Greece Adopts National Law Implementing The EU AI Act

Greek Law 5321/2026, enacted on 20 July 2026¹ (the Greek AI Law), establishes national implementing measures for Regulation (EU) 2024/1689² (the EU AI Act)³.
The Greek AI Law creates a comprehensive framework for the regulation of AI systems in Greece. Its objectives are to ensure a high level of protection for health, safety and fundamental rights, while fostering innovation through effective domestic implementation of the EU AI Act⁴.
Key areas addressed include the designation of national competent authorities for market surveillance, inter-authority cooperation mechanisms, the AI regulatory sandbox and real-world testing, administrative sanctions and judicial review, a Central AI Registry for public sector AI use and the establishment of an AI Observatory.
This Briefing provides a high-level overview of the principal features of the Greek AI Law.

The Greek AI Law establishes a multi-authority governance model for AI supervision in Greece.
The Hellenic Data Protection Authority (HDPA) is designated as the principal market surveillance authority. The HDPA is competent for AI systems falling within the prohibited practices under the EU AI Act, high-risk AI systems listed in Annex III and AI systems subject to transparency obligations⁵.
Existing sectoral market surveillance authorities retain supervisory competence for high-risk AI systems integrated into products covered by relevant EU harmonization legislation⁶. The HDPA is further designated as the single point of contact for communication with the EU AI Office and for reporting obligations under the EU AI Act⁷. The Hellenic Telecommunications and Post Commission (EETT) is designated as the national notifying authority⁸.
The Greek AI Law provides for the establishment of an AI Coordination and Expertise Centre within the EETT⁹ (the Centre). The Centre’s competencies include supporting competent authorities in applying the EU AI Act, providing advisory and technical support, delivering training and education, facilitating the development of codes of conduct and promoting innovation. The Centre will also provide resources for the operation of the AI regulatory sandbox and guidance on the application of the EU AI Act, with particular attention to SMEs and start-ups.
A unified complaints system is established at the HDPA for complaints concerning infringements of the EU AI Act¹⁰.
Specifically, sectoral market surveillance authorities receiving complaints are required to promptly notify the unified complaints system, determine within 30 days whether they have jurisdiction, and assess the complaint while updating the system on the progress of their examination within 60 days. Where a sectoral authority lacks jurisdiction, or fails to act within the prescribed time limits, the HDPA may assume competence to investigate the complaint, coordinate with the relevant authority where appropriate, issue a decision and impose any applicable sanctions, subject to the parties' right to be heard.
The Greek AI Law introduces a broad cooperation framework. Multiple public authorities, government ministries, and other bodies are required to cooperate with the HDPA for purposes of implementing the EU AI Act¹¹.

The Greek AI Law establishes an AI regulatory sandbox at the EETT, with the EETT and the HDPA designated as the competent authorities for its operation (the AI sandbox)¹². The AI sandbox is intended to provide a controlled environment for the development, testing and validation of innovative AI systems before their placement on the market or putting into service.
The EETT and HDPA are empowered to monitor real-world testing of high-risk AI systems conducted outside the AI sandbox and may request information concerning such testing. Real-world testing requires express written authorization from the competent authority and the expiry of the 30-day decision period does not constitute tacit approval¹³.
Where a provider or its authorized representative established in Greece declares bankruptcy or ceases its activity, the liquidator is required to maintain the technical documentation records required under the EU AI Act¹⁴.
An AI Observatory is established within the Ministry of Digital Governance, under the Special Secretariat for AI and Data Governance¹⁵. Its mission includes monitoring implementation of the National AI Strategy, identifying strategic priorities and opportunities and publishing reports on AI-related activities in Greece.

The Greek AI Law introduces specific governance and transparency measures concerning the use of AI systems by public sector bodies.
A unified AI systems registry (the Registry) is established within the Special Secretariat for Artificial Intelligence and Data Governance of the Ministry of Digital Governance¹⁶. The Registry records AI systems used by public sector bodies.
Every public sector body intending to deploy an AI system must file a registration declaration with the Registry before the system becomes operational¹⁷. Public sector bodies already using AI systems at the time of the Law’s entry into force must submit their registration declarations without delay and in any event no later than 31 December 2026¹⁸.

The Greek AI Law supplements the enforcement framework under the EU AI Act by establishing national procedures and conferring powers on competent authorities.
The HDPA and sectoral market surveillance authorities are empowered, by specifically reasoned decision and following a prior hearing of the parties concerned, to:
1.  issue warnings, compliance orders, and reprimands;
2. impose administrative fines in accordance with the EU AI Act¹⁹; and
3. impose or threaten periodic penalty payments which, for undertakings, may not exceed 2% of average daily total worldwide annual turnover or income in the preceding financial year²⁰.
Administrative sanctions must be effective, proportionate, and dissuasive in each individual case²¹.
In determining sanctions, the competent authorities may consider whether the provider or deployer has taken adequate measures to ensure a sufficient level of AI literacy among relevant personnel²². The authorities may also consider, under a dispute settlement procedure to be established by HDPA decision, whether the operator has acknowledged the infringement²³.
Fines and periodic penalty payments imposed by the HDPA constitute public revenue and are collected in accordance with the Code for the Collection of Public Revenue²⁴.
The HDPA and market surveillance authorities are required to publish their sanction decisions on their websites, including the sanctions imposed, the nature of the infringements and the identity of the infringer, while respecting confidentiality obligations²⁵. In the event of an administrative sanction, the competent authorities may require the sanctioned operator to bear the costs incurred in investigating and establishing non-compliance²⁶.
Sanction decisions may be challenged by way of annulment proceedings before the Council of State²⁷. The same remedy is available in respect of other individual administrative acts and regulatory acts adopted under the Law²⁸.
The Greek AI Law creates criminal offences for the removal of machine-readable labels on AI-generated synthetic content and for obstructing a deployer’s disclosure regarding deepfake content. These offences are punishable by imprisonment and a fine, unless the conduct is punishable more severely under another provision²⁹.

Identify regulatory touchpoints: The multi-authority governance model means that AI system operators may need to engage with multiple regulators, depending on the risk classification of their AI systems and the sectors in which those systems are deployed.
Review AI systems portfolio: Businesses should assess the risk classification of their AI systems under the EU AI Act, review their internal governance and compliance frameworks and identify any adjustments necessary to meet the requirements applicable to providers and deployers.
Invest in AI literacy: The Law expressly provides that adequate measures to ensure AI literacy may be considered a mitigating factor when sanctions are imposed. Developing and implementing AI literacy programmes for relevant personnel is both a compliance measure and a practical risk management tool.
Public sector engagement: Businesses that supply AI systems to public sector bodies should be aware of the Registry requirements and the transparency obligations applicable to their public sector clients. Proactive engagement in relation to compliance documentation may facilitate procurement processes.
Monitor sandbox opportunities: The AI sandbox intends to offer a structured environment for testing innovative AI systems with regulatory guidance. Businesses developing novel AI applications may benefit from engaging with the sandbox framework once operational.

This Briefing was prepared with the assistance of Trainee Attorney Eirini Vyzirgiannaki.

Footnotes

^{1 Greek Law 5321/2026 on ‘Measures for the implementation of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act) – Amendments to Law 4961/2022 (Government Gazette A’ 146) and other provisions’ (Government Gazette Α’ 114/20.7.2026).
2 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonized rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act).
3 For additional insight into the EU AI Act, please refer to our previous briefing from May 2024 here.
4 Article 1 of the Greek AI Law.
5 Article 3(1) of the Greek AI Law; Article 70(1) of the EU AI Act.
6 Article 3(2) of the Greek AI Law.
7 Article 4 of the Greek AI Law; Article 70(2) of the EU AI Act.
8 Article 5 of the Greek AI Law; Article 28(1) of the EU AI Act.
9 Article 6(1) of the Greek AI Law.
10 Article 7(1) of the Greek AI Law.
11 Articles 8 and 9 of the Greek AI Law.
12 Article 12(1) of the Greek AI Law; Articles 57 and 58 of the EU AI Act.
13 Article 13(2) of the Greek AI Law; cf. Article 60(4) and Article 60(4)(b) of the EU AI Act.
14 Article 14 of the Greek AI Law; Article 18(1) of the EU AI Act.
15 Article 22 of the Greek AI Law.
16 Article 21(1) of the Greek AI Law.
17 Article 21(2) of the Greek AI Law.
18 Article 25(2) of the Greek AI Law.
19 Article 99 of the EU AI Act. Specifically, infringements may result in administrative fines of up to €35m or 7% of worldwide annual turnover (for prohibited AI practices), up to €15m or 3% of worldwide annual turnover (for breaches of other key obligations related to operators and notified bodies), and up to €7.5m or 1% of worldwide annual turnover (for supplying incorrect, incomplete or misleading information to competent authorities), with reduced caps applying to SMEs and start-ups.
20 Article 16(1)(a) through (e) of the Greek AI Law; Article 99 of the EU AI Act. The powers set out in Article 16(1) of the Greek AI Law are in addition to those under the EU AI Act and Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 on market surveillance and compliance of products.
21 Article 16(2) of the Greek AI Law.
22 Article 16(3) of the Greek AI Law; Article 4 of the EU AI Act.
23 Article 16(4) of the Greek AI Law.
24 Article 16(6) of the Greek AI Law; Law 4978/2022.
25 Article 17(1) and (3) of the Greek AI Law; Article 78 of the EU AI Act.
26 Article 18(1) of the Greek AI Law.
27 Article 19(1) of the Greek AI Law.
28 Article 19(2) of the Greek AI Law.
29 Article 23 of the Greek AI Law; Articles 50(1) and 50(4) of the EU AI Act.}