NIS2 in Malta

Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order

Law in force since 2026-01-23

Law: L.N. 71/2025 (S.L. 460.41)
Authority: Critical Infrastructure Protection (CIP) Department
Classes: essential entity (essential), important entity (important)
Register: CIP Department national self-registration mechanism
ISO 27001: Not named in the law

Know when Malta changes its NIS2 rules

One email when the law, the deadlines or the portal change.

The law

The order is a legal notice under the European Union Act. The consolidated text on legislation.mt carries the date 2026-01-23. L.N. 89 of 2026 amended it later. It created an Enforcement Committee that imposes the fines.

Name: Measures for a High Common Level of Cybersecurity across the European Union (Malta) OrderMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, as amended by L.N. 89 of 2026
In force: 2026-01-23
Text: Read the L.N. 71/2025 (S.L. 460.41)

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

The Maltese law keeps the Directive's size and class rules.

Also note

Public administration entities listed in art. 3(3)(f)(i) are essential entities.
Domain name registration providers are in scope at any size.

Registration

Essential and important entities, and domain name registration providers, register on the self-registration mechanism of the CIP Department. The order sets no registration deadline. Report a change within 2 weeks.

Portal: CIP Department national self-registration mechanism
Rule: The law sets no fixed period
You need: Name, CSIRT provider, contact details, IP ranges, sector and sub-sector, and the Member States where you offer services.
Changes: Report changes to your data within 14 days

Incident reporting

24 hEarly warning
72 hIncident notification
1 monthFinal reportafter the incident notification

Send the reports to the national CSIRT, which informs the CIP Department.

Trust service providers notify within 24 hours of the incident notice. The CSIRT passes the report to the competent authority.

Measures and proof

Essential: Every essential or important entity appoints a qualified auditor that the CIP Department approves. The CIP Department can also order regular, targeted and ad hoc audits of essential entities. The entity pays for a targeted audit by an independent body, with limited exceptions.
Important: The CIP Department supervises important entities after the fact, on evidence of non-compliance. The same qualified-auditor duty applies.

The date

2026-01-23 Consolidated order in force

Duties of management

Management bodies approve the risk-management measures and oversee them. Members can be liable for breaches and must follow training.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 32(3)-(4) of the order. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class	Ceiling	At EUR 20m	At EUR 500m	At EUR 2bn
Essential	EUR 10m or 2%	EUR 10m	EUR 10m	EUR 40m
Important	EUR 7m or 1.4%	EUR 7m	EUR 7m	EUR 28m

The Enforcement Committee imposes the fines on a report from the CIP Department or the sector authority.