Greece AI Act Implementation Law

Overview

Part A of Law 5321/2026 establishes domestic measures implementing Regulation (EU) 2024/1689 in Greece. Articles 1 and 2 combine protection of health, safety and fundamental rights with support for innovation. The law supplies national institutions, procedures and enforcement arrangements rather than replacing the Regulation’s harmonized substantive rules. Its components include market surveillance, inter-authority cooperation, conformity assessment, supervised experimentation, sanctions, judicial protection and public-sector AI governance. It was published in Government Gazette A΄ 114 of 20 July 2026.

The scope addressed here is Articles 1–26 of Part A, with Article 58 included for commencement; Part B is outside this scope. Private operators and public bodies are subject to different provisions: administrative enforcement can apply to both, while the national AI systems register concerns public-sector use. The law criminalizes interference with specified transparency markings and disclosures. Article 26 repeals Chapter B of Part A of Law 4961/2022, not the entire law. Under Article 58, commencement is on publication, 20 July 2026, unless an individual provision specifies otherwise.

Definitions

Part A does not introduce a separate comprehensive dictionary of AI terminology. Article 1 identifies artificial intelligence as TN and Regulation (EU) 2024/1689 as the AI Regulation. Operative provisions use the Regulation’s categories and cross-references. Article 3 distinguishes Article 5 prohibited practices, Annex III high-risk systems, systems subject to Article 50 transparency obligations, and high-risk systems connected with products governed by Annex I, Section A harmonization legislation. These categories allocate Greek supervisory competence; they are not alternative national risk classifications.

Market-surveillance authorities supervise compliance; EETT performs the notifying-authority role under Article 28 of the Regulation; and Article 11 assigns a specific conformity-assessment role to the Hellenic Data Protection Authority. Public-sector scope is linked to Article 14(1)(a) of Law 4270/2014, while Article 21 distinguishes bodies covered by Article 14(1)(c) when assigning register responsibilities. Sandbox participation concerns providers or prospective providers. Deepfakes, general-purpose models, AI literacy and impact assessments operate through EU provisions rather than independently formulated Greek technical definitions.

Governance and Institutional Framework

Article 3 designates the Hellenic Data Protection Authority, APDPCH, as market-surveillance authority for prohibited practices, Annex III high-risk systems and Article 50 transparency obligations. Existing authorities under Annex I, Section A harmonization legislation supervise high-risk AI connected with products covered by that legislation. Article 4 makes APDPCH the single point of contact. It publishes a directory of sectoral authorities, communicates their details to the European Commission, exchanges information with the AI Office, and submits reports where sectoral authorities do not report directly. Sectoral authorities must supply contact details and communicate changes without delay.

Article 5 designates the Hellenic Telecommunications and Post Commission, EETT, as notifying authority. Article 6 establishes an AI Coordination and Expertise Centre within EETT for requested technical support, coordination, training of sectoral authorities, codes of conduct and innovation support, particularly for SMEs and startups. The Centre provides resources and technical and administrative support for the sandbox. Article 15 assigns appointment of Greek representatives to the European AI Board to the Ministry of Digital Governance. Articles 21 and 22 place the public-sector register and AI Observatory under the Ministry’s Special Secretariat for Artificial Intelligence and Data Governance.

Key Focus Areas

The law separates general AI supervision from product-sector supervision and establishes coordination mechanisms. Articles 8 and 9 require cooperation, assistance and information exchange between APDPCH, sectoral authorities, customs authorities and other public bodies. Necessary information sharing for APDPCH’s assigned functions may include personal data and legally protected business or professional information, subject to equivalent confidentiality protection. The Labour Inspectorate, National Cybersecurity Authority, Competition Commission, Capital Market Commission and Bank of Greece must notify APDPCH without delay when they learn of Annex III high-risk systems while exercising their responsibilities.

Article 21 requires public bodies to register AI systems before operation. Declarations include a documented risk classification, information about data and decisions, safeguards and applicable impact assessments. Article 22 establishes an Observatory to monitor the national AI strategy and publish reports. Article 23 prohibits removal of machine-readable synthetic-content markings, interference with providers’ marking solutions, and removal or obstruction of specified deployer disclosures concerning deepfakes or artificially generated or manipulated content. This prohibition extends beyond requiring public bodies to label their own outputs.

Implementation Framework

Articles 10 and 11 establish conformity-assessment arrangements. Under Article 10, a sectoral notifying authority evaluates a conformity-assessment body under its harmonization legislation and forwards its application for AI Regulation recognition to EETT. EETT evaluates compliance with Article 31 of the Regulation and accepts relevant National Accreditation System certificates as conformity evidence under the specified accreditation framework. Approval follows a positive EETT assessment. Article 11 designates APDPCH to conduct Annex VII conformity assessment for specified high-risk systems intended for operation by law-enforcement, migration and asylum authorities. This function must be organizationally and functionally separate from supervision and sanctions.

Article 12 establishes an AI regulatory sandbox within EETT, operated jointly by EETT and APDPCH, with relevant sectoral authorities participating within their competences. EETT’s invitation determines application deadlines and format, scoring criteria, admission limits and participation fees by applicant category. Cooperation may involve PHAROS AI FACTORY, the Hellenic Centre for Defence Innovation and European Digital Innovation Hubs. Article 13 requires express written authorization for covered real-world testing outside sandboxes: expiry of the referenced 30-day period does not constitute approval. Article 24 authorizes decisions on complaints, coordination and settlement procedures. Under Article 14, a liquidator retains specified documentation when a Greece-established provider or authorized representative becomes bankrupt or ceases activity.

Monitoring and Evaluation

Article 7 establishes a unified AI Regulation complaints system within APDPCH without displacing the complaint right under Article 85 of the Regulation. APDPCH forwards complaints within sectoral competence and informs complainants. Sectoral authorities receiving complaints directly must notify the unified system without delay, transmitting the receipt date, summary, description of the AI Regulation issue and a copy. Within 30 days of receipt, they must determine competence; within 60 days, they must evaluate the complaint, report progress and establish an action timetable. These deadlines concern competence and evaluation, not a universal final merits decision.

Following specified competence refusals, APDPCH redirects the complaint or assumes exclusive responsibility. If a sectoral authority fails to provide the required 60-day update, APDPCH may initiate takeover and give it ten further days to act, after which APDPCH becomes exclusively competent. Coordination and the respondent’s prior-hearing right must be preserved. Article 13 authorizes monitoring and information requests for real-world tests. Article 22 allows the Observatory to use register information, identify priorities and opportunities, support strategy stakeholders and publish reports. It does not prescribe annual reporting or fixed performance indicators.

Penalties, Liability, and Appeals

Article 16 authorizes reasoned enforcement decisions after a prior hearing: warnings, compliance orders with deadlines, reprimands, administrative fines under Article 99 of the AI Regulation, and periodic financial penalties for failure to obey compliance orders. For undertakings, periodic penalties must not exceed 2% of average daily total worldwide turnover or income in the preceding financial year. They cease upon demonstrated full compliance. These measures may also apply to public-sector bodies. Sanctions must be effective, proportionate and dissuasive; authorities may consider adequate AI-literacy measures and admissions in settlement procedures. APDPCH fines and periodic penalties are public revenue collected under Law 4978/2022. Specified provisions of Law 4624/2019 apply by analogy.

Article 17 requires publication of sanction decisions on authority websites, including the sanctions, infringement nature and offender identity, while preserving confidentiality. Sectoral decisions are also transmitted to APDPCH for publication. Article 18 permits recovery of investigation and noncompliance-establishment costs after an administrative sanction, including testing and specified product-related costs. Article 23 provides imprisonment and a monetary criminal penalty for prohibited transparency interference unless another provision punishes the act more severely; it specifies neither a prison term nor an amount. Article 19 permits annulment applications before the Council of State against sanction decisions, specified other individual acts and regulatory acts under the law. Article 11 exempts APDPCH’s designated conformity-assessment activity from the specified liability-insurance requirement, without creating a general compensation regime.

Relationship to Other Instruments

Regulation (EU) 2024/1689 anchors Part A’s classifications, institutions, conformity assessment and enforcement. Regulation (EU) 2019/1020 supplies complementary market-surveillance, customs-cooperation and cost-recovery references, while Regulation (EC) 765/2008 supports accreditation evidence under Article 10. Article 20 amends the annex to Law 4990/2022 to include AI Regulation violations within product-safety and compliance coverage and privacy, personal-data and network-security coverage. This extends the existing whistleblower framework rather than creating a separate comprehensive procedure.

Article 26 repeals Chapter B of Part A of Law 4961/2022 from commencement. Article 21 connects the replacement public-sector register to Law 4270/2014’s institutional categories and the Data Use Officer under Article 13 of Law 5188/2025. Declarations must state whether required fundamental-rights impact assessments under Article 27 of the AI Regulation and data-protection impact assessments under Article 35 GDPR have been performed. Articles 6 and 25 reference existing procurement and staff-mobility legislation for expert support and transitional staffing.

International Alignment

Greek institutional assignments implement the EU regulatory architecture. APDPCH communicates authority names, responsibilities and contact information to the European Commission and exchanges information with the AI Office. Ministry appointments to the European AI Board connect domestic supervision with EU coordination. Continued product-sector supervision preserves links to harmonization legislation, while Article 10 integrates notification with harmonized accreditation standards.

The sandbox operates under Articles 57 and 58 of the AI Regulation; EETT invitations address matters not already regulated by referenced EU implementing acts. European Digital Innovation Hubs may cooperate with it. The Expertise Centre facilitates Article 95 codes of conduct and applies Article 78 confidentiality obligations. These arrangements do not create an independent international treaty, blanket mutual recognition with non-EU countries or automatic recognition of foreign AI approvals. National administrative arrangements remain distinct from the Regulation’s substantive application conditions.

Implementation Timeline

Sources and References