NIS2 Registration Duty in Malta: Who Must Register, Where and By When
What the Maltese NIS2 registration duty is
Malta transposed the NIS2 Directive through the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order (S.L. 460.41). One of the first practical obligations for in-scope organisations is to enter themselves onto a national register.
The Order requires the Critical Infrastructure Protection Department (CIP Department) — the national supervisory authority under article 7 — to establish a *national self-registration mechanism* for essential and important entities providing services in Malta. In practice, this means affected organisations do not wait to be contacted: they must proactively register themselves.
The registration mechanism is set out in article 7(1)(c) and article 7(3)(h), and the duty on entities to register is set out in article 7(4). The CIP Department also maintains the resulting register, reviewing and updating it on a regular basis and at least every two (2) years.
Who must register
Under article 7(4), the following must register on the national self-registration mechanism:
- Essential and important entities providing services in Malta; and
- Entities providing domain name registration services in Malta.
Whether your organisation is an essential entity or an important entity depends on the classification rules in article 4. In summary:
- Essential entities include, among others, entities of a type in the First Schedule that exceed the ceilings for medium-sized enterprises; qualified trust service providers, top-level domain name registries and DNS service providers (regardless of size); certain providers of public electronic communications networks or services; specified public administration entities; and entities identified or designated by the CIP Department under the relevant provisions of article 3.
- Important entities are entities of a type in the First or Second Schedule that do not qualify as essential entities under article 4(1), including entities identified as important by the CIP Department.
If your sector or sub-sector appears in the First or Second Schedule and you meet the size or designation criteria, you are likely in scope. A structured scoping exercise is the fastest way to confirm your status before you register.
Not sure whether you are essential or important? Use our free scoping tool to check your sector, size and classification, then map the exact registration steps that apply to you.
What information you must submit and where
Registration is made on the national self-registration mechanism established by the CIP Department under article 7(3)(h). Under article 7(4), entities must provide at least the following information:
| Item | Detail required |
|---|---|
| (a) Entity name | The name of the entity |
| (b) CSIRT | The name of the CSIRT providing monitoring services to the entity, and whether it is an internal or autonomous CSIRT |
| (c) Contact details | Address and up-to-date contact details, including email addresses, IP ranges and telephone numbers |
| (d) Sector | Where applicable, the relevant sector and sub-sector listed in the First or Second Schedule |
| (e) Cross-border services | Where applicable, a list of the Member States where the entity provides services falling within the scope of the Order |
Keeping details current is also part of the duty. Under article 7(5), essential and important entities must notify the CIP Department of any changes to the details submitted under article 7(4) *without delay* and, in any event, within two (2) weeks of the date of the change.
The exact electronic portal or channel used to submit the registration is an operational detail — the precise registration channel is [TÄPSUSTAB PARTNER-JURIST].
By when must you register
The Order places a clear duty to register on essential and important entities providing services in Malta, as well as on entities providing domain name registration services in Malta (article 7(4)).
The KB context does not state a specific calendar registration deadline for the initial self-registration. Accordingly, the exact registration deadline is [TÄPSUSTAB PARTNER-JURIST] and should be confirmed against the current official text and any guidance issued by the CIP Department.
What the Order does fix precisely is the timeline for updating your details: any change to the information submitted under article 7(4) must be notified within two (2) weeks of the date of the change (article 7(5)).
Given the uncertainty around the exact registration date, the practical approach is to prepare your registration data set now — entity details, CSIRT arrangements, contact points, sector mapping and any cross-border service list — so you can register as soon as your obligation crystallises.
What happens if you do not register
Registration is not just an administrative formality — it is embedded in the supervisory and enforcement framework of the Order.
Under the enforcement powers in article 29(6)(j) (for essential entities) and article 30(6)(i) (for important entities), the CIP Department, or where designated the competent authority, can order an entity to register under the national self-registration mechanism. This confirms that registration compliance is directly enforceable.
More broadly, the supervisory measures in article 29 and article 30 allow the authority to request information and assess compliance, including compliance with the obligation to submit information. Administrative penalties under article 32 apply where entities infringe articles 19 or 20 (cybersecurity risk-management measures and reporting obligations): up to €10 000 000 or 2% of total worldwide annual turnover for essential entities, and up to €7 000 000 or 1.4% for important entities, whichever is higher.
The most reliable way to avoid enforcement exposure is to confirm your classification early, register correctly and keep your details up to date.
Frequently asked questions
Who has to register under NIS2 in Malta?
Under article 7(4) of S.L. 460.41, essential entities and important entities providing services in Malta, together with entities providing domain name registration services in Malta, must register on the national self-registration mechanism established by the CIP Department.
Which authority runs the NIS2 register in Malta?
The Critical Infrastructure Protection Department (CIP Department) is the national supervisory authority (article 7) and is responsible for establishing the national self-registration mechanism and maintaining the register.
What information must be submitted when registering?
Under article 7(4), an entity must provide at least: its name; the name of its CSIRT and whether it is internal or autonomous; address and up-to-date contact details (including email addresses, IP ranges and telephone numbers); where applicable the relevant sector and sub-sector from the First or Second Schedule; and where applicable a list of Member States where it provides in-scope services.
Is there a deadline to register?
The Order clearly imposes the duty to register, but the KB context does not state a specific calendar deadline for initial registration, so that date is [TÄPSUSTAB PARTNER-JURIST]. Note that changes to registered details must be notified within two (2) weeks of the change under article 7(5).
Check your NIS2 compliance
The complete NIS2 guide — Malta →
This article is general information, not legal advice. A partner lawyer confirms your specific situation.