cyprusai actai regulationeu ai actcompliancehigh-risk ai

Cyprus AI Act Framework: What Businesses Must Know

Regulations.ai (AI-assisted)•

Cyprus has taken a decisive step in the global AI regulatory landscape, establishing a robust national framework to implement the European Union's landmark Artificial Intelligence Act (AI Act). This move, formalized through the "Governance Framework for the Implementation of Regulation (EU) 2024/1689 on Artificial Intelligence in Cyprus," means that companies and individuals operating within Cyprus must now navigate a new era of AI accountability. The framework, effective February 2, 2025, dictates how AI systems developed, operated, or deployed in Cyprus will be regulated, with a particular focus on high-risk applications and general-purpose AI models.

What's changing

The core of Cyprus's new framework is the direct application of the EU AI Act, which introduces a tiered approach to AI regulation based on risk. Businesses in Cyprus need to understand three main pillars of change:

  1. Outright Prohibitions: Certain AI practices are deemed too risky or harmful and are strictly forbidden. These include, but are not limited to, social scoring by public authorities and the use of real-time remote biometric identification systems in public spaces for law enforcement purposes, with limited exceptions. These prohibitions are the first to take effect, becoming mandatory from February 2, 2025.

  2. Strict Rules for High-Risk AI Systems: For AI systems identified as "high-risk" – those used in critical infrastructure, employment and worker management, law enforcement, migration and border control, or education – the obligations are extensive. Providers (developers) and deployers (users) of these systems must implement stringent measures. This includes establishing robust risk management systems, ensuring high data quality, maintaining detailed technical documentation, logging activities, and guaranteeing appropriate human oversight. These comprehensive requirements for high-risk AI systems will become mandatory from August 2, 2026.

  3. Transparency and Risk Management for General-Purpose AI Models (GPAI): Models like large language models (LLMs) that can be adapted for various purposes also fall under the regulation. Providers of these GPAI models must meet specific transparency obligations, including technical documentation and information for downstream providers, and implement risk management duties, especially for models with systemic risk. These rules for general-purpose AI apply from August 2, 2025.

Cyprus is also preparing its national penalty regime, which will align with the AI Act's maximum fines. Non-compliance with the prohibited AI practices could lead to penalties of up to €35 million or 7% of a company's global annual turnover, whichever is higher. Other breaches carry lower, but still significant, financial penalties. Individuals affected by non-compliant AI systems will have the right to file complaints with national authorities and seek legal remedies in court. The national framework will transpose the AI Act's enforcement and penalty regime into national law, as required by Article 99, and notify the European Commission of these provisions.

Who is affected

The Cyprus AI Governance Framework primarily affects providers (those who develop or place AI systems on the market) and deployers (those who use AI systems in a professional context) operating within Cyprus. This includes a wide range of entities:

  • Jurisdiction: Any company, public authority, or individual developing, importing, distributing, or using AI systems within Cyprus's borders, or whose AI systems affect people in Cyprus, will be subject to these rules.
  • Sectors: While the high-risk categories specifically target critical infrastructure, employment, law enforcement, and education, the broader implications of GPAI rules mean that virtually any sector leveraging advanced AI technologies could be affected. This includes finance, healthcare, manufacturing, retail, and public services.
  • Sizes: The regulation applies regardless of company size. While larger enterprises may have more resources to dedicate to compliance, smaller businesses and startups developing or deploying AI will also need to adhere to the requirements, particularly if their systems fall into high-risk categories or are general-purpose AI models. The staggered implementation dates are a critical challenge, requiring careful planning across all organizational sizes to ensure compliance with each phase.

Three things to do this week

Given the staggered implementation and the significant penalties for non-compliance, businesses in Cyprus should take immediate steps to prepare:

  1. Audit AI Systems for Prohibitions: Begin an urgent review of all current and planned AI systems within your organization to identify any practices that might fall under the outright prohibitions, which take effect on February 2, 2025. This includes assessing any use of social scoring or real-time remote biometric identification. Proactively discontinuing or reconfiguring such systems is crucial to avoid severe penalties.

  2. Identify High-Risk AI: Start the process of assessing which, if any, of your AI systems qualify as "high-risk" under the Act's definitions (e.g., those used in critical infrastructure, employment, law enforcement, or education). This identification is foundational, as it dictates the extensive compliance obligations that will apply from August 2, 2026. Understanding your exposure now allows for strategic planning and resource allocation.

  3. Plan for Staggered Deadlines: Develop a comprehensive, phased compliance roadmap. Map out the specific obligations against their respective effective dates: prohibitions (February 2, 2025), general-purpose AI rules (August 2, 2025), and high-risk AI system requirements (August 2, 2026). This roadmap should include internal audits, policy updates, staff training, and technological adjustments to ensure readiness for each phase.

Related context

This new framework is part of a broader push by Cyprus to engage with and regulate artificial intelligence. Businesses should also be aware of:

Note: this article was drafted by AI - Google Gemini

Back to News