Malta accessibility law: LN 138/2018 + EAA explained

Who has to comply

Public-sector since 2018; consumer services from 28 June 2025.

Malta is the EU's smallest member state by population but hosts a disproportionately large online-gaming, betting and fintech sector whose consumer-facing services reach far beyond the island. Under the EAA-implementing act extending LN 138/2018, a foreign store selling to Maltese consumers is covered on the country-of-consumption basis. Because English is an official language, Maltese-facing sellers have no localisation excuse, though a bilingual Maltese-and-English accessibility statement is the expected norm.

What the law actually requires

The technical baseline is WCAG 2.1 Level AA via EN 301 549. EN 301 549 references WCAG 2.1 Level AA in full and adds a few requirements specific to mobile apps and documents. Beyond the technical bar, Malta requires the following operational items, which auditors check first because they are simple to verify:

• EN 301 549 / WCAG 2.1 AA

• Bilingual statement (Maltese + English)

Penalties and how enforcement actually works

Administrative penalties under the EAA-implementing act.

Enforcement is led by MITA (Malta Information Technology Agency), which runs the public-sector accessibility regime and extends oversight to covered private services. Malta's model is centralised and largely complaint-driven, with administrative penalties under the EAA-implementing act. Given the small administration and the concentration of covered services in remote gaming and fintech, enforcement attention naturally follows those visible, high-traffic operators, with the bilingual statement and feedback channel as the first things checked.

Practical first steps for a Malta site

If you are starting now and want to land before enforcement, run an automated audit, fix the high-impact issues (contrast, labels, keyboard, focus), publish an accessibility statement, and set up a feedback inbox. That sequence covers 80% of what auditors look for in a first sweep.

• Run a baseline scan to know your current score

• Fix critical and serious issues in priority order — these are the ones cited in complaints

• Publish a public accessibility statement on a stable URL (Malta regulators expect this discoverable)

• Add a feedback channel and answer within the country-specified window

• Re-scan after every major release; track regressions