On 20 January 2026, the Proposal for a Regulation for the EU Cybersecurity Act (‘The Cybersecurity Act 2’) was published by the European Commission to update and replace Regulation (EU) 2019/881 (the “2019 Cybersecurity Act”). The Proposal was introduced in response to major changes in cybersecurity threats as well as the weaknesses identified in the 2019 Cybersecurity Act. Since the adoption of the 2019 Cybersecurity Act, cyberattacks have become more frequent and sophisticated, increasingly targeting critical infrastructures, essential services and digital supply chains. At the same time, growing geopolitical tensions and the EU’s reliance on technologies from third countries have…
Two long-awaited Legal Notices published on Friday, 23rd January 2026 have brought into force key elements of Malta’s cybersecurity and resilience framework, implementing two recent EU legislative developments. Entry Into Force of the NIS 2 Directive Legal Notice 22 of 2026 brought Subsidiary Legislation 460.41, the Measures for a High Common Level of Cybersecurity Across the European Union (Malta) Order, into force on Friday, 23rd January 2026. This Subsidiary Legislation transposes the EU Network and Information Systems Directive II (more commonly known as ‘NIS 2’) into Maltese law and is brought into force as already previously published without substantial substantive…
On 3rd November 2025, the MFSA published a circular on the reporting timelines for submissions of the Register of Information (‘ROI’) pursuant to Article 28(3) of Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (‘DORA’). The circular outlines the reporting period for submitting the ROI from 2026 onwards, which falls between 1 January and 21 March of every reporting year. Financial entities falling within the scope of DORA must submit to the MFSA the updated ROI, containing all information regarding the contractual arrangements in place with ICT third-party service providers, annually and within the specified reporting period.…