The EU AI Act was supposed to reach its big milestone on 2 August 2026. Then, days before that date, the EU changed the timetable. If you run a business in Malta and are unsure what now applies, you are not alone. This guide sets out what is in force, what has been postponed, and who enforces it locally. It is general information, not legal advice.
What is the EU AI Act, in one paragraph?
The AI Act is the EU’s regulation on artificial intelligence. It entered into force on 1 August 2024 and sorts AI uses into four levels: unacceptable risk (banned), high-risk (strict requirements), transparency risk (disclosure duties) and minimal risk (no specific obligations). The European Commission notes that the vast majority of AI systems used in the EU fall into the minimal risk category. Obligations differ depending on whether you are a provider (you develop an AI system or put it on the market under your name) or a deployer (you use one in your business). Most Maltese SMEs are deployers.
What changed with the AI Omnibus in July 2026?
In November 2025 the Commission proposed a “Digital Omnibus” to simplify the rules. After a political agreement in May, the AI part was fast-tracked so it could take effect before the original deadline. It was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and entered into force on 27 July. The main changes, as summarised by Lewis Silkin and Gibson Dunn:
- High-risk obligations postponed. Stand-alone high-risk systems listed in Annex III (for example AI used in employment, education, creditworthiness and access to essential services) move from 2 August 2026 to 2 December 2027. High-risk AI embedded in regulated products under Annex I moves to 2 August 2028.
- AI literacy softened. Article 4 now requires providers and deployers to support the development of AI literacy among their staff, rather than ensure a specific level.
- A short grace period for content marking. Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking of their outputs.
- New prohibitions. AI systems that generate non-consensual intimate imagery or child sexual abuse material are banned.
- More help for smaller firms. Simplifications for SMEs, including simplified technical documentation, are extended to small mid-cap companies.
- Sandboxes later. Member states have until 2 August 2027 to set up at least one AI regulatory sandbox.
What already applies to my business today?
Prohibited practices (since 2 February 2025)
Certain uses are banned outright, such as manipulative techniques that cause significant harm or social scoring. Very few ordinary business uses come close, but it is worth confirming that none of your tools do.
AI literacy (since 2 February 2025, softened in 2026)
If your staff use AI at work, you should take proportionate steps to help them understand it: what it is good at, where it fails and how to use it safely. Keeping a simple record of training and guidance is sensible.
Transparency (from 2 August 2026)
According to Jones Walker’s analysis, the Article 50 duties that apply from 2 August 2026 include:
- Telling people when they are interacting with an AI system, such as a website chatbot, unless it is obvious.
- Machine-readable marking of AI-generated audio, images, video and text by the providers of those systems.
- Disclosing deepfakes, with exceptions for evidently creative or satirical work.
- Disclosing AI-generated text published to inform the public on matters of public interest, unless it has been through human editorial review.
- Informing people exposed to emotion recognition or biometric categorisation systems.
The same analysis notes Article 50 breaches can attract fines of up to €15 million or 3% of worldwide annual turnover, with SMEs subject to whichever of the two is lower.
General-purpose AI models (since 2 August 2025)
Obligations for providers of general-purpose AI models, such as the large language models behind popular assistants, became applicable on 2 August 2025. These fall on the model providers, not on businesses that use their products.
Who enforces the AI Act in Malta?
Malta implemented the national framework through two legal notices in 2025. According to a Chambers and Partners summary, Legal Notice 226 of 2025 designates the Malta Digital Innovation Authority (MDIA) as the lead market surveillance authority, single point of contact and operator of the national AI regulatory sandbox. Legal Notice 227 of 2025 gives the Information and Data Protection Commissioner (IDPC) oversight of high-risk systems in sensitive areas such as biometrics, law enforcement, border control and the administration of justice.
The same summary reports that the MDIA can impose administrative penalties of up to €350,000 or 1% of annual turnover, plus daily penalties of up to €12,000. For most SMEs, the more immediate point is simply that there is now a local regulator with powers, and that GDPR obligations enforced by the IDPC continue to apply to any AI that processes personal data.
Does the delay mean Maltese SMEs can relax?
Not quite. High-risk obligations were deferred, not cancelled, and the new dates are fixed. If you use AI to screen job applicants, assess customers’ creditworthiness, or make decisions about access to services, you are likely to fall into the high-risk category from December 2027. Deployers of such systems will have duties around human oversight, monitoring, record keeping and staff training.
Fifteen months is not long to review vendors, adjust processes and train people, particularly if the AI is built into software you buy rather than something you control.
What should you do next?
Start with an inventory: every AI tool or feature in use, who uses it, what data it touches and what decisions it influences. From there, most businesses find their obligations are manageable. We have written a step-by-step EU AI Act checklist for Maltese SMEs to help, and we build governance into every AI automation project from the start.
Frequently asked questions
Did the EU AI Act come into force on 2 August 2026?
The AI Act entered into force on 1 August 2024 and applies in stages. Most provisions became applicable on 2 August 2026, including the Article 50 transparency duties, but the high-risk obligations were postponed to 2 December 2027 and 2 August 2028.
Does the AI Act apply to small businesses in Malta?
Yes. There is no general exemption for SMEs, although penalties are capped at the lower amount for SMEs and some documentation is simplified. Most SMEs are deployers, whose duties centre on AI literacy, transparency and, for high-risk uses, oversight.
Who is the AI Act regulator in Malta?
The Malta Digital Innovation Authority (MDIA) is the lead market surveillance authority and single point of contact. The Information and Data Protection Commissioner (IDPC) oversees certain high-risk areas such as biometrics and law enforcement.
Do I have to label content my team creates with AI?
Providers of generative AI systems must mark outputs in a machine-readable way. As a deployer, you must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless it has had human editorial review. Routine internal drafts are not covered.
If you want a clear picture of where your business stands, book a free discovery call with Haystack. We will help you map your AI use and the practical steps that follow.
