The report, quoted by Maltese media, said the state had failed to recognise risks to the reporter’s life and take reasonable steps to avoid them.
Caruana Galizia died in a car bomb attack near her home in October 2017.
An investigation led to PM Joseph Muscat’s resignation in 2019 after his close associates were implicated.
However, he has denied corruption allegations.
Called a “one-woman Wikileaks”, Caruana Galizia uncovered networks of corruption in the country and abroad.
She was a harsh critic of government. In 2017 she effectively triggered an early election by publishing allegations linking Mr Muscat to the Panama Papers scandal, which exposed the use of tax havens by the rich.
Caruana Galizia’s family sought an independent public inquiry into her murder.
Mr Muscat gave it the go-ahead, a few months before he resigned.
In its conclusions, written up in a 437-page report, it said the state had “created an atmosphere of impunity, generated by the highest echelons”.
So far only a handful of individuals have been charged.
In February, one of three men accused of murdering Caruana Galizia pleaded guilty and was jailed for 15 years.
The others are yet to go to trial.
A fourth person, Maltese businessman Yorgen Fenech, has also been charged with complicity over the killing – an allegation he denies.
He was arrested in November 2019 as he tried to sail away from Malta on a yacht, and is now awaiting trial.
His mother had been killed “because she stood between the rule of law and those who sought to violate it”, he said.