	NIS2 Implementation in the EU
	Malta
	(Europe) Firm Ganado Advocates Contributors Paul Micallef Grimaud Andrea Grima Updated 02 Feb 2026
Status of the legislative process	Enacted
Status of the NIS2 Implementation Act	On 8 April 2025, the NIS2 Directive was transposed into national law through Legal Notice 71 of 2025, which established Subsidiary Legislation 460.41, titled the Measures for High Common Level of Cybersecurity Across the European Union (Malta) Order. On 23 January 2026, Subsidiary Legislation 460.41 came into force via Legal Notice 22 of 2026.
Significant deviations of the National Implementation Act from the NIS2 Directive, if any	Subsidiary Legislation 460.41 mirrors closely the NIS2 Directive. Article 2(5)(b) of the NIS2 Directive has not been implemented, and therefore, educational institutions fall outside the scope of Subsidiary Legislation 460.41. Article 2(5)(a) of the NIS2 Directive, on the other hand, has been implemented, and Subsidiary Legislation 460.41 applies to public administration entities at the local level.
Date of entry into force of the Implementation Act	The NIS2 Directive was transposed into national law on 8 April 2025 through Legal Notice 71 of 2025, which established Subsidiary Legislation 460.41. On 23 January 2026, Subsidiary Legislation 460.41 came into force via Legal Notice 22 of 2026.

NIS2 Implementation in the EU

Back XLS

Status of the legislative process

Enacted

Status of the NIS2 Implementation Act

On 8 April 2025, the NIS2 Directive was transposed into national law through Legal Notice 71 of 2025, which established Subsidiary Legislation 460.41, titled the Measures for High Common Level of Cybersecurity Across the European Union (Malta) Order. On 23 January 2026, Subsidiary Legislation 460.41 came into force via Legal Notice 22 of 2026.

Significant deviations of the National Implementation Act from the NIS2 Directive, if any

Subsidiary Legislation 460.41 mirrors closely the NIS2 Directive.
Article 2(5)(b) of the NIS2 Directive has not been implemented, and therefore, educational institutions fall outside the scope of Subsidiary Legislation 460.41.
Article 2(5)(a) of the NIS2 Directive, on the other hand, has been implemented, and Subsidiary Legislation 460.41 applies to public administration entities at the local level.

Date of entry into force of the Implementation Act

The NIS2 Directive was transposed into national law on 8 April 2025 through Legal Notice 71 of 2025, which established Subsidiary Legislation 460.41. On 23 January 2026, Subsidiary Legislation 460.41 came into force via Legal Notice 22 of 2026.