CRA Compliance in Malta

MITA serves as Malta's national competent authority for the CRA, with market surveillance for consumer and industrial products coordinated with the Malta Competition and Consumer Affairs Authority (MCCAA). Malta's NIS2 transposition legislation designates MITA as the competent authority for cybersecurity oversight, providing the legislative basis for CRA enforcement. Malta's small size means that MITA's enforcement approach will necessarily be risk-based and proportionate, focusing on higher-risk product categories and entities with significant market footprint. Malta coordinates with ENISA and peer EU NCAs for cross-border product incidents.

Maltese manufacturers submit Article 14 notifications to MITA-CSIRT through MITA's contact channels. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. MITA-CSIRT participates in the EU CSIRTs network, ensuring that cross-border incidents are coordinated with relevant EU CSIRTs and ENISA. Given Malta's small size, manufacturers should contact MITA directly to confirm current Article 14 notification procedures and establish a named contact within MITA-CSIRT for incident coordination before any incident arises.

Market surveillance for CRA products in Malta is coordinated between MITA and MCCAA. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. MCCAA conducts market surveillance under EU consumer and product safety regulations. Malta's small regulatory capacity means that market surveillance will be risk-based, with the highest-risk product categories receiving priority attention. Manufacturers registered in Malta should maintain comprehensive CRA technical documentation in English, which is Malta's primary business language.

MITA provides cybersecurity guidance for Maltese businesses through its website and publications. Malta Enterprise supports business investment including cybersecurity through its investment incentive schemes, with some applicable to CRA compliance investments. The Malta Chamber of SMEs provides regulatory guidance for small and medium manufacturers. Given Malta's small domestic market, Maltese manufacturers are strongly encouraged to utilise ENISA's comprehensive free CRA guidance — available in English — as the primary implementation reference. The Malta Digital Innovation Authority (MDIA) may provide additional guidance for technology manufacturers in Malta's growing digital economy.