Cyprus AI Regulation Overview

Overview

The Republic of Cyprus governs artificial intelligence through a centralized, EU-harmonized governance architecture established under Regulation (EU) 2024/1689 (the EU AI Act), complemented by national strategic roadmaps. Initial foundational efforts were defined in the National Artificial Intelligence Strategy (2020), which articulated government priorities for building an AI-ready economy, enhancing public services, fostering research, and ensuring ethical standards in line with the EU Coordinated Plan on Artificial Intelligence. Following the entry into force of the EU AI Act in August 2024, Cyprus transitioned to a formal statutory enforcement structure.

In November 2024, the Deputy Ministry of Research, Innovation and Digital Policy (DMRID) completed the initial formal step required by Article 77 of the EU AI Act by notifying the European Commission of the national public authorities responsible for protecting fundamental rights. This was followed by a formal Council of Ministers decision on 22 January 2025 and subsequent public notices designating national competent authorities for notification, market surveillance, and EU-level representation. The Cypriot framework coordinates public administration, research institutions, and regulatory bodies while integrating AI execution with broader national initiatives such as the National Strategy for Research and Innovation 2024–2026.

Regulatory Approach

Cyprus adopts a risk-based, binding EU regulatory approach for market oversight while deploying non-binding, soft-law policy instruments to stimulate research and digital capacity. Legally binding obligations are anchored directly in Regulation (EU) 2024/1689, enforcing strict prohibitions on unacceptably risky AI practices and imposing comprehensive compliance requirements on high-risk AI deployments and general-purpose AI (GPAI) models. The national framework provides for phased implementation timelines mirroring EU milestones, ensuring legal certainty and consistent market supervision across the internal market.

Parallel to binding EU legislation, Cyprus uses policy strategies to drive national AI development and adoption. Frameworks such as the National Strategy for Research and Innovation 2024–2026 (administered by DMRID and executed through the Research and Innovation Foundation) and the Digital Strategy for Cyprus 2020–2025 guide public investments, grant schemes, and sandbox testing without imposing independent statutory sanctions. This dual approach pairs strict risk mitigation for fundamental rights with proactive funding and innovation support.

Key AI Legislation

The primary binding and non-binding instruments governing AI in Cyprus include:

• Governance Framework for the Implementation of Regulation (EU) 2024/1689 on Artificial Intelligence (2024): National operational framework establishing designated competent authorities, market surveillance responsibilities, fundamental rights oversight, and EU coordination mechanisms under the EU AI Act.
• National Artificial Intelligence Strategy: Actions for the Leverage and Development of AI in Cyprus (2020): Strategic roadmap outlining core pillars for AI investment, national data spaces, talent development, public service automation, and ethical guidelines.
• National Strategy for Research and Innovation 2024–2026 (2023): Policy guidance framework governing state research investments, commercialization funding, and academic-industry collaboration across key digital technologies.
• Digital Strategy for Cyprus 2020–2025 (2020): Overarching policy blueprint for public sector digital transformation, broadband infrastructure, digital economy support, and digital skills.
• National Action Plan for Digital Skills 2021–2025 (2021): Policy plan focused on upskilling the national workforce, workforce training, and digital literacy.

Governance & Enforcement Bodies

Institutional oversight of AI in Cyprus relies on a clear division of roles among established public authorities. The Deputy Ministry of Research, Innovation and Digital Policy (DMRID) serves as the national coordinating authority and represents the Republic of Cyprus on the European Artificial Intelligence Board. DMRID oversees national policy alignment, strategic roadmaps, and cross-agency coordination.

Operational market surveillance and technical oversight are divided between specialized regulators. The Office of the Commissioner for Electronic Communications and Postal Regulation (OCECPR / Commissioner of Communications) acts as the Notifying Authority, a Market Surveillance Authority (MSA), and Cyprus’s Single Point of Contact for the EU AI Act. The Commissioner for Personal Data Protection functions as an MSA for designated Annex III high-risk AI categories and maintains primary enforcement authority over data-protection-related prohibited AI practices. Additionally, the Council of Ministers retains authority to designate further sectoral MSAs as operational needs evolve.

Penalties & Enforcement

Enforcement mechanisms and financial penalties for violations of mandatory AI rules in Cyprus are tied directly to Article 99 of Regulation (EU) 2024/1689. National secondary legislation is being drafted to operationalize administrative fine structures and statutory proceedings. The EU AI Act establishes statutory maximum fine ceilings reaching up to EUR 35,000,000 or 7% of total worldwide annual turnover for infringements involving prohibited AI practices, with lower fine tiers applied to non-compliance with high-risk requirements or general obligations.

Conversely, non-binding strategic frameworks—such as the National Strategy for Research and Innovation 2024–2026 and the National AI Strategy—do not contain statutory penalties or administrative fines. Compliance under research and development frameworks is enforced through grant terms, funding conditions, and auditing procedures administered by executive agencies such as the Research and Innovation Foundation (RIF).

Data Protection Framework

Data protection principles are integrated into Cyprus’s national AI governance model. The Commissioner for Personal Data Protection plays a dual regulatory role, supervising compliance under the General Data Protection Regulation (GDPR) while acting as a designated Market Surveillance Authority for high-risk AI applications under Annex III of the EU AI Act. The Commissioner leads enforcement against prohibited AI practices where personal data processing and privacy rights are implicated.

The national governance architecture requires close structural coordination between market surveillance activities and mandatory Data Protection Impact Assessments (DPIAs). AI providers and deployers operating in Cyprus must maintain technical documentation, logging, and data governance standards that simultaneously satisfy EU AI Act risk mitigation rules and GDPR privacy requirements.

Sector-Specific Rules

Sector-specific AI regulation in Cyprus is organized through targeted thematic domains under national smart specialisation policies and sectoral market surveillance mechanisms. The Council of Ministers possesses statutory authority to appoint specialized sectoral Market Surveillance Authorities to oversee high-risk AI applications operating within specific domain jurisdictions.

National research and innovation roadmaps explicitly prioritize digital technologies, health, agrifood, shipping and maritime, renewable energy, advanced materials, space, and environmental monitoring. The corpus holds no record of standalone sectoral AI statutes for finance, health, or autonomous vehicles; sectoral supervision currently relies on cross-cutting EU AI Act provisions, general privacy law, and existing domain regulatory frameworks.

International Alignment

Cyprus aligns its AI regulatory and development policies strictly with European Union frameworks and international standards. The national architecture directly implements Regulation (EU) 2024/1689, participates in EU-level coordination via the European Artificial Intelligence Board, and reflects the objectives of the EU Coordinated Plan on Artificial Intelligence. Cyprus also links its national digital plans to the European Digital Compass and European Research Area (ERA) goals.

Standardization activities are aligned with international guidelines through the Cyprus Organisation for Standardisation (CYS), which coordinates national engagement with European and international technical standardisation bodies to establish reliable AI benchmarks.

Future Developments

Cyprus is following a staged implementation schedule to complete its AI regulatory infrastructure by 2026. Key upcoming milestones include the full operationalization of general-purpose AI (GPAI) rules and specific governance chapters in August 2025, alongside the ongoing drafting of national secondary legislation establishing formal administrative procedures and national penalty regimes required by Article 99 of the AI Act.

By 2 August 2026, Cyprus will fully implement all high-risk AI obligations under the EU AI Act. This milestone includes establishing operational national AI regulatory sandboxes to support SME experimentation and expanding the investigative and enforcement powers of designated fundamental rights authorities, including the Commissioner for Personal Data Protection, the Ombudsman, and the Attorney-General.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Deputy Ministry of Research, Innovation and Digital Policy (DMRID)	National coordinator for AI implementation and representative to European Artificial Intelligence Board	Policy coordination, strategic oversight, multi-agency alignment, national roadmap administration
Office of the Commissioner for Electronic Communications and Postal Regulation (OCECPR)	Notifying Authority, Market Surveillance Authority, and Single Point of Contact under EU AI Act	Market surveillance, notification of conformity assessment bodies, EU coordination, technical supervision
Commissioner for Personal Data Protection	Market Surveillance Authority for specific Annex III high-risk AI categories and data protection enforcement	Surveillance of Annex III categories, enforcement of data-protection-related prohibited AI practices, GDPR enforcement
Commissioner for Administration and the Protection of Human Rights (Ombudsman)	Designated national authority for protection of fundamental rights under Article 77 of Regulation (EU) 2024/1689	Fundamental rights oversight, investigation of human rights compliance in AI deployments
Attorney-General	Designated fundamental rights authority under Article 77 of Regulation (EU) 2024/1689	Legal oversight and protection of fundamental rights under statutory mandates
Research and Innovation Foundation (RIF)	Executive agency for national research and innovation strategy implementation	Issuing competitive funding calls, allocating grants, monitoring targets, auditing beneficiary compliance