Lithuania AI Regulation Overview

Overview

Lithuania's regulatory approach to artificial intelligence centers on operationalizing European Union standards—specifically Regulation (EU) 2024/1689 (EU AI Act)—within its domestic legal order while supporting a competitive local AI ecosystem. The country transitioned from early non-binding policy roadmaps, such as the 2019 "Lithuanian Artificial Intelligence Strategy: A Vision of the Future" and the "Action Plan for the Development of Artificial Intelligence Technologies in Lithuania 2023–2026", to formal statutory enforcement mechanisms. In January 2025, the Seimas enacted targeted legislative amendments designed to embed EU AI Act compliance, market oversight, and regulatory experimentation directly into domestic law.

Rather than drafting a standalone domestic AI statute, Lithuania enacted a linked legislative package consisting of Act No. XV-105 (amending the Law on Technology and Innovation) and Act No. XV-106 (amending the Law on Information Society Services). Published in the State Gazette (TAR) on January 22, 2025, with major provisions becoming effective on April 1, 2025, these amendments establish national governance infrastructure, designate institutional roles, and authorize a national AI regulatory sandbox (DI smėliadėžė) to support safe development, testing, and commercialization.

Regulatory Approach

Lithuania follows a horizontal, risk-based regulatory philosophy directly aligned with the risk taxonomy of the EU AI Act (categorizing systems into unacceptable, high-risk, limited-risk, and minimal-risk). Domestic legislation ties technical documentation, fundamental rights impact assessments, data governance, cybersecurity safeguards, and conformity assessment requirements to high-risk AI deployments. This binding statutory baseline is complemented by soft-law instruments, including parliamentary resolutions and strategic roadmaps that guide public-sector adoption and promote ethical, human-centric AI development.

The regulatory model balances strict EU compliance with targeted measures to accelerate domestic technology innovation. By establishing a national AI regulatory sandbox administered by the Innovation Agency and refining the statutory definition of "start-up" to include an innovation potential assessment, Lithuania provides structured pathways for testing and regulatory support. This approach aims to reduce procedural friction for small and medium-sized enterprises (SMEs) and early-stage ventures while maintaining market oversight through designated national authorities.

Key AI Legislation

• Amendments to the Law on Technology and Innovation (Act No. XV-105): Adopted in January 2025, this law designates the Innovation Agency as the national notifying authority responsible for assessing conformity assessment bodies, creates the statutory basis for the national AI regulatory sandbox, and refines start-up classification criteria to include an innovation potential test.
• Amendments to the Law on Information Society Services (Act No. XV-106): Adopted in January 2025, this act designates the Communications Regulatory Authority (RRT) as the national market surveillance authority and single point of contact under the EU AI Act, empowering it to inspect systems, enforce technical documentation rules, order corrective actions, and impose administrative penalties.
• AI Regulatory Sandbox Policy (2024): Adopted in July 2024 to fulfill EU AI Act obligations, this framework creates a supervised national testing environment (DI smėliadėžė) operated by the Innovation Agency, offering regulatory guidance, pre-certification support, and high-performance computing (HPC) access for AI developers.
• Seimas Resolution on the Principles of Use of Artificial Intelligence Technologies in the Public Sector (2024): Adopted on May 9, 2024, this resolution sets political and administrative principles for state and municipal bodies, requiring human oversight, non-discrimination, transparency, public disclosure, and service continuity in public-sector AI deployments.
• Action Plan for the Development of Artificial Intelligence Technologies in Lithuania 2023–2026: A strategic implementation roadmap defining national measures for ecosystem growth, strategic data initiatives, language resources, compute infrastructure, and public-sector pilots.
• Lithuanian Artificial Intelligence Strategy: A Vision of the Future (2019): Lithuania's foundational national strategy establishing core ethical pillars, sector adoption goals, and recommendations for national AI governance mechanisms.

Governance & Enforcement Bodies

Institutional oversight in Lithuania is structured primarily around a two-body framework divided between the Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT) and the Innovation Agency (Inovacijų agentūra). RRT serves as the national market surveillance authority and single point of contact for cross-border cooperation with the European AI Office and other EU Member States. RRT is responsible for market checks, technical inspections, incident handling, and enforcing compliance across the domestic market. The Innovation Agency functions as the national notifying authority, evaluating and notifying independent conformity assessment bodies and managing the national AI regulatory sandbox.

Inter-agency policy coordination is led by the Ministry of Economy and Innovation (EIMIN), which oversees national AI policy and coordinates the National AI Governance Forum. Sectoral and horizontal bodies maintain specific supervisory duties, including the State Data Protection Inspectorate for data privacy and processing, the Consumer Rights Protection Service for consumer welfare, and the State Data Agency for state data governance and the State Data Lake. The National AI Governance Forum brings together these regulators along with key ministries to harmonize enforcement, maintain technical guidance, and coordinate public-sector data integration.

Penalties & Enforcement

Under the 2025 amendments to the Law on Information Society Services (Act No. XV-106), the Communications Regulatory Authority (RRT) possesses explicit market surveillance and enforcement powers. RRT can demand technical documentation, request access to datasets or source code under defined safeguards, issue mandatory compliance orders, direct product suspensions or recalls, and impose administrative fines or public corrective measures for non-compliance. Enforcement processes align with the administrative penalty structures established under the EU AI Act.

The national AI Regulatory Sandbox Policy establishes a liability framework for participants during pre-market testing. Providers adhering to an agreed sandbox plan and acting in good faith under regulatory guidance are protected from administrative fines under the EU AI Regulation for activities within the controlled environment. However, participating entities remain civilly liable for any real-world harms or damages caused during sandbox testing.

Data Protection Framework

AI governance in Lithuania operates in close integration with General Data Protection Regulation (GDPR) requirements and national data protection laws. The State Data Protection Inspectorate retains statutory supervisory powers over personal data processing within AI systems. Implementing legislation requires AI providers and deployers to maintain data governance, implement technical and organizational safeguards, and conduct fundamental rights and privacy impact assessments where required.

The State Data Agency leads national data governance through the State Data Lake initiative, providing secure, auditable access to public datasets for vetted public-sector AI projects and sandbox testing. Furthermore, the Lithuanian AI Regulatory Sandbox Policy incorporates Article 59 of the EU AI Act, authorizing limited further processing of personal data for public-interest AI sandbox projects under strict oversight, confidentiality controls, and data protection safeguards.

Sector-Specific Rules

Public-sector deployment of AI is subject to targeted guidance established by the Seimas Resolution of May 9, 2024. Public entities and municipal administrations deploying AI must maintain meaningful human oversight, ensure transparency and public disclosure of automated processes, maintain equality and non-discrimination, and guarantee that AI adoption does not diminish public service quality or compromise national security.

Beyond public-sector principles, the corpus holds no records of standalone, domain-specific AI statutes governing sectors such as autonomous vehicles, financial services, or healthcare AI. Instead, national strategies identify healthcare, manufacturing, agriculture, transport, and energy as strategic priorities for AI adoption, while directing sectoral oversight bodies to apply existing domain legislation alongside national AI market surveillance rules.

International Alignment

Lithuania's AI framework is directly aligned with European Union law. The national amendments adopted in 2025 (Acts XV-105 and XV-106) were created specifically to implement Regulation (EU) 2024/1689 (EU AI Act) and align domestic digital service supervision with Regulation (EU) 2022/2065 (Digital Services Act). Lithuania's designated market surveillance authority (RRT) acts as the official single contact point for cross-border cooperation with the European AI Office, the European AI Board, and partner Member States.

National policies, including the AI Regulatory Sandbox Policy and the 2023–2026 Action Plan, explicitly link domestic activities to EU coordinated plans and international standards. Lithuania participates in EU-wide regulatory learning, submits annual sandbox outcome reports to EU bodies, localized international educational initiatives such as "Elements of AI", and promotes regional Baltic cooperation in AI research and data infrastructure.

Future Developments

Full operationalization of Lithuania's AI regulatory framework is structured along a phased timetable extending through 2026. Key pending milestones include the commencement of the Innovation Agency's notified-body evaluation powers in August 2025, the planned public presentation and funding execution for the AI sandbox, and the target operational launch of testing and business consultations within the sandbox by January 1, 2026, ahead of the EU-wide sandbox operational deadline of August 2, 2026.

The National AI Governance Forum and EIMIN are progressing secondary regulations, technical documentation guidance, and sandbox entry procedures. Under the Law on Information Society Services amendments, national authorities must execute a three-year ex-post evaluation plan to evaluate the effectiveness of conformity mechanisms and sandbox operations, ensuring ongoing refinement of domestic AI governance in line with broader EU regulatory application dates.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT)	Designated national market surveillance authority and single point of contact under the EU AI Act and Law on Information Society Services.	Inspect technical documentation, request dataset/source code access, issue compliance orders, suspend or recall systems, impose administrative fines, and liaise with the European AI Office.
Innovation Agency (Inovacijų agentūra)	Designated national notifying authority and operator of the national AI regulatory sandbox (DI smėliadėžė).	Evaluate and notify conformity assessment bodies, manage public registry of notified bodies, administer sandbox testing environments, assess start-up innovation potential.
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)	National supervisory authority for data protection and privacy under GDPR and national law.	Supervise personal data processing in AI deployments, enforce privacy safeguards, oversee data processing within AI regulatory sandboxes.
Consumer Rights Protection Service (Valstybinė vartotojų teisių apsaugos tarnyba)	National consumer protection agency exercising sectoral oversight for digital services and AI applications.	Enforce consumer rights legislation, review fairness and transparency in consumer-facing AI systems.