Malta: Artificial Intelligence Comparative Guide

1 Legal and enforcement framework

1.1 In broad terms, which legislative and regulatory provisions govern AI in your jurisdiction?

The legal ramifications of artificial intelligence (AI) are a popular topic in most jurisdictions. Many countries have already started analysing and amending their legal frameworks to cater for this disruptive technology; however, the general inclination is that designing a standalone AI legal framework is not the best way to address the various legal issues that arise in this context. A gap analysis of existing regulation and ‘piecemeal' legislation which tackles specific issues appears to be the trend in this respect.

In the same vein, Malta does not have a dedicated legal framework to govern AI per se, although various initiatives have been taken. In October 2018, the Malta.AI Taskforce was set up by the Maltese government. Two documents have been published by the taskforce:

• Malta's Ethical AI Framework; and
• A Strategy and Vision for Artificial Intelligence in Malta 2030.

The framework, published in October 2019, does not have the binding force of law, but establishes a set of guiding principles for trustworthy AI governance. It builds on the AI Ethics Guidelines for Trustworthy AI published in April 2019 by the European Commission's High-Level Expert Group on Artificial Intelligence (AI HLEG), but adds a number of control practices which aim to provide guidance on how the principles set out therein should translate in practice.

In terms of the legal aspect, numerous initiatives have been structured under the strategy. These will be discussed in more detail in the following questions.

1.2 How is established or ‘background' law evolving to cover AI in your jurisdiction?

Malta's existing laws have not yet been amended to take account of AI; however, pursuant to the strategy, a National Technology Ethics Committee is to be set up under the Malta Digital Innovation Authority (MDIA), which will oversee the framework and its intersection across various policy initiatives. Another legislative initiative is the Technology Regulation Advisory Committee, which will be set up to focus on assessing and determining the extent to which existing laws and regulations will apply to AI technologies. It will also focus on analysing local laws that may need to change, monitoring developments at European level and advising on the setting up of a regulatory sandbox for AI.

The regulatory sandbox will provide regulatory exemptions, enabling firms to explore and test concepts and solutions with proportionate safeguards. In addition to the regulatory sandbox, the Office of the Information and Data Protection Commissioner (IDPC), as the national data protection authority, will also set up a data sandbox to support organisations that need to use personal data in the process of developing or testing innovative products and services in the specific area of AI.

Malta has also focused on a national AI Certification Programme, which will be based on the framework and its underlying control practices and will provide applicants with valuable recognition in the marketplace that their AI systems have been developed in an ethically aligned, transparent and socially responsible manner.

1.3 Is there a general duty in your jurisdiction to take reasonable care (like the tort of negligence in the United Kingdom) when using AI?

Under the Maltese law of obligations, pursuant to Article 1032(1) of the Civil Code, "a person shall be deemed to be in fault if, in his own acts, he does not use the prudence, diligence, and attention of a bonus paterfamilias". Furthermore, Article 1032(2) of the Civil Code goes on to state that "no person shall, in the absence of an express provision of the law, be liable for any damage caused by want of prudence, diligence, or attention in a higher degree". It appears that the standard of reasonable care which is required is that of a reasonable man, or a ‘bonus paterfamilias'.

In principle, therefore, whoever causes harm by acting in a manner which falls below the level of diligence of a ‘bonus paterfamilias' will be liable to compensate for the harm that he or she has caused as a result of such negligence. The duty which is mentioned in Article 1032 of the Civil Code has not been amended in order to cater for AI issues, and there is no express provision or principle in Maltese law stating that there is a duty of reasonable care when using AI. The duty of care which exists under Maltese law is of a general nature and does not specifically discuss AI matters.

Furthermore, under the Product Safety Act (which transposes the Product Safety Directive), a product is safe if it meets all statutory safety requirements under European or national law (or, in default thereof, European Commission recommendations and codes of practice), and any distributor that supplies products which it should know to be unsafe (even though it does not actually know this) will be liable under that act.

1.4 For robots and other mobile AI, is the general law (eg, in the United Kingdom, the torts of nuisance and ‘escape' and (statutory) strict liability for animals) applicable by analogy in your jurisdiction?

In a 2019 Report by the European Commission on the Liability for Artificial Intelligence and other Emerging Digital Technologies, it was discussed that from the 19th century onwards, legislatures generally responded to risks brought about by new technologies by introducing strict liability. So far, these changes to the law have concerned, for example, means of transport, such as trains and motor vehicles, energy and pipelines. Even before that, tort laws often responded to increased risks by shifting the burden of proving fault, making it easier for the victim to succeed if the defendant was in control of particular sources of harm such as animals or defective immovables.

Under the Maltese Civil Code, Article 1038 states that "any person who without the necessary skill undertakes any work or service shall be liable for any damage which, through his unskilfulness, he may cause to others". Furthermore, Article 1040 provides that "the owner of an animal, or any person using an animal during such time as such person is using it, shall be liable for any damage caused by it, whether the animal was under his charge or had strayed or escaped". Many academic writers have drawn a parallel between this situation and one where, for example, a robot runs amok, stating that such provisions should be invoked in such a case. This comparison is being made in parallel with similar articles in foreign legislation.

Furthermore, the Product Liability Directive was transposed into Maltese law through Articles 56 to 71 of the Consumer Affairs Act which introduce the principle of strict (no-fault) liability into the product liability regime. This legislation is subject to the limitations of the Product Liability Directive itself.

1.5 Do any special regimes apply in specific areas?

No special regimes apply in specific areas which deal with AI. To date, Malta has no AI-specific legislation and its civil law framework has not yet been amended to cater specifically for AI-related matters. The process towards the legislative inclusion of issues brought about by AI has been kick-started by the strategy; however, no concrete changes or innovations have been implemented at the time of writing.

1.6 Do any bilateral or multilateral instruments have relevance in the AI context?

Malta is a member state of the European Union, and consequently is bound by all regulations, directives and recommendations issued by the European Union and any treaties to which the European Union may become a party. The European Union has already issued or been involved in a number of initiatives, such as:

• the AI Ethics Guidelines for Trustworthy AI, issued by the AI HLEG;
• the Report on Liability for Artificial Intelligence and Other Emerging Technologies, prepared by the Expert Group on Liability and New Technologies – New Technologies Formation and published on 21 November 2019; and
• the Declaration of Cooperation on Artificial Intelligence, signed by 25 European countries on 10 April 2018. The declaration builds further on the achievements and investments of the European research and business community in AI and sets out the basis for the Coordinated Plan on AI.

In its own right, Malta adheres to the Organisation for Economic Co-operation and Development Recommendations of the Council on Artificial Intelligence (https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449#adherents).

1.7 Which bodies are responsible for enforcing the applicable laws and regulations? What powers do they have?

From a local context and a general law perspective, the Maltese police and the courts of Malta are responsible for enforcing the applicable laws and regulations. The powers of these bodies depend on the applicable laws and regulations. For instance, in the case of tort law, the courts of Malta have the power to make decisions and order the payment of damages to injured parties. The MDIA has the power to oversee and provide for registration and certification of innovative technology arrangements. The Office for Consumer Affairs is responsible for the promotion and protection of consumer rights and welfare. Furthermore, the Standardisation Directorate of the Standards and Metrology Institute – a Maltese independent body set up under the Malta Competition and Consumer Affairs Act – is entrusted with the coordination of standardisation and related activities at various corporate, national, regional and international levels. Finally, the IPDC is the national supervisory authority responsible for monitoring and enforcing the provisions of the General Data Protection Regulation and the Data Protection Act.

1.8 What is the general regulatory approach to AI in your jurisdiction?

Malta's regulatory approach to addressing AI has been primarily led by the Malta.AI Taskforce. Notably, the regulatory process in terms of AI is still in its initial stages and no legislative amendments or new acts or regulations have been introduced as yet. So far, the efforts of the taskforce have involved the publication of the framework and the strategy. How the regulatory sphere will evolve in terms of AI remains unclear; however, efforts are being made by the Maltese authorities, via the taskforce, to initiate this process. The Technology Regulation Advisory Committee is yet to be set up to carry out a gap analysis of how existing laws and regulations can address the challenges brought about by AI technologies and to recommend relevant amendments. Meanwhile, the framework aims to formulate ethical principles as to how AI technologies should be developed and used. The four main principles are human autonomy, harm prevention, fairness and explicability, as further discussed in question 8.

2 AI market

2.1 Which AI applications have become most embedded in your jurisdiction?

Common AI applications in Malta include:

• AI marketing tools (eg, automated split testing and optimisation, dynamic content presentation depending on user, natural language processing); and
• AI in finance (eg, onboarding, fraud detection, compliance, accounting).

2.2 What AI-based products and services are primarily offered?

The AI products and services on offer off-the-shelf in Malta are very similar to those on offer in other Western countries; however, a number of setups exist to carry out customisations.

From the public sector perspective, the servizz.gov platform is the central point of information for all government services in Malta. One of the projects which the government is focusing on is exploring how AI can be applied to the servizz.gov customer service workflow, in order to drive performance enhancements and process clients' requests as efficiently and accurately as possible. The first phase will focus on the back office. An AI-driven email assistant will be created to assist servizz.gov agents with the automatic analysis of citizens' email queries and provide the assigned agent with a suggested automatic reply. The agent will then use the suggested reply as a basis for the official final reply to the citizen, to minimise the time taken to reply to queries. A human agent will check and control the quality and content of the reply email, and the changes will be monitored by the AI system so that it continues to learn how to better formulate reply emails. However, the final say remains with the human agent. Later phases of the project envisage the development of a chatbot, which will use AI to initially determine how citizens can best be directed to obtain the information they are seeking. The long-term strategy is to include voice assistance over the telephone, according to the same principle of an AI system that can communicate and help customers with their queries, but in this case using the voice medium.

2.3 How are AI companies generally structured?

AI companies are typically young and agile firms structured as limited liability companies, with relatively low levels of capital and a wealth of knowledge and ideas.

2.4 How are AI companies generally financed?

AI companies are usually financed through seed capital of the founding members and sometimes also make use of angel investment capital provided by bigger organisations that have accumulated cash in the more traditional industrial sectors (eg, construction). Both in Europe and in Malta, many funding opportunities also exist for AI and other technology companies.

2.5 To what extent is the state involved in the uptake and development of AI?

A Strategy and Vision for Artificial Intelligence in Malta 2030 establishes plans for the Maltese government to focus on designing measures that enable companies of all sizes to use, develop and integrate AI applications in the way they work and the way they do business. These include:

• new forms of financial assistance measures (grants and vouchers) to support entities to carry out in-depth AI readiness assessments, review business processes and implement AI-based solutions;
• investment in the development of Maltese language tools to support AI-driven understanding and generation of Maltese text and speech to catalyse the deployment of AI solutions by industry;
• the creation of a Digital Innovation Hub for businesses to access technological expertise, advise and insight into industry practices; and
• training programmes and financial support measure to assist business owners and employees to develop AI-related skillsets.

3 Sectoral perspectives

3.1 How is AI currently treated in the following sectors from a regulatory perspective in your jurisdiction and what specific legal issues are associated with each: (a) Healthcare; (b) Security and defence; (c) Autonomous vehicles; (d) Manufacturing; (e) Agriculture; (f) Professional services; (g) Public sector; and (h) Other?

(a) Healthcare

Discussions on AI and the healthcare system are mainly being approached from a data perspective. Malta's vision includes exploring how AI can be applied to the following aspects of healthcare:

• preventing disease;
• optimising the care trajectory for patients with common chronic conditions;
• developing and applying precision therapies for complex illnesses;
• reducing adverse events; and
• accelerating biomedical research.

Healthcare is, by nature, a data-heavy sector, thus providing many opportunities for the application of AI. The Pharmacy of Your Choice (POYC) repository stores data of over 143,000 active patients with chronic conditions. One of the projects which is to be undertaken in Malta consists of exploring the manner in which the application of AI in the POYC platform can:

• help prescribers to make more informed decisions from a patient safety perspective;
• perform predictive analysis to drive cost savings in procurement spend; and
• devise preventive care models at both the macro and micro level to create better health outcomes.

Malta's Ministry for Health is currently laying the technical and legal foundations for public health data to be collected, stored and made available for consumption in a standardised, structured and secure manner through the implementation of a National Electronic Health Record (NEHR) system. The NEHR project is expected to go live by the end of 2021. This aims to generate better-informed decisions by health professionals and ensure continuity of care for patients. It is expected to create the perfect environment for context-rich data, in which AI can be deployed to process large amounts of complex, interrelated health information in the most efficient and effective manner possible.

(b) Security and defence

AI raises a number of questions across ethical, legal and regulatory domains, including national security and defence matters. These issues include the risks of biased and unaccountable automated decision making, discrimination, data privacy issues, cyber threats and the potential for manipulation of political systems and wider society in general. With the increase of AI technologies, it is important that these issues are addressed immediately, in order to mitigate risks and unintended outcomes.

In Malta, matters of security and defence fall under the remit of the Ministry for Home Affairs, National Security and Law Enforcement. To date, no specific measures have been taken by in terms of the application of AI to matters of security and defence.

(c) Autonomous vehicles

So far, no legislative initiatives have been taken in order to provide a legal framework for the introduction of autonomous vehicles in Malta. When looking at Malta's Motor Vehicles Regulations (Subsidiary Legislation 65.11), there does not seem to be any provision which would prevent the introduction of autonomous vehicles in Malta; however, the manner in which the regulations are drafted seems to suggest that the motor vehicle must be driven by a person. In fact, Article 59 provides: "The licensee of a motor vehicle is responsible that the driver employed by him is in possession of the requisite licences. The driver of a vehicle is responsible that the motor vehicle under his charge is provided with the necessary licence for the service which it is required to perform."

Furthermore, in the Motor Vehicles Insurance (Third-party risks) Ordinance, Chapter 104 of the Laws of Malta, the term ‘driver' is defined as follows: "where a separate person acts as steersman of a motor vehicle, includes that person as well as any other person engaged in the driving of the vehicle".

The Motor Vehicles Insurance Ordinance also seems to suggest that the user of such motor vehicles in Malta must be a natural person. Drivers of motorised vehicles can be liable for damage of other traffic members only if the driver was personally at fault. This is the only ground to claim damages for traffic accidents. ‘Fault', as a legal concept, means the wrongful behaviour for which the person who has caused damage can legally be blamed. Victims will not be entitled to compensation unless they can prove fault. As Malta is a country that currently has exclusively fault-based liability in relation to motor vehicle accidents, it will not impose liability on the driver/operator or owner of an autonomous vehicle, unless he or she must have been aware of this risk and could have prevented it.

(d) Manufacturing

In a communication from the European Commission of April 2018, entitled Artificial Intelligence for Europe, the applications of AI to the manufacturing sector were discussed. Europe has a world-leading AI research community, with a strong leading manufacturing industry, which relies increasingly on AI. The commission commits to analysing systemic shifts in value chains in order to:

• anticipate AI opportunities for small and medium-sized enterprises (SMEs);
• pilot critical industrial AI applications in non-tech sectors; and
• reinforce the European advanced manufacturing support centre for SMEs.

Another communication issued by the European Commission in February 2020 discussed Europe's leading position in the field of AI and manufacturing, and confirmed that over half of the top manufacturers in Europe have implemented at least one instance of AI in their manufacturing operations.

Upon joining the European Union in 2004, Malta began transforming its economic focus, shifting from low-end manufacturing to an innovation-driven, service-based economy, which is now recognised as a leading global hub for financial and digital industries, with a re-dimensioned focus on industry aligned to advanced manufacturing. In A Strategy and Vision for Artificial Intelligence in Malta 2030, the manufacturing sector was discussed. In this regard, the Maltese government will be providing financial support for AI-related research and technology development in Malta's areas of smart specialisation (including high-value added manufacturing) through the Malta Council for Science and Technology FUSION Fund. From a legislative and regulatory point of view, however, no amendments or initiatives have been taken in relation to AI issues in the manufacturing industry.

(e) Agriculture

From a regulatory perspective, the concept of AI has not been introduced in the agriculture sector in Malta. From a European perspective, in the European Commission's April 2018 communication, it expressed its support towards AI technologies in both basic and industrial research. This includes investments in projects in key application areas, including agriculture. A pilot scheme was also introduced to support breakthrough market-creating innovation through the European Innovation Council. One of the areas which is targeted by this scheme is indeed agriculture.

Furthermore, in the white paper on AI published by the European Commission in February 2020, the potential of AI was discussed. Notably, Europe has excellent research centres, innovative start-ups, a world-leading position in robotics and competitive manufacturing and services sectors, including the agriculture sector.

(f) Professional services

The Malta Financial Services Authority has discussed how AI is affecting the financial services sector. Malta looks set to embrace these technologies and cultivate a framework to position itself as a leader in the area. AI-driven based solutions are now being used for intelligent financial planning, investment and money management services for consumers.

In relation to gaming, AI technologies are frequently incorporated into solutions to help detect and reduce fraud, enhance marketing effectiveness and augment customer service interactions and customer experience functions. Furthermore, in the advanced manufacturing and aviation maintenance, repair and overhaul industries, AI-driven solutions are being deployed for condition monitoring and predictive maintenance activities. The solutions draw on the vast amount of data that aircraft, ships and machines now generate. One of the pillars of the Malta AI strategy focuses on private sector adoption. This involves the promotion of awareness to enable companies of all sizes to use, develop and integrate AI applications across their organisations. The Maltese government will also focus on measures that enable companies to integrate AI applications in the way they work.

(g) Public sector

Malta's AI strategy outlines many projects in terms of how AI can be applied to the public sector. AI has the potential to help transform how public services are delivered and how national resources are used. AI can also improve the government's efficiency, thereby improving internal operations and governance.

One of the primary projects which the Maltese government is proposing is the creation of an AI-powered government. An awareness campaign will be launched for public officers to build capacity, knowledge and understanding of what AI is, why it is important and the benefits of public sector adoption. Another initiative aims to encourage the procurement of smart technologies. The government intends to develop various policy measures, including the launch of a new business case template which requires business owners to put forward a request for technology procurement to document whether emerging technologies have been considered. The Malta.AI Taskforce set up a Working Group for Public and Private Sector Adoption, in consultation with the public administration. Six AI pilot projects were identified, which will be undertaken and implemented by 2022 within the sectors of traffic management, education, healthcare, customer service, tourism and utilities.

(h) Other

Tourism is a vital sector of Malta's economy, contributing to approximately 15% of Malta's gross domestic product. The Malta Tourism Authority is responsible for overseeing all matters involving tourism, which falls under the responsibility of the minister for tourism, the environment and culture. AI models are being applied to big data in order to:

• identify industry trends and sentiment (ie, what tourists like and dislike) at scale;
• provide recommendations on places to visit and book; and
• enable hotels and vacation rental owners to deploy automated pricing solutions based on supply and demand.

In Malta, no regulatory changes have been discussed or implemented so far in terms of the tourism sector.

Real estate is another sector which is tackled in Malta's AI strategy. AI solutions are being used to increase the relevance of recommendations that users see on websites, display personalised advertising, identify when new properties come on the market, and automatically tag and classify property photos and listings.

4 Data protection and cybersecurity

4.1 What is the applicable data protection regime in your jurisdiction and what specific implications does this have for AI companies and applications?

As an EU member state, Malta's data protection regime comprises the GDPR and the local law which supplements it – namely, the Data Protection Act, Chapter 586 of the Laws of Malta, together with guidelines issued by the EU European Data Protection Board and the IDPC.

AI systems require colossal amounts of data in order to be properly trained to build their algorithmic models and achieve accurate results. Often, such data is personal data. When such reliance is specifically on personal data, the principles as outlined in the GDPR must be observed. Thus, given this heavy reliance on data, the implications of the GDPR on AI companies and applications which involve the use of personal data in particular are quite significant. In the first place, the GDPR generally restricts access to and collection of data. Second, data can be used only for its original intended purpose, thus restricting the reuse of data for novel purposes and the possibility of new value through combination of datasets. Under the GDPR, decisions that are taken solely in an automated manner must allow for human review of that decision if it significantly affects the data subject. Furthermore, the data subject has a right to an explanation as to how a decision was reached. These factors can render automation of processes impractical and costly, and many argue that this defeats the purpose of automated processes.

On a final note, AI companies and applications which involve the use of personal data must implement safeguards and data protection must be present by design and by default.

4.2 What is the applicable cybersecurity regime in your jurisdiction and what specific implications does this have for AI companies and applications?

AI and machine learning are playing an increasingly important role in cybersecurity, with the ability to analyse data from masses of cyber incidents and use this information to identify potential threats.

The Maltese National Cyber Security Steering Committee is responsible for overseeing and coordinating the implementation of the National Cyber Security Strategy (NCSS). Launched in 2016, the NCSS outlines six goals:

• establishing a government framework;
• combating cybercrime;
• strengthening national cyber defence;
• securing cyberspace;
• raising awareness and educating on cyber-security; and
• implementing national and international cooperation aimed to ensure effective consultation, cooperation and collaboration.

Malta maintains an established Critical Information Infrastructure Protection Directorate, which also serves as the national authority overseeing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security for network and information systems across the European Union. The oversight of the security of electronic communications networks and services is part of the regulatory remit of the Malta Communications Authority; whereas privacy and data protection aspects are overseen by the Office of the Information and Data Protection Commissioner. The Malta Information Technology Agency overseas the security of the government's technological infrastructure and establishes government policies in the cybersecurity space. Other relevant players include the entities entrusted with public security, such as the police and the army.

5 Competition

5.1 What specific challenges or concerns does the development and uptake of AI present from a competition perspective? How are these being addressed?

As mentioned above, large amounts of data are necessary to properly train AI models. Furthermore, personal data can be used to analyse, forecast and influence human behaviour – an opportunity that transforms such data and the outcomes of its processing into valuable commodities. Machine learning (ML) and AI are useful for businesses, as they significantly reduce the price of prediction, which benefits all businesses. The tech giants can develop these tools in-house from data they already possess. Thus, organisations which have control over large amounts of structured and unstructured data (personal or non-personal) are better placed to make the best use of the opportunities that AI and ML offer.

This raises a potential competition issue: companies which have a monopoly over collections of data could have an unfair competitive advantage, which could negatively affect future innovation and the shared benefits it would bring in a negative way, distorting the market structure towards anti-competitive practices. Regulation must ensure that there is open access to data streams to allow small businesses and other sectors to reap the benefits of AL and ML.

As part of the implementation of the Public-Sector Information Re-Use Directive, the Malta Information and Technology Agency published its National Data Strategy in 2016 with a holistic and comprehensive vision for the management of data across the whole public administration, set out as one of the pillars of the Digital Malta Strategy, and a vision for data to empower citizen and business applications. The National Data Strategy comprises a set of general principles and best practices that should guide future investments in this domain.

Another matter to be considered is that through ML, online platforms often use algorithms designed to adjust pricing automatically, rather than manually. This must be considered in light of the two-sided nature of digital platforms, given that platforms commonly afford preferential treatment to their own products over those of competitors.

The Competition Act (Chapter 379 of the Laws of Malta) regulates competition and provides for fair trading in Malta. While the Competition Act does not specifically target ML, AI and anti-competitive algorithms, the general provisions relating to prohibited agreements, prohibited practices and abuse of dominant position will still tend to apply.

6 Employment

6.1 What specific challenges or concerns does the development and uptake of AI present from an employment perspective? How are these being addressed?

One of the most debated ‘cons' of AI and automation generally is that as such systems become more sophisticated, less reliance on human labour may be required, with a resulting loss of employment. Various studies have been undertaken in relation to the potential impact that automation will have on the workforce.

A Strategy and Vision for Artificial Intelligence in Malta 2030 contains various measures to tackle the employment issue in a number of ways. First, the Maltese government intends to launch a project in order to understand and plan for the impact of technology and automation on the Maltese labour market. The strategy contains measures to equip the workforce with stronger digital competencies and new skills, such as by designing and launching a national reskilling programme to help vulnerable workers to develop new digital skills through the provision of short training courses and to support measures for on the-job training. Further support measures will be developed to help employers to invest more in on-the-job training and employees to undertake external training programmes. The strategy also contains actions to increase the number of graduates and postgraduates with AI-related degrees.

7 Data manipulation and integrity

7.1 What specific challenges or concerns does the development and uptake of AI present with regard to data manipulation and integrity? How are they being addressed?

A Strategy and Vision for Artificial Intelligence in Malta 2030 discusses initiatives which will be taken in terms of AI and data manipulation/integrity. One of these initiatives involves the introduction of a legal notice in order to regulate the secondary processing of personal data in the health sector, as allowed for and specified within the GDPR. The legal notice will lay out conditions and safeguards, as well as providing for a clear approval mechanism for health research through Malta's Health Ethics Committee.

The IDPC, as the national data protection authority, will also be setting up a data sandbox to support organisations that need to use personal data in the process of developing or testing innovative products and services in the specific area of AI. Data sandbox participants will be assisted by the IDPC on how to apply data protection rules and requirements to their projects, and will be given assurances (to the extent possible) that such projects do not infringe the provisions of the GDPR. The scope of the data sandbox is to give a certain level of comfort from enforcement action.

Malta's Ethical AI Framework also delves into the issues of privacy and data governance which arise from AI technologies. One challenge which could arise in terms of AI and data protection is that when a company uses AI to make a significant and important decision about one's data, this could pose certain risks to that data. To combat this challenge, the trustworthy AI requirements mentioned in the framework are intended to be continuously evaluated and addressed throughout the AI system's lifecycle.

8 AI best practice

8.1 There is currently a surfeit of ‘best practice' guidance on AI at the national and international level. As a practical matter, are there one or more particular AI best practice approaches that are widely adopted in your jurisdiction? If so, what are they?

At a national level, there are two best practice guidance documents on AI:

• Malta's Ethical AI Framework, published in October 2019; and
• A Strategy and Vision for Artificial Intelligence in Malta 2030, also published in October 2019.

The framework sets out four ethical principles for trustworthy AI:

• Human autonomy: Humans interacting with AI systems must enjoy full and effective self-determination.
• Harm prevention: AI systems must not cause harm at any stage of their lifecycle to humans, the natural environment or other living beings.
• Fairness: The development, deployment, use and operation of AI systems must be fair.
• Explicability: End users and other members of the public should be able to understand and challenge the operation of AI systems as required for the particular use case.

The achievement of these objectives is already embedded, in part, in existing legal and regulatory requirements, and therefore they should be considered in relation to mandatory compliance required as a function of laws and regulations, as well as enhanced ethical expectations by stakeholders.

8.2 What are the top seven things that well-crafted AI best practices should address in your jurisdiction?

Well-crafted AI best practices should essentially translate the four ethical principles outlined in question 8.1 into specific requirements that can be measured and evaluated. The framework extracts the following requirements in terms of best practices for the achievement of trustworthy AI:

• human agency (including human oversight);
• privacy and data governance (including access to quality data and integrity);
• explainability and transparency;
• wellbeing (including sustainable and environmentally friendly AI, and democracy);
• accountability (including auditability, redress, minimisation and reporting of negative impacts);
• fairness and lack of bias; and
• performance and safety (including accuracy, reliability and reproducibility, resilience to attack, security fallback plans and general safety).

8.3 As AI becomes ubiquitous, what are your top tips to ensure that AI best practice is practical, manageable, proportionate and followed in the organisation?

In the short term, AI will touch every aspect of our lives and all organisations will become reliant on AI to some extent. Given both the beneficial and the harmful aspects of this technology, the ethical management and use of AI systems is fundamental. At the same time, it is important not to overburden the use of AI in such a way as would render it impractical or diminish its benefits. The framework suggests the following in terms of governance measures:

• introducing ethical AI considerations as corporate values;
• ensuring clear roles and responsibilities for the ethical deployment of AI;
• establishing the role of an ethics officer or assigning responsibility and accountability to a senior executive of the organisation for the lawful and ethical design, operation and use of AI systems;
• establishing a cross-disciplinary AI advisory board or similar mechanism to monitor and assist an organisation in developing appropriate responses to AI ethical and legal obligations;
• bringing in external guidance or establishing auditing processes to oversee ethics and accountability, in addition to internal initiatives; and
• taking out an insurance policy as a risk mitigation measure against potential damage from the AI system, or considering a self-insurance mechanism whereby the AI designer or operator segregates a portion of funds as insurance.

9 Other legal issues

9.1 What risks does the use of AI present from a contractual perspective? How can these be mitigated?

AI contracting software has the potential to improve how businesses contract and manage their contracts, thus increasing productivity and efficiency. One example of how AI can be used is for the legal review of contracts. Software for reviewing legal documents has been around for a while; however, its functionality was often limited to storing and organising such contracts. AI boosts such functions by, for instance, recognising the type of contract involved based on pattern recognition, and even through prediction, data extraction and analytics. AI tools serve as a check that allows for more efficient review and identification of potential errors before contracts are finalised. Based on this understanding of how AI can facilitate contract review and contract management, the risks imposed by the use of AI as currently foreseen are minimal.

9.2 What risks does the use of AI present from a liability perspective? How can these be mitigated?

Currently, across the globe, one of the pertinent discussions relating to AI systems concerns liability – a serious issue which requires careful consideration. As AI systems become more autonomous, this inevitably raises questions about responsibility for the actions of AI systems. By way of illustration, should a driverless car cause an accident, liability for the accident must be attributed – someone must be held responsible. This could be the manufacturer, the user of the system or other intermediaries. Liability could also be joint; however, liability could also be attributed directly and solely to the system itself. Indeed, in early 2017, the European Parliament Committee on Legal Affairs (JURI) discussed the possibility of formulating a legal framework for robots, within which the concept of creating a separate ‘electronic personality' for ‘autonomous' robots (‘autonomy' being considered as "the ability to take decisions and implement them in the outside world, independently of external control or influence") was discussed, for the limited purpose of attributing liability to the robot. At the same time, JURI's report specified that this concept should in no way restrict the recoverable damages and proposed some additional recommendations for consideration, such as the establishment of a compulsory insurance scheme and a compensation fund to which all parties would contribute.

These suggestions have met with significant criticism and the current trend of thinking appears to be more in line with simply relying on current liability frameworks, the concept of strict liability (ie, which does not depend on actual negligence or intent to harm), product liability and the current application of the Machinery Directive (transposed into Maltese law through the Machinery Regulations). Nonetheless, these ‘real-world' considerations must be addressed, as liability issues in relation to AI systems will only become more common.

The risks which are to be considered include:

• the accuracy of AI systems outputs and performance measures;
• security risks aggravated by AI;
• the coherence of AI decisions to natural persons; and
• human biases and discrimination in AI systems.

A Strategy and Vision for Artificial Intelligence in Malta 2030 provided for the establishment of the Law Review Commission, which will have the mandate to carry out a gap analysis of local legislation and identify where the development of local regulations is needed.

9.3 What risks does the use of AI present with regard to potential bias and discrimination? How can these be mitigated?

The risks of potential bias and discrimination in AI lies in the fact that people input the data used to building AI tools. The fact that AI systems learn from data does not guarantee that their outputs will be free of human bias or discrimination. The data used to train and test AI systems, and the way in which they are designed and used, are all factors that may lead AI systems to treat people less favourably.

Malta's Ethical AI Framework discusses the adoption of fair AI which lacks bias and recommends that mechanisms be implemented for individuals to flag issues about bias, discrimination or poor performance of AI systems (in relation to end users as well as indirectly affected individuals). Such mechanisms must be clearly communicated to relevant stakeholders on how and with whom they can raise such issues. The requirement of ‘explainable AI' within the framework also helps to mitigate the risk of bias by ensuring that it is possible to understand the ‘reasoning' behind a decision taken by AI systems. The General Data Protection Regulation also implements controls in relation to automated decision making.

10 Innovation

10.1 How is innovation in the AI space protected in your jurisdiction?

As explained in question 1, the Maltese government set up the Malta.AI Taskforce to develop a national AI strategy with the aims of:

• devising a holistic approach to the AI sector;
• finding ways to create a sustainable local engine for growth;
• examining the risks of AI without hindering innovation and economic development; and
• creating a new sector for investment in Malta.

This strategy aims to position Malta as the ultimate AI launchpad: a forum in which local and foreign companies and entrepreneurs can develop, prototype, test and scale AI.

Innovation is at the heart of the strategy, which addresses three aspects of innovation and AI:

• investment and economic activity from local and foreign businesses;
• increased expenditure on research and development (R&D); and
• the creation of new start-up enterprises.

Malta will seek to attract and develop talent, drive investment and set up a sustainable innovation ecosystem that allows the AI sector to grow. An interface has been created for interested parties to submit a proposal and request a meeting with government officials via the Malta.AI website. Plans are also in place for the development of a digital collaboration platform, allowing the government, research institutes and the private sector to publish project profiles, collaboration requests, innovation challenges and requests for information. The collaboration platform will be the digital hub of Malta's AI activity, showcasing the volume of AI opportunities in Malta and facilitating opportunities for collaboration between local and international start-ups, corporates and research organisations.

The development of new emerging technological sectors such as AI has been made a national priority of the Maltese government. The field of R&D is a major driver of innovation and helps new products and services to be brought to market. Malta is assuming a multi-pronged approach to increase R&D activity in AI.

10.2 How is innovation in the AI space incentivised in your jurisdiction?

The Maltese government has, through the national AI strategy, paved the way for the provision of several incentives to AI-related entities, including the following:

• a patent box regime (deduction), which enables qualifying beneficiaries to benefit from a deduction against taxable income or gains of up to 95% of the gross revenue from their qualifying IP assets;
• equity-based risk capital for Maltese start-ups and scale-ups, structured through co-investments;
• tax credits for investors in return for investment in qualifying Maltese start-ups or early stage companies;
• various incentives through Malta Enterprise, the government agency responsible for inward investment and support to Maltese businesses;
• the revision of Malta's tax legislation to remove capital gains tax and duty on documents relating to the transfer of shares; and
• the launch of two new types of visas which provide a simplified, fast-track procedure for start-up founders, investors and their families from outside the European Union and European Free Trade Area to reside and work in Malta:
• • a start-up visa for aspiring entrepreneurs who intend to develop an innovative business in Malta; and
  • an investor visa for investors who provide business angel and venture capital financing to Maltese start-ups.

Public-private foundation Tech.mt has been tasked with promoting Malta as a leading global hub for AI. Through Tech.mt, the government will be providing €1 million per annum of funding to enhance the visibility of Malta in this regard.

11 Talent acquisition

11.1 What is the applicable employment regime in your jurisdiction and what specific implications does this have for AI companies?

In terms of Maltese labour and employment law, the applicable laws and regulations are as follows:

• Primary legislation: The most notable of these primary legislative sources include:
• • the Constitution of Malta;
  • the Employment and Industrial Relations Act (EIRA);
  • the Employment Commission Act;
  • the Employment and Training Services Act; and
  • EU regulations and directives which apply in virtue of the doctrine of direct effect.
• Secondary legislation: Regulations made under the EIRA, the majority of which serve to implement EU regulations and directives, fleshing out the basic legal framework provided by the EIRA. These include wage regulation orders – administrative regulations which regulate certain conditions of employment for specific sectors. At present, there are 31 different work regulation orders in force.
• Public Service Management Code: Members of the public service have their conditions of employment regulated by means of the Public Service Management Code, which was introduced in 2002.
• Collective agreements: These are enterprise-specific agreements which regulate the conditions of employment of around one-third of the total gainful employment in the private sector.

The body of labour and employment laws in Malta has not been amended in relation to AI. Thus, as matters currently stand, the abovementioned employment regime will continue to apply, even in AI companies. Industrial disputes which may arise in this regard would fall under the exclusive jurisdiction of the Industrial Tribunal, in terms of the EIRA.

11.2 How can AI companies attract specialist talent from overseas where necessary?

Malta intends to position itself as a leading hub for global start-up activity. The country already has a sizeable number of foreign entrepreneurs, companies and workers in digital and knowledge-based industries – mostly from the EU countries of Sweden, the United Kingdom, Germany, Italy, France and Spain. Malta will now implement further measures to:

• make it easier for non-European Economic Area nationals looking to set up or invest in business locally; and
• incentivise workers with specialised skills that are in high demand both locally and globally to move to Malta.

In A Strategy and Vision for Artificial Intelligence in Malta 2030, certain initiatives in terms of AI in the employment sector were discussed. One of the initiatives which Malta is discussing is the launch of a start-up visa for aspiring entrepreneurs who intend to develop an innovative business in Malta (see question 10.2). The government will also shortly re-introduce the Qualifying Employment in Innovation and Creativity (Personal Tax) Scheme. This allows qualifying employees who work in a wide range of AI-related roles and earn over €52,000 per annum to benefit from a reduced flat rate of personal income tax at 15% for a three-year period.

Malta also recently introduced the Key Employee Initiative, which provides third-country nationals who will be employed in a managerial or highly technical post at a salary above €30,000 per annum with a fast-tracked work and residence permit, to be processed within five working days.

12 Trends and predictions

12.1 How would you describe the current AI landscape and prevailing trends in your jurisdiction? Are any new developments anticipated in the next 12 months, including any proposed legislative reforms?

The Malta.AI Taskforce has been set up in order to formulate a national AI strategy which would position Malta as the ultimate AI launchpad: a forum in which local and foreign companies and entrepreneurs can develop, prototype, test and scale AI. A number of measures within the strategy form part of a project plan which will now be implemented in the coming months. The aim is to build a vibrant start-up community and encourage its members to collaborate with local business looking to infuse AI into their operations.

13 Tips and traps

13.1 What are your top tips for AI companies seeking to enter your jurisdiction and what potential sticking points would you highlight?

The Maltese government aims to attract and welcome AI-related companies of all sizes across all industries, from start-ups to scale-ups and established global tech leaders. Companies wishing to benefit from the opportunities which Malta provides should ensure that they are willing to develop their technology in an ethical manner, in line with Malta's Ethical AI Framework, and should be mindful and aim to comply with the control practices detailed therein. Certification of AI technologies under the framework would provide the technology with a valued stamp of approval.

It should be noted, however, that Malta is an EU member state and as such is subject to the rigorous requirements of the GDPR in terms of data privacy. The restrictions within the GDPR may be quite daunting for AI companies and can occasionally be one reason why developers of AI systems prefer to establish themselves outside Europe. That said, compliance with ethical principles and with data privacy requirements is certainly a valuable consideration for entities considering the uptake of AI technologies; and thus, in our opinion, Malta's ethical principles and data privacy laws are more of a benefit than a ‘trap'.

Co-Authored by Nina Fauser.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.