NIS2 · National implementation
NIS2 in Malta
Malta transposed NIS2 through Subsidiary Legislation 460.41 (Legal Notice 71 of 2025), the Measures for a High Common Level of Cybersecurity across the European Union Order.
- National law
- Subsidiary Legislation 460.41 (Legal Notice 71 of 2025)
- Measures for a High Common Level of Cybersecurity Order
- Status
- In force
- In force
- 2026
- Authority
- Critical Infrastructure Protection (CIP) Department
Supervision
The Critical Infrastructure Protection (CIP) Department is the competent authority, with CSIRTMalta as national CSIRT. Registration follows the order's notification duties.
What is specific to Malta
Malta implemented via subsidiary legislation under existing enabling acts rather than a new act of parliament — quick to adopt, but the operative detail depends on the CIP Department's directions. Malta's concentration of iGaming, financial and hosting companies means many Maltese entities hit the digital-provider and ICT-management categories with the main-establishment rules in play.
Official sources
Primary references: the national statute book at legislation.mt and the national cybersecurity authority at criticalinfrastructure.gov.mt.
NIS2 in Malta: frequently asked questions
Last reviewed: