyber Resilience Regulations, MDIA Designation under the Cyber Resilience Act
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 7 days, effective 11 September 2026.
A product security requirements rule binding public and private bodies.
As of 18 September 2026.
What it requires
- This designation does not itself add a duty beyond the Cyber Resilience Act's own: the Regulation's essential requirements and market-placement duties reach a manufacturer's product with digital elements from 11 December 2027, and its vulnerability and incident reporting duties have applied since 11 September 2026, both documented at the European Union jurisdiction level.
- Expect the Malta Digital Innovation Authority to act as Malta's Notifying Authority and Market Surveillance Authority under the Cyber Resilience Act, though the MDIA's own complaints procedure states the corresponding provisions are still to come into application, so this role's operative reach in Malta specifically is not yet confirmed by the sources read here.
- Report an actively exploited vulnerability or a severe incident to ENISA's single reporting platform under the Regulation's own Article 14 and Article 16, since which Maltese body, if any, is designated as the CSIRT coordinator for that report is not confirmed in the primary text read here.
Who enforces it
Enforcement body
The Malta Digital Innovation Authority (MDIA), which describes itself as Malta's prospective Notifying Authority and Market Surveillance Authority under the Cyber Resilience Act.
Settledness
- As of
- 18 September 2026
- Guidance link
- https://mdia.gov.mt/services/cyber-security/
- Guidance body
- Malta Digital Innovation Authority (MDIA)
- Open questions
- Has the Malta Digital Innovation Authority's role as Notifying Authority and Market Surveillance Authority under the Cyber Resilience Act become operative, given the MDIA's own complaints procedure states the corresponding provisions are still to come into application even after the Regulation's Article 14 reporting duties began applying EU-wide on 11 September 2026?
- Which Maltese body, if any, is designated as the CSIRT that coordinates a Malta-established manufacturer's Article 14 vulnerability and incident reports, given the MDIA's own list of the EU regulations it administers describes only the Notifying Authority and Market Surveillance Authority roles?
What it reaches
Obligation class
Governance, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Malta Digital Innovation Authority (MDIA) describes itself as the prospective Notifying Authority and Market Surveillance Authority pursuant to the Cyber Resilience Act (Regulation (EU) 2024/2847). Malta's legislation portal carries this designation under a consolidated record, Subsidiary Legislation 591.6, Cyber Resilience Regulations, made under Chapter 591, the Malta Digital Innovation Authority Act, with a recorded point in time of 11 September 2026.
The Cyber Resilience Act's own essential requirements and market-placement duties for a manufacturer, applicable from 11 December 2027, and its vulnerability and incident reporting duties, applicable since 11 September 2026, are the Regulation's own and are documented at the European Union jurisdiction level rather than restated here.
The MDIA's own published complaints procedure states that the corresponding provisions under the Cyber Resilience Act are still to come into application, so whether the MDIA's Notifying Authority and Market Surveillance Authority role under this Regulation is yet fully operative is not established in the primary text read here.
When LexLint raises it
distributes_software_productships_mobile_app
Read the law
Malta Digital Innovation Authority, official Cybersecurity services page and Legislation page
legislation.mt, consolidated record for S.L. 591.6