Lithuania - AI Act Implementation (XV-106)

Overview

The Act (adopted by the Seimas on 14 January 2025 as law No. XV-106) amends the Law on Information Society Services (No. X-614) to implement key operational requirements of the EU Artificial Intelligence Act and to accelerate safe AI development in Lithuania. It designates national competent authorities, clarifies market surveillance and notifying roles, and creates legal pathways for conformity assessment, notified bodies, and a national AI sandbox for experimental testing. The legislative instrument is available in the national registry and official publication; see the official legal entry at e-tar / legal act (EN) and the Seimas project page at Seimas (LT). The Ministry of the Economy and Innovation published explanatory material and press notices summarizing institutional changes and the rationale for creating an AI sandbox: Ministry press release.

Definitions

The amendments adopt and incorporate definitions consistent with the EU AI Act, clarifying terms used in national practice: "AI system" (software developed using machine learning, logic- and knowledge-based approaches, or statistical methods that outputs a decision, recommendation or prediction), "provider" (natural or legal person placing an AI system on the EU market), "deployer" (entity using an AI system within Lithuania), "high-risk AI system" (categories referenced in Annex III of the AI Act, e.g., critical infrastructure, education, employment, law enforcement, migration, biometric identification, healthcare, essential services), "notified body" (conformity assessment entity assessed and notified by the national notifying authority), and "market surveillance" (activities by the national authority to enforce compliance and remove unsafe AI from the market). The law ties these definitions directly to the text and annexes of the EU AI Act while keeping cross-references to existing national terms used in the Information Society Services Act.

Governance and Institutional Framework

The amendment creates a two-body national governance model aligned with the AI Act: the Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT) is designated as the national market surveillance authority and Single Contact Point; the Innovation Agency (Inovacijų agentūra) is designated as the national notifying authority responsible for assessing and notifying conformity assessment bodies and coordinating an AI sandbox. The Ministry of the Economy and Innovation acts as the policy coordinator and sponsor for the sandbox and support programmes. The law requires the RRT to develop surveillance procedures, establish information-sharing channels with sectoral authorities, and to publish annual enforcement reports; the Innovation Agency must define criteria for notifying bodies, maintain a public registry of notified bodies, and operate transparent application and appeal procedures. See the government implementation page for the national competent authority designations at EIMIN - national competent authorities and the public registry entry at Seimas - legal act.

Key Focus Areas

The Act focuses on: (1) institutional designation and cooperation — assigning RRT and the Innovation Agency concrete roles and coordinating with other national bodies protecting fundamental rights (e.g., the Equal Opportunities Ombudsperson and Ombudsmen offices); (2) conformity assessment — enabling notified bodies (private, academic, or public) to certify compliance of high-risk AI systems through harmonised procedures; (3) market surveillance and enforcement — granting the RRT powers to inspect technical documentation, demand source code or datasets under specific safeguards, order corrective measures, and impose administrative penalties; (4) AI sandbox and innovation facilitation — creating a legal mechanism for supervised pilot testing with reduced procedural friction under oversight and time-limited derogations where the sandbox is used solely for testing and evaluation; (5) transparency and user information — obliging providers to disclose system capabilities, limitations, and instructions for safe use; and (6) data governance and cybersecurity — mandating technical and organizational measures to preserve data quality, integrity, and model security. Together these elements balance innovation incentives (sandbox, start-up assessment and targeted public support) with a robust compliance regime for high-risk AI systems.

Implementation Framework

Operational implementation is staged: the law enters into force on 1 April 2025; market surveillance duties for RRT commence from that date while certain notifying authority powers for the Innovation Agency are scheduled from 2 August 2025 to align with notification and accreditation timelines. The Innovation Agency will publish procedures for designation of notified bodies, accreditation criteria, and a public registry; it will also host the AI sandbox operational rules, application procedures, and privacy safeguards. The RRT will issue market surveillance guidance, define technical documentation formats, and coordinate a national single point of contact for cross-border cooperation with the European AI Office. The amendments require interagency memoranda of understanding, cross-training, and budgetary allocations; explanatory materials and guidance documents are posted by the Ministry at EIMIN press release and by the national registry at e-tar.

Monitoring and Evaluation

The law mandates periodic monitoring: the RRT must publish annual surveillance reports (including enforcement actions, risk assessments, and corrective measures). The Innovation Agency must report on notified-body designations, sandbox participants and outcomes, and the Ministry will monitor economic impact indicators (start-up growth, investment, AI adoption metrics). The act also requires a three-year ex-post evaluation plan to assess whether the sandbox and conformity mechanisms effectively support innovation while protecting rights. Data collection duties for monitoring must respect data protection rules; coordination with the national Data Protection Inspectorate and sectoral oversight bodies is required. The Act calls for publication of anonymised summaries of market surveillance outcomes to foster transparency and accountability.

Penalties, Liability, and Appeals

Penalties are administrative and aligned with the AI Act’s framework. The RRT may order corrective measures (withdrawal, suspension, required modifications), impose administrative fines for non-compliance, and publish decisions. The law specifies procedures for administrative appeals and judicial review; affected providers or notified bodies may appeal administrative measures to the competent administrative courts. Liability and redress obligations remain coordinated with existing civil liability rules—providers and deployers can be held civilly liable under national law for harms caused by non-compliant AI systems. The law also contains provisions enabling faster enforcement in public-safety exigencies and safeguards for trade secrets during inspections.

Relationship to Other Instruments

The amendment explicitly interfaces with EU instruments (the EU AI Act, the Digital Services Act and existing EU market surveillance regulations) and national statutes (Law on Technology and Innovation, Data Protection rules, consumer protection law, sector-specific safety regimes such as health or transport). It amends specific articles of the Law on Information Society Services to align national institutional roles with EU obligations; cross-references to the Law on Technology and Innovation ensure coordination where state support and start-up assessment are concerned. The law also references accreditation and standardisation instruments (national accreditation body) to operationalise notified-body qualifying requirements.

International Alignment

The Act is explicitly designed to implement the EU AI Act and to ensure Lithuania meets the EU deadline for designating national competent authorities. It positions Lithuania to participate in EU-level cooperation (European AI Board and AI Office coordination), cross-border market surveillance, and to notify conformity assessment bodies to the EU internal market. The Act therefore supports interoperability with other member states’ enforcement frameworks and strengthens Lithuania’s capacity to be an EU hub for regulated AI testing and certification. See EU-level guidance on market surveillance and national competent authorities at EU - Market Surveillance under AI Act.

Implementation Timeline

Sources and References