S.L. 460.41 Art. 41Administrative Review Tribunal. 

(1) Any decision taken by the Committee in accordance with this order may be appealed within twenty (20) days from the service of the decision by means of an application filed before the Administrative Review Tribunal.

(2) Any party to an appeal who feels aggrieved by a decision of the Administrative Review Tribunal may, on a question of law, appeal from such decision by filing an application to the Court of

Appeal constituted in accordance with article 41(9) of the Code of

Organization and Civil Procedure. Such application shall be filed within twenty (20) days from the date of the decision of the Administrative Review Tribunal.

(3) The provisions of article 466 of the Code of Organization and Civil Procedure shall, apply to the mutatis mutandis, administrative penalties established by this order.

42. Deleted by Legal Notice 89 of 2026.

43. Deleted by Legal Notice 89 of 2026.

FIRST SCHEDULE Substituted  by: Sectors, Subsectors, L.N. 89 of Types of Entities of High Criticality and Competent 2026. Authorities (in accordance with article 4)

Sector Subsectors Type of entity/entities

CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(a) Electricity (i) Electricity undertakings as defined in Article 2, point (57), of Directive (EU) 2019/944 of the European Parliament and of the Council, which carry out the function of "supply" as defined in Article 2, point (12), of said Directive;

(ii) Distribution system operators as defined in Article 2, point (29), of Directive (EU) 2019/944;

(iii) Transmission system operators as defined in Article 2, point (35), of Directive (EU) 2019/944; CIP Department as the national supervisory authority.

(iv) Producers as defined in Article 2, point (38), of Directive

(EU) 2019/944;

(v) Nominated electricity market operators as defined in Article 2, point (8), of Regulation (EU) 2019/943 of the European Parliament and of the Council;

(vi) Market participants as defined in Article 2, point (25), of Regulation (EU) 2019/943 providing aggregation, demand response or energy storage services as defined in Article 2, points (18), (20) and (59), of Directive (EU) 2019/944;

(vii) Operators of a recharging point that are responsible for the management and operation of a rechargingpoint, which providesa recharging service to end users, including in the name and on behalf of a mobility service provider.

(b) District heating (i) Operators of district heating or district cooling as defined in CIP Department as the and cooling Article 2, point (19), of Directive (EU)2018/2001 of the European national supervisory authority. Parliament and of the Council.

(c) Oil (i) Operators of oil transmission pipelines;

(ii) Operators of oil production, refining and treatment facilities, CIP Department as the storage and transmission; national supervisory authority.

(iii) Central stockholding entities as defined in Article 2, point (f), of Council Directive 2009/119/EC;

(d) Gas (i) Supply undertakings as defined in Article 2, point (8),ofDirective2009/73/ECoftheEuropean Parliament of the Council;

(ii) Distribution system operators as defined in Article of Directive 2009/73/EC;

(iii) Transmission system operators as defined in Article 2, point (4), of Directive 2009/73/EC;

(iv) Storage system operators as defined in Article 2, Directive 2009/73/EC;

(v) LNG system operators as defined in Article 2, Directive 2009/73/EC;

(vi) Natural gas undertakings as defined in Article 2, Directive 2009/73/EC;

(vii) Operators of natural gas refining and treatment

(e) Hydrogen (i) Operators of hydrogen production, storage and operators. CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

(a) Air (i) Air carriers as defined in Article 3, point (4), of Regulation

(EC) No 300/2008 used for commercial purposes;

(ii) Airport managing bodies as defined in Article 2, point (2), of CIP Department as the Directive 2009/12/EC of the European Parliament and of the national supervisory authority. Council, airports as defined in Article 2, point (1), of said Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council, and entities operating ancillary installations contained within airports;

(iii) Traffic management control operators providing air traffic control (ATC) services as defined in Article 2, point (1), of Regulation (EC) No 549/2004 of the European Parliament and of the Council.

(b) Rail (i) Infrastructure managers as defined in Article 3, point (2), of Not applicable. Directive 2012/34/EU of the European Parliament and of the Council;

(ii) Railway undertakings as defined in Article 3, point (1), of Directive2012/34/EU and operators of service facilities as defined in Article 3, point (12), of said Directive.

(c) Water (i) Inland, sea and coastal passenger and freight water transport CIP Department as the companies, as defined for maritime transport in Annex I to national supervisory authority. Regulation (EC)No725/2004,not including theindividualvessels operated by those companies.

(ii) Managing bodies of ports as defined in Article 3, point (1), of Directive 2005/65/EC, including their port facilities as defined in Article 2, point (11), of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports

(iii) Operators of vessel traffic services (VTS) as defined in Article 3, point (o), of Directive 2002/59/EC of the European Parliament and of the Council.

(d) Road (i) Road authorities as defined in Article 2, point Commission Delegated Regulation (EU) 2015/962 responsible traffic management control, excluding public entities traffic-management or the operation of intelligent systems is a non-essential part of their general activity;

(ii) Operators of Intelligent Transport Systems as Article 4, point (1), of Directive 2010/40/EU of Parliament and of the Council.

(e) Public Transport (i) Public service operators as defined in Article 2, point (d), of Regulation (EC) No 1370/2007 of the European Parliament and of the Council.