Malta Implements National Framework For The EU Cyber Resilience Act

Legal Notice 238 of 2026

On 11^th of September 2026, Malta published Legal Notice 238 of 2026 – Cyber Resilience Regulations, 2026 (the “Regulations”) in Government Gazette No. 21,717, establishing the national regulatory and enforcement framework for the application of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements, commonly referred to as the Cyber Resilience Act (“CRA”).

The CRA establishes EU-wide cybersecurity requirements for hardware and software products made available on the European Union market. Although the CRA is directly applicable in Malta and therefore does not require transposition in the same manner as an EU Directive, the new Regulations provide the institutional, supervisory and enforcement mechanisms required for its effective application at national level.

A central role for the MDIA

One of the principal effects of the Regulations is the designation of the Malta Digital Innovation Authority (“MDIA”) as both the Notifying Authority and the Market Surveillance Authority for the purposes of the CRA.

As Notifying Authority, the MDIA assumes responsibility for the national framework governing conformity assessment bodies carrying out assessments under the CRA. Chapter IV of the CRA, concerning notifying authorities and conformity assessment bodies, has applied since the 11^th of June 2026. As Market Surveillance Authority, the MDIA is responsible for monitoring products with digital elements made available on the Maltese market and is empowered to investigate compliance, request technical documentation and require corrective measures where cybersecurity risks or non-compliance are identified.

The Regulations therefore place the MDIA at the centre of Malta’s enforcement of the CRA and considerably expand the practical importance of the Authority in relation to cybersecurity and digital-product regulation.

Incident and vulnerability reporting

The publication of the Regulations coincides with an important milestone under the CRA. As of 11^th of September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.

Manufacturers must generally issue an early warning within 24 hours of becoming aware of a reportable vulnerability or incident, followed by a fuller notification within 72 hours. Further reporting obligations apply thereafter. Reports are submitted through the CRA’s Single Reporting Platform. Accordingly, while the majority of the CRA will not apply until 11^th of December 2027, businesses should not regard the intervening period as merely preparatory. Certain substantive obligations are already applicable.

The Maltese framework also identifies the national CSIRT structure relevant to cybersecurity incident response, complementing the MDIA’s supervisory and market-surveillance role.

Enforcement and administrative penalties

The Regulations establish the Maltese administrative framework through which non-compliance with the CRA may be addressed. The MDIA may, depending on the circumstances of the infringement, make use of enforcement measures including warnings, corrective measures and administrative penalties. In determining the appropriate response, considerations such as the nature and seriousness of the infringement and the size of the economic operator may be relevant.

This national framework operates alongside the substantial penalty regime established by the CRA itself. Certain infringements, including breaches of the CRA’s essential cybersecurity requirements and Articles 13 and 14, may attract administrative fines of up to €15 million or 2.5% of an undertaking’s total worldwide annual turnover for the preceding financial year, whichever is higher.

 The CRA requires penalties to be effective, proportionate and dissuasive and provides for significant administrative fines in respect of certain infringements. Importantly, the Regulations also provide mechanisms through which affected persons may challenge administrative decisions. They further amend Malta’s Administrative Justice Act so as to bring decisions taken under the Cyber Resilience Regulations within the applicable administrative justice framework.

Supporting smaller businesses and innovation

The Regulations also reflect the CRA’s approach towards microenterprises and small and medium-sized enterprises (“SMEs”), recognising that the technical and administrative burden involved in cybersecurity compliance may be proportionately greater for smaller operators.

The framework contemplates assistance aimed at improving cybersecurity knowledge and preparedness and allows for the establishment of cyber resilience regulatory sandboxes, through which innovative products may be developed or tested within a controlled regulatory environment.

What changes for businesses in Malta?

Legal Notice 238 of 2026 ensures that the CRA now has a clearly defined Maltese supervisory and enforcement structure. Businesses that manufacture, import or distribute products with digital elements should therefore identify whether their products fall within the CRA, determine their role within the relevant supply chain and establish procedures for dealing with vulnerability and incident reporting. Manufacturers in particular should already have processes capable of identifying potentially reportable cybersecurity events and escalating them rapidly enough to comply with the applicable 24- and 72-hour deadlines.

Looking ahead to the 11^th of December 2027, businesses will also need to prepare for the CRA’s wider requirements concerning secure product design and development, vulnerability management, cybersecurity risk assessments, technical documentation, conformity assessment and CE marking.

Conclusion

By designating the MDIA as Malta’s Notifying Authority and Market Surveillance Authority and introducing the necessary enforcement, penalty and administrative-review mechanisms, the Regulations provide the national structure through which the CRA will be supervised and enforced.

Although full application of the CRA remains scheduled for December 2027, its vulnerability and incident-reporting obligations have applied since 11^th of September 2026. Businesses operating in the digital-product sector should therefore begin treating CRA compliance as a present regulatory requirement rather than solely a future implementation exercise.