How do data centre permits and single information points work in Malta under CADA?

Under the proposed Cloud and AI Development Act (CADA), Malta would be required to designate one or more Single Information Points (SIPs) to assist data ce

Summary Under the proposed Cloud and AI Development Act (CADA), Malta would be required to designate one or more Single Information Points (SIPs) to assist data centre operators with all authorisations for projects located within designated data centre acceleration zones. These SIPs would coordinate procedures ranging from spatial planning to grid connections, potentially leveraging existing infrastructure established under the Gigabit Infrastructure Act (Regulation (EU) 2024/1309). Crucially, Article 13 would oblige Malta to issue an aggregated baseline permit for each zone, covering zone-level authorisations and excluding only installation-specific permits. This framework would cap the permit-granting procedure at 12 months for projects within these zones, significantly reducing administrative uncertainty for operators.

Detail

The proposed Cloud and AI Development Act (CADA), COM(2026) 502 final, introduces a harmonised regulatory framework designed to accelerate the deployment of data centre capacity across the European Union. For Malta, as for all Member States where data centre capacity is being deployed, the proposal mandates specific procedural reforms to how data centre permits are granted and managed. These reforms specifically target projects located within designated "data centre acceleration zones." The core of this administrative simplification lies in the interplay between Article 12 (Single Information Points) and Article 13 (Facilitating administrative and permit-granting processes).

The Obligation to Designate Single Information Points (Article 12)

Article 12(1) of the proposal explicitly obliges Malta to designate one or more single information points for data centre operators of data centre projects in acceleration zones. The text states: "The data centre operator shall have the right, upon request, to be assisted by a single information point throughout the entire lifecycle of the data centre project in an acceleration zone with respect to all authorisations required for the deployment of the data centre."

This designation is a mandatory requirement for Member States where data centre capacity is being deployed. The primary function of the SIP is to act as a centralised coordination hub. Rather than navigating a fragmented landscape of disparate municipal, regional, and national authorities, the operator engages with the SIP, which then coordinates the necessary interactions with other bodies.

The scope of assistance provided by the SIP is broad. Article 12(2) outlines that the role of the single information point may include, among other things, coordinating, facilitating, monitoring, and sharing information on procedures relating to:

Spatial planning and building permits.
Environmental assessments, in accordance with the upcoming Regulation on speeding-up environmental assessments (referenced as Regulation (EU) 2026/XXX in the proposal).
Authorisations regarding water abstraction, wastewater discharge, and heat utilisation and recovery.
Compliance with applicable administrative and reporting obligations.
Information to the public, aimed at increasing public acceptance of the data centre project.
Applications for connection to electricity, heat, or communications networks.

Crucially, the SIP also assists in assessing whether a data centre project may qualify as a "strategic project" under Article 14, which can unlock further support measures and accelerated timelines.

Interaction with Existing Gigabit Infrastructure Act SIPs

CADA recognises that many Member States, including Malta, have already established single information points under other EU legislation, most notably the Gigabit Infrastructure Act (Regulation (EU) 2024/1309). Article 12(1) explicitly states: "The Member States may designate for this purpose a single information point established under Regulation (EU) 2024/1309."

This provision allows Malta to avoid creating redundant administrative structures. If the existing SIP under the Gigabit Infrastructure Act possesses the necessary capacity and mandate, it can be upgraded or integrated to fulfil the CADA requirements. The text clarifies that "The functions, procedures and mechanisms applicable to such single information points under Regulation (EU) 2024/1309, including those relating to digital access, administrative coordination and dispute settlement, shall also apply."

This integration is significant for Maltese operators. It suggests that the digital platforms, dispute resolution mechanisms, and administrative workflows already established for gigabit network deployment can be leveraged for data centre projects, provided they are situated within an acceleration zone. This creates a unified entry point for both connectivity infrastructure and compute infrastructure, reducing the learning curve for operators and ensuring consistency in administrative expectations.

Aggregated Baseline Permits and Permitting Timelines (Article 13)

While the SIP handles coordination, Article 13 addresses the substantive permitting process. It introduces the concept of an "aggregated baseline permit" for each designated acceleration zone. Article 13(2) requires Malta to prepare and issue this permit, which "shall cover the permits and administrative authorisations required for the data centre projects located within the acceleration zone, excluding installation-specific permits."

This is a transformative mechanism for developers. Instead of each individual data centre project undergoing a full environmental and spatial planning assessment from scratch, the acceleration zone itself undergoes a comprehensive assessment. Article 13(3) mandates that before issuing the aggregated baseline permit, Member States shall carry out all necessary procedures and assessments, including any relevant environmental assessments, planning procedures and evaluations applicable at the level of the acceleration zone.

Once the aggregated baseline permit is issued, data centre projects within that zone are only required to obtain additional permits for activities falling outside the scope of the baseline permit. Article 13(4) states: "Data centres deployed in acceleration zones shall be required to obtain additional permits only for activities falling outside the aggregated baseline permit referred to in paragraph 2."

Article 13(5) further tightens the timeline, stating that "The permit-granting procedure for data centre projects deployed in data centre acceleration zones shall not exceed 12 months, from the moment a comprehensive application has been submitted." This strict deadline applies to the entire process, providing greater certainty for investors. The text notes that this time limit is without prejudice to any shorter time limits set by Member States, encouraging Malta to potentially accelerate this further if national law allows.

SME Support and Accessibility

Recognising the varying resources available to different operators, Article 12(4) imposes a specific duty on the single information point: "When providing the administrative support and the assistance referred to in this Article, the single point of contact shall pay particular attention to SMEs and, where appropriate, establish a dedicated channel for communication with SMEs to provide guidance and respond to queries related to the implementation of this Regulation."

For Maltese SMEs and smaller cloud providers, this provision ensures that the complexity of the CADA framework does not disproportionately hinder market entry. The SIP is not just a passive information repository but an active support mechanism, required to tailor its assistance to the needs of smaller entities.

What this means for you

For CTOs, architects, and SMEs evaluating the practical impact of CADA in Malta, the introduction of single information points and aggregated baseline permits represents a shift from fragmented, unpredictable permitting to a streamlined, time-bound process.

Single Point of Contact: You would no longer need to independently navigate multiple municipal and national authorities for each permit. The designated SIP in Malta would serve as your primary liaison for all authorisations related to your data centre project in an acceleration zone.
Faster Time-to-Market: With the 12-month maximum permitting timeline under Article 13, project planning would become more predictable. The aggregated baseline permit means that many environmental and spatial assessments would be pre-completed at the zone level, reducing the scope of your individual application.
Leveraging Existing Infrastructure: If Malta has already implemented a SIP under the Gigabit Infrastructure Act, you could expect to use familiar digital platforms and procedures. This would reduce administrative overhead and allow your teams to focus on technical deployment rather than bureaucratic navigation.
SME-Specific Guidance: If you represent a small or medium-sized enterprise, you would have a right to dedicated support from the SIP. You should request tailored guidance on compliance and procedural steps, as the SIP would be mandated to facilitate this.
Strategic Project Assessment: The SIP would also assist in determining if your project qualifies as a "strategic project" under Article 14. This designation could provide additional benefits, including potential state aid and further accelerated processing, so early engagement with the SIP would be crucial.

Common misconceptions

Misconception 1: The SIP replaces the need for individual permits. The SIP does not grant permits; it coordinates and assists in the process. You would still need to obtain all necessary authorisations, but the SIP would help manage the complexity and timeline. Furthermore, the aggregated baseline permit covers zone-level authorisations, but you would still need installation-specific permits for elements not covered by the baseline.

Misconception 2: CADA creates a new, separate SIP for data centres. CADA allows Member States to designate existing SIPs, such as those under the Gigabit Infrastructure Act. Malta would not be required to create a wholly new administrative body if the existing infrastructure can be adapted. This avoids duplication and leverages established workflows.

Misconception 3: The 12-month permitting timeline applies to all data centres in Malta. The 12-month maximum timeline under Article 13 specifically applies to data centre projects deployed within designated data centre acceleration zones. Projects outside these zones would not benefit from the aggregated baseline permit or the strict 12-month deadline, although Malta may choose to apply similar standards more broadly.

Misconception 4: SMEs are exempt from the permitting process. SMEs are not exempt from obtaining permits. However, Article 12(4) mandates that the SIP provide particular attention and dedicated communication channels to SMEs. This means you would have a right to enhanced support and guidance, but you must still comply with all technical and regulatory requirements.

This is general information about a draft EU regulation, not legal advice.