EveryAILaw.com

LN 226/2025 adds no Maltese classification or general risk-assessment duty: classification follows Article 6 and Annex III of Regulation (EU) 2024/1689. The two operator requirements below retain their own named actors; this grouped section has no common role or asserted obligation-category mapping. Institutional context: MDIA is market-surveillance authority and single point of contact (reg. 3), coordinates with the specified sectoral authorities, and is Notifying Authority; the National Accreditation Board performs the Article 28(1) assessment and monitoring (reg. 7). MDIA establishes and runs the national regulatory sandbox (reg. 9); participation is a facility, not an operator duty. Registration, importer-information and sandbox provisions commence on 2026-08-02; the earlier institutional designations and penalty provisions are not deferred by the grouped Effective date. Penalties qualification: Imposed by MDIA and without prejudice to the Chapter XII penalties of Regulation (EU) 2024/1689. Appeals lie under Part IX of the MDIA Act.

The requirements below concern law-enforcement use of real-time remote biometric identification in publicly accessible spaces, with the statutory urgency exception. Institutional context: IDPC supervises the reg. 3 high-risk systems and prohibited practices, establishes the reg. 11 registry, and exercises corrective powers. These institutional functions are not duties assigned to deployers. The Effective date describes the core biometric controls; earlier administrative and penalty provisions retain their own commencement under reg. 1(3). Penalties qualification: Article 20 of the Data Protection Act applies mutatis mutandis to Commissioner decisions; appeals lie to the Information and Data Protection Appeals Tribunal.