The EU AI Act in Cyprus

Per Cyprus - AI Regulation Implementation (2024/1689)

• Deputy Ministry of Research, Innovation and Digital Policy (DMRID) — National coordinator for AI Act implementation; representative to the European Artificial Intelligence Board; policy and coordination lead
• Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR) / Commissioner of Communications — Notifying Authority; Market Surveillance Authority; Single Point of Contact; communications and cybersecurity liaison
• Office of the Commissioner for Personal Data Protection (Cyprus) — Market Surveillance Authority (for specified Annex III categories); enforcement of data‑protection-related prohibited practices within its remit; DPIA and GDPR coordination
• Commissioner for Administration and the Protection of Human Rights (Ombudsman) — Oversight and protection of fundamental rights; part of the national list under Article 77
• Attorney-General of the Republic — Legal adviser to the State and part of the national list to protect fundamental rights under Article 77

Per Cyprus - Research and Innovation Strategy

• Deputy Ministry of Research, Innovation and Digital Policy — Policy lead and strategic oversight; responsible for publishing the Strategy and coordinating implementation.
• Research and Innovation Foundation (RIF) — Operational implementation, funding programmes, administration of competitive calls and monitoring of funded projects.

Per Cyprus - Digital Skills Action Plan

• Deputy Ministry of Research, Innovation and Digital Policy — Coordinator and lead implementing authority
• Human Resources Development Authority (HRDA) — Managing and funding vocational and upskilling programmes
• Cyprus Academy of Public Administration — Public sector training partner for government staff and managers
• Digital Security Authority / National Cybersecurity Coordination Centre (NCC-CY) — Cybersecurity training and capacity building partner

Per Cyprus - Digital Transformation Strategy

• Deputy Ministry of Research, Innovation and Digital Policy (DMRID) — Coordinating authority and implementer of the Digital Strategy; portfolio oversight and reporting.
• Office of the Commissioner for Personal Data Protection — National supervisory authority for data protection, enforcement of GDPR compliance for Strategy projects.
• Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR) — Regulator for electronic communications and postal services; oversees telecoms compliance and market regulation.

Per Cyprus - National AI Strategy

• Department of Electronic Communications (DEC) — Deputy Ministry of Research, Innovation and Digital Policy — Primary coordinating authority for the strategy's publication and initial implementation oversight
• Ministry of Transport, Communications and Works (MTCW) / Government of Cyprus — Sponsoring ministry for the Department of Electronic Communications and initial publisher of the strategy
• Research and Innovation Foundation (RIF) — National funding agency expected to coordinate competitive R&D and innovation funding aligned to the strategy
• Cyprus Organisation for Standardisation (CYS) — Coordinate national standardisation activities and representation to international standardisation bodies on AI topics

Per Cyprus - AI Regulation Implementation (2024/1689)

• Prohibited AI practices (Article 5) subject to administrative fines up to EUR 35,000,000 or 7% of total worldwide annual turnover, whichever is higher (Member States must set implementing penalty law).
• Non-compliance with provider/deployer/importer/distributor obligations (non-Article 5 breaches) subject to administrative fines up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher.
• Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities subject to fines up to EUR 7,500,000 or 1% of total worldwide annual turnover, whichever is higher.
• National corrective measures may include warnings, orders to bring systems into compliance, suspension of placing on the market, product recall or withdrawal and temporary bans.
• National penalty rules to be notified to the European Commission by Cyprus prior to the AI Act application date.

Per Cyprus - Research and Innovation Strategy

• Repayment or clawback of grant funding in cases of material non-compliance with grant agreements.
• Suspension or termination of funding where progress milestones are not met.
• Exclusion from future national funding competitions for serious or repeated breaches.
• Administrative sanctions consistent with public financial management rules and RIF administrative procedures.
• Audit findings referred to national audit or legal authorities where fraud or misuse of funds is identified.

Per Cyprus - Digital Skills Action Plan

• No criminal sanctions under the Action Plan itself (it is a strategy).
• Administrative remedies: suspension or adjustment of funding for non-compliant RRP-funded measures.
• Contractual penalties and remedies as set out in grant or procurement agreements with training providers.
• Public accountability measures: publication of underperformance in monitoring reports and potential reallocation of resources.

Per Cyprus - Digital Transformation Strategy

• The Strategy itself does not impose new criminal sanctions; enforcement derives from sectoral laws and contractual terms.
• Data protection breaches are subject to administrative fines and corrective measures under GDPR and the national data protection regime enforced by the Data Protection Commissioner.
• Non‑compliance with telecoms regulation and licensing obligations may lead to administrative sanctions under OCECPR jurisdiction.
• Breach of terms for EU/RRF funding can result in suspension, repayment (clawback) of funds, and procurement sanctions.
• Contractual penalties and performance remedies may be applied under public procurement contracts supporting Strategy projects.

Per Cyprus - National AI Strategy

• The strategy as a policy document does not create new statutory penalties; enforcement of data protection and privacy obligations remains under GDPR and national law.
• Non‑compliance with existing statutory obligations (e.g., GDPR, sectoral safety rules) can result in administrative fines or sanctions under those regimes.
• Any future regulatory measures recommended following implementation reviews may include administrative or civil enforcement provisions as determined by legislators.