S.L. 591.2 Art. 6Designation, functions and powers of the Authority as the national cybersecurity certification authority.

(1) For the purposes of Article 58 of Regulation (EU)

2019/881, the Authority shall be designated as the national cybersecurity certification authority responsible for the supervisory tasks in Malta and shall have all the functions prescribed in Regulation

2019/881, including the function of:

(a) supervising and enforcing rules included in European cybersecurity certification schemes in accordance with Article 54(1)(j) of Regulation (EU) 2019/881, for the monitoring of compliance of ICT products, ICT services, ICT processes and managed security services with the requirements of the European cybersecurity certificates that have been issued in Malta, in cooperation with other relevant market surveillance authorities;

(b) monitoring compliance with and enforcing the obligations of manufacturers or providers of ICT products, ICT services, ICT processes or managed security services that are established in Malta and that carry out conformity self-assessment, and shall, in particular, monitor compliance with and enforce the obligations of such manufacturers or providers specified in Article 53(2) and (3) of Regulation (EU) 2019/881 and the corresponding European cybersecurity certification scheme;

(c) without prejudice to Article 60(3) of Regulation

(EU) 2019/881, actively assisting and supporting the national accreditation bodies in the monitoring and supervision of the activities of conformity assessment bodies, for the purposes of Regulation (EU) 2019/881;

(d) monitoring and supervising the activities of the public bodies accredited as conformity assessment bodies in accordance with Article 56(5) Regulation (EU) 2019/881;

(e) where applicable, authorising conformity assessment bodies in accordance with Article 60(3) of the Regulation (EU) 2019/881 and restrict, suspend or withdraw existing authorisation where conformity assessment bodies infringe the requirements of Regulation (EU) 2019/881 and these regulations;

(f) handling complaints by natural or legal persons in relation to European cybersecurity certificates issued by national cybersecurity certification authorities or to European cybersecurity certificates issued by conformity assessment bodies in accordance with Article 56(6) of Regulation (EU) 2019/881 or in relation to EU statements of conformity issued under Article 53 of Regulation (EU) 2019/881, and shall investigate the subject matter of such complaints to the extent appropriate, and shall inform the complainant of the progress and the outcome of the investigation within a reasonable period;

(g) providing an annual summary report on the activities conducted under paragraphs (b), (c) and (d) or under sub-regulation (2) to ENISA and the ECCG;

(h) cooperating with other national cybersecurity certification authorities or other public authorities, including by sharing information on the possible non-compliance of ICT products, ICT services, ICT processes and managed security services with the requirements of these regulations and Regulation (EU) 2019/881 or with the requirements of specific European cybersecurity certification schemes;

(i) monitoring relevant developments in the field of cybersecurity certification;

(j) participating in the ECCG in an active, effective, efficient and secure manner for the effective implementation of Regulation (EU) 2019/881;

(k) cooperating with other national cybersecurity certification authorities and with the European Commission, in particular, by exchanging information, experience and good practices as regards cybersecurity certification and technical issues concerning the cybersecurity of ICT products, ICT services, ICT processes and managed security services; and

(l) participating in peer reviews with other national cybersecurity certification authorities within the European Union in accordance with Regulation (EU) 2019/881.

(2) Without prejudice to the Authority’s powers under the Act, for the purpose of the implementation of Regulation (EU) 2019/ 881, the Authority shall be empowered to:

(a) request conformity assessment bodies, European cybersecurity certificates’ holders and issuers of EU statements of conformity to provide any information it requires for the performance of its tasks;

(b) carry out investigations, in the form of audits of conformity assessment bodies, European cybersecurity certificates’ holders and issuers of EU statements of conformity, for the purpose of verifying their compliance with