Greece - Digital Governance Framework (4961/2022)

Overview

Law 4961/2022 (FEK A' 146, 27 July 2022) is Greece's horizontal statute addressing adoption, governance and regulation of emerging information and communication technologies. It sets out obligations for public authorities and private actors, creates institutional coordination mechanisms and assigns roles for national cybersecurity and market surveillance. Key pillars include (i) governance and institutional structures for AI and digital governance, (ii) mandatory risk assessments and registries for certain AI uses, (iii) baseline security and supply‑chain duties for IoT and connected devices, (iv) legal recognition and rules for DLT/blockchain and smart contracts, and (v) IP and liability rules for 3D printing files and products. The full enacted text is published in the Government Gazette; the official FEK entry and downloadable PDF are referenced in the Sources below (FEK entry for Law 4961/2022 and Official FEK PDF (Law 4961/2022)).

Definitions

The Act defines a set of core technology terms to avoid ambiguity in application: "AI system" (broad definition covering models, algorithms and data pipelines), "Internet of Things (IoT)" (connected devices performing automated processing and data exchange), "distributed ledger technology (DLT)" and "blockchain" (shared, synchronized ledgers using consensus mechanisms), "3D printing" (additive manufacturing using CAD files), "smart contract" (codified contractual logic executed on DLT), and "UAS / UAV" (systems for unmanned aerial operations). These definitions are used to delineate obligations by actor (manufacturer, importer, distributor, operator) and by use case (profiling, personnel evaluation, critical infrastructure management).

Governance and Institutional Framework

Law 4961 establishes or assigns responsibilities to multiple public bodies to ensure coherent national governance. The Ministry of Digital Governance (General Directorate for Digital Policy / General Directorate of Cybersecurity) is the central coordinator for implementing digital governance and cybersecurity measures. A national Coordinating Committee for Artificial Intelligence is created to steer implementation of the National AI Strategy and advise on legal safeguards. The law designates the General Directorate of Cybersecurity as the national certification/co‑ordination point for EU cybersecurity certification schemes and mandates the creation of an Observatory for Hybrid Threats to provide expert analysis and strategic guidance (National Cybersecurity Authority note on national law). In addition, the law requires each central government entity to appoint a Responsible Officer for Information and Communications Systems Security (ΥΑΣΠΕ) and sets duties for critical infrastructure coordinators.

Key Focus Areas

The Act focuses on specific dimensions: (1) algorithmic governance — requiring algorithmic impact assessments alongside GDPR DPIAs for public sector AI deployments and for private uses affecting consumers/employees; (2) documentation and registries — mandatory registries for AI systems used in profiling and personnel evaluation where entities above a size threshold must maintain descriptive records of operating parameters, affected population estimates and risk mitigation measures; (3) cybersecurity and supply‑chain security — obligations for IoT device makers, importers and operators to ensure baseline security and to cooperate with national conformity assessment and market surveillance; (4) DLT and smart contracts — legal recognition and evidentiary rules for records maintained on distributed ledgers and rules facilitating certain transactions and dispute resolution; (5) 3D printing, IP and product liability — protection and remuneration mechanisms for CAD files and liability for defective digital models and printed goods; and (6) UAS postal/logistics services — technical and safety rules for UAV operations used in postal distribution. These focus areas are developed into sectoral obligations and enforcement mechanisms across the law (EY summary of Law 4961/2022).

Implementation Framework

Implementation relies on a mix of primary statutory obligations and delegated instruments. The law provides for ministerial and joint ministerial decisions to specify detailed technical and procedural requirements (e.g., templates for algorithmic impact assessments, registries, IoT security standards, and DLT record‑keeping rules). The General Directorate of Cybersecurity is empowered to define conformity assessment procedures, to designate assessment bodies, and to carry out market surveillance (including requests for information and inspections). Public authorities are required to integrate data classification and security planning into procurement processes (strengthened requirements for government cloud hosting and system design). The law further mandates coordination with the Hellenic Data Protection Authority on overlapping data protection matters and creates a registry of public sector data protection officers to facilitate information exchange.

Monitoring and Evaluation

Monitoring mechanisms include periodic reporting by public entities on AI use and by designated registrants on AI system operation; the law authorises audits and inspections by the National Cybersecurity Authority and other competent bodies. The Coordinating Committee for AI and the Observatory on Hybrid Threats are tasked with producing periodic assessments of technology risks, adoption trends and cross‑sector impacts, enabling policy updates. Market surveillance measures provide for corrective measures and public advisories where systemic risks or product deficiencies are identified.

Penalties, Liability, and Appeals

The statute establishes administrative sanctioning powers for non‑compliance (penalties, suspension of operations, orders to correct deficiencies) and describes civil liability rules for damage caused by defective digital products (including defective CAD files and AI‑driven decisions). The law preserves criminal liability where other criminal law provisions apply. It also sets internal appeal routes and administrative judicial review for decisions by supervisory authorities. Fines and other administrative measures are imposed according to the seriousness of violations, in accordance with the enabling provisions for enforcement (details of monetary scales and procedural rules are provided in delegated acts and are subject to subsequent amendments).

Relationship to Other Instruments

Law 4961/2022 expressly interacts with EU and national frameworks: it preserves the applicability of the GDPR (Regulation (EU) 2016/679) and aligns national cybersecurity roles with EU certification/regulatory initiatives. The law includes transposition/interaction clauses with existing national digital governance statutes (e.g., Law 4727/2020) and anticipates alignment with subsequent EU measures such as the AI Act and NIS2 (where applicable). The statute also amends numerous domestic provisions (e.g., administrative procedure registers, KEPAs, public procurement and signature rules) to harmonise digital transformation and administrative processes.

International Alignment

From the drafting stage, the law was designed to be compatible with European policy objectives on AI, cybersecurity and digital operational resilience. It creates national authorities and processes that can implement EU regulatory instruments (for example, implementing EU cybersecurity certification frameworks and cooperating with EU supervisory mechanisms). The law also enables Greece to incorporate future EU rules (including delegated acts and sectoral regulations) through ministerial and delegated decisions, thereby maintaining operational alignment with EU directives/regulations.

Implementation Timeline

Sources and References