Greece AI Regulation Overview

Overview

Greece’s approach to artificial intelligence (AI) and digital governance relies on a combination of horizontal statutory legislation, strategic national policy blueprints, and direct national implementation of European Union digital frameworks. The Hellenic Republic has established binding rules for emerging technologies, including AI systems, Internet of Things (IoT) devices, distributed ledger technology (DLT), and automated decision-making. These statutory requirements operate alongside national data governance initiatives designed to modernize public administration, facilitate responsible data sharing, and protect individual rights.

Central to Greece's legislative framework is Law 4961/2022 on emerging information and communication technologies, which establishes mandatory governance obligations for algorithmic decision-making systems in both public and private sectors. This horizontal legislation is complemented by Law 5188/2025, which transposes the EU Data Governance Act and creates national structures for public sector data sharing and supervision. Broader operational direction is anchored in the national Digital Transformation Bible 2020–2025 and guided by strategic advisory documents such as "A Blueprint for Greece’s AI Transformation" (2024).

Regulatory Approach

Greece employs a hybrid regulatory approach combining binding horizontal legislation with structured soft-law policy frameworks. Primary statutes set explicit legal duties, such as conducting algorithmic impact assessments (AIAs), maintaining internal AI system registries for high-impact use cases like profiling and employee evaluation, and implementing cybersecurity controls. These binding mandates are designed to operate alongside EU horizontal regulations, prioritizing risk management, legal certainty, and fundamental rights safeguards.

Complementing statutory acts, strategic instruments provide policy guidance and outline recommendations for future regulatory evolution. Recommendations from the High-Level Advisory Committee on Artificial Intelligence promote an EU-aligned, risk-based classification model, technical documentation standards (model cards and audits), and co-regulation models. Public administration AI deployments face specific statutory restrictions, requiring explicit legal authorization and tailored risk evaluations prior to deployment.

Key AI Legislation

• Law 5188/2025 (Data Governance Act Implementation and Public Data Strategy): Establishes national implementing measures for EU Regulation 2022/868. Designates the Ministry of Digital Governance as the single information point and supervisory body for data intermediation services and data altruism organisations, requires Data Use Officers (DUOs) in central government entities, and introduces administrative fines of €10,000 to €100,000 for breaches.
• Law 4961/2022 (Emerging Information and Communication Technologies): Horizontal statute regulating AI systems, IoT, DLT, smart contracts, 3D printing, and logistics UAS. Mandates Algorithmic Impact Assessments (AIAs) for sensitive deployments, requires internal registries for AI profiling and personnel evaluation, and designates security officers across public administration.
• Law 5039/2023 (Omnibus Measures / Galileo PRS Amendment): Amends Law 4961/2022 regarding access to the Galileo Public Regulated Service (PRS), placing authorization under the National Cybersecurity Authority with assistance from the Ministry of National Defence.
• Law 4727/2020 (Code on Digital Governance): Framework statute unifying digital public services, transposing EU Open Data Directive (EU 2019/1024) and Web Accessibility Directive (EU 2016/2102), recognizing eIDAS trust services, establishing the GOV.GR portal, citizen digital mailboxes, and the national Personal Number.
• A Blueprint for Greece’s AI Transformation (2024 Policy Strategy): National AI strategy blueprint issued by the High-Level Advisory Committee on AI proposing a layered governance structure (AI supervisory authority, AI Interministerial Committee, AI Politeia research lab, AI observatory) and flagship transformation programs.
• Digital Transformation Bible 2020–2025: Formal national digital strategy approved by ministerial decision (FEK 2894/Β/05-07-2021) organizing strategic priorities across public digital services, open data, cybersecurity, and advanced technologies including AI and blockchain.
• EU AI Act Article 77 Fundamental Rights Designation (2024): Formal designation by the Ministry of Digital Governance listing four independent public authorities to enforce fundamental-rights protections regarding high-risk AI under the EU AI Act starting August 2026.

Governance & Enforcement Bodies

Institutional oversight for AI and digital governance in Greece is primarily centered within the Ministry of Digital Governance. The Ministry coordinates digital strategy, manages central digital infrastructure (GOV.GR), acts as the single information point under Law 5188/2025, and oversees national cybersecurity policy through the General Directorate of Cybersecurity. Additional statutory bodies, including the national Coordinating Committee for Artificial Intelligence and the Coordinating Committee for Public Sector Information, support cross-ministerial implementation and strategic alignment.

To enforce fundamental rights protections under Article 77 of the EU AI Act, Greece has designated four existing independent public authorities: the Hellenic Data Protection Authority (HDPA), the Greek Ombudsman, the Hellenic Authority for Ensuring Communications Secrecy (ADAE), and the Greek National Commission for Human Rights (GNCHR). These bodies acquire specific powers to request and review technical documentation, risk assessments, and fundamental-rights impact assessments from AI deployers and providers within their statutory jurisdictions, operating in coordination with market surveillance authorities.

Penalties & Enforcement

Enforcement mechanisms in Greece combine administrative fines, market surveillance powers, and procedural safeguards. Under Law 5188/2025 implementing the Data Governance Act, administrative fines range from €10,000 to €100,000 for violations of national implementing measures. The law also empowers competent authorities to order injunctive measures to correct non-compliance, subject to mandatory prior hearing rights and judicial review before the competent Administrative Court of Appeal.

Under Law 4961/2022, market surveillance and conformity assessment functions are exercised by the General Directorate of Cybersecurity and competent technical regulators, who may inspect systems, request technical specifications, and require corrective measures. Under the EU AI Act enforcement architecture, while Article 77 fundamental-rights authorities may request documentation and perform reviews, primary investigative powers and sanctioning mechanisms—including formal corrective orders and regulatory fines—are exercised by designated market surveillance authorities.

Data Protection Framework

Greece’s data protection framework operates under the strict primacy of EU data protection law, specifically the General Data Protection Regulation (GDPR / Regulation (EU) 2016/679). Both Law 4961/2022 and Law 5188/2025 explicitly confirm that national provisions governing AI deployment, data reuse, and public sector registries apply without prejudice to GDPR rules and fundamental privacy guarantees.

Where AI systems involve the processing of personal data, statutory requirements under Law 4961/2022 mandate that Algorithmic Impact Assessments (AIAs) must be conducted alongside mandatory Data Protection Impact Assessments (DPIAs). The Hellenic Data Protection Authority (HDPA) maintains independent regulatory oversight over processing activities, enforces GDPR compliance across automated systems, and serves as a designated fundamental-rights authority under Article 77 of the EU AI Act.

Sector-Specific Rules

Greece has enacted sector-specific rules touching upon transportation, logistics, public administration, and digital trust. In transport and logistics, Law 4961/2022 prescribes detailed technical and safety requirements for Unmanned Aerial Systems (UAS/UAV) operated for postal and distribution services. Furthermore, Law 5039/2023 regulates access authorization and technical compliance checks for the Galileo Public Regulated Service (PRS), assigning operational responsibilities to the National Cybersecurity Authority in cooperation with the Ministry of National Defence.

For financial transactions, commerce, and advanced manufacturing, Law 4961/2022 establishes legal recognition and evidentiary standards for smart contracts and distributed ledger technologies (DLT), while introducing specific intellectual property and product liability rules for 3D printing CAD files and printed outputs. In public administration, public sector bodies face strict statutory limits on deploying algorithmic decision-making tools unless explicitly authorized by law with documented safeguards.

International Alignment

Greece’s regulatory trajectory is closely integrated with European Union legislative frameworks and international initiatives. Statutory instruments directly transpose or operationalize key EU acts, including the Data Governance Act (Regulation (EU) 2022/868), the Open Data Directive (Directive (EU) 2019/1024), the eIDAS Regulation (Regulation (EU) No 910/2014), the Web Accessibility Directive (Directive (EU) 2016/2102), and the Interoperable Europe Regulation (Regulation (EU) 2024/903).

Furthermore, national policy initiatives—such as "A Blueprint for Greece’s AI Transformation" (2024)—are designed to align with the EU AI Act (Regulation (EU) 2024/1689) and OECD AI Principles. Greece actively participates in EU-level implementation bodies, including the European Data Innovation Board, to maintain cross-border interoperability and legal alignment across Member States.

Future Developments

Greece is pursuing several phased regulatory and operational milestones. Under the national designation for Article 77 of the EU AI Act, the four designated fundamental-rights protection authorities (HDPA, Ombudsman, ADAE, GNCHR) will formally exercise their additional documentation request and supervisory powers starting on 2 August 2026, following the EU AI Act's phased implementation schedule.

In addition, Law 5188/2025 sets explicit administrative milestones, including the operational opening of the national single information point and registries for data intermediation services and data altruism organisations by 30 June 2025. Policy proposals outlined in the 2024 AI Transformation Blueprint also anticipate ongoing legislative follow-up to establish a dedicated national AI supervisory authority, an AI observatory, and the AI Politeia research lab.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministry of Digital Governance	Central coordinator for digital policy, cybersecurity, public sector data strategy, and single information point under Law 5188/2025	Supervises data intermediation services, maintains registers, issues technical specifications, oversees digital governance implementation
Hellenic Data Protection Authority (HDPA)	Independent data protection authority; designated Article 77 fundamental-rights body under EU AI Act	Enforces GDPR compliance, inspects personal data processing in AI, requests and reviews technical documentation and impact assessments
Greek Ombudsman (Συνήγορος του Πολίτη)	Independent administrative authority for equal treatment and civic rights; designated Article 77 body under EU AI Act	Investigates administrative complaints, reviews AI impacts on equality and fundamental rights, requests system documentation
Hellenic Authority for Ensuring Communications Secrecy (ADAE)	Independent authority safeguarding secrecy of communications; designated Article 77 body under EU AI Act	Monitors communications confidentiality, requests technical documentation for AI affecting communications secrecy
Greek National Commission for Human Rights (GNCHR)	Independent advisory and human rights body; designated Article 77 body under EU AI Act	Evaluates human rights impacts of high-risk AI systems, requests technical and organisational documentation from operators
National Cybersecurity Authority (General Directorate of Cybersecurity)	National authority for cybersecurity, ICT product market surveillance, and Galileo PRS access oversight	Conducts market surveillance, performs security inspections, oversees technical conformity assessment, enforces cybersecurity rules