Greece has enacted Law 5321/2026, supplementing EU Regulation 2024/1689 (AI Act). The Law establishes a national framework for supervising AI systems and supporting innovation, introduces several notable country-specific provisions and repeals the previous national AI legislation.
Beyond the EU baseline, the Law introduces sanctions for non-compliance and the right to effective judicial protection, stricter real-world testing requirements, a national AI registry for public sector AI, and designates the Hellenic Data Protection Authority (HDPA) as lead market surveillance authority alongside sector-specific regulators.
Supervision
The HDPA is designated as the market surveillance authority for prohibited AI systems, high-risk AI systems listed in Annex III of the AI Act, and AI systems subject to transparency obligations; HDPA will act as the national single point of contact for the AI Act. The HDPA is expected to establish a unified complaints submission system, through which it will receive complaints concerning alleged violations of the AI Act.
Additionally, the Hellenic Telecommunications and Post Commission (EETT) is appointed as the notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. The EETT will host the Coordination and Expertise Centre for AI, which will support market surveillance; the EETT will also host the AI regulatory sandbox, which will be operated jointly by EETT and HDPA.
Enhanced enforcement framework
Administrative sanctions
Law 5321/2026 grants the HDPA and the designated market surveillance authorities a toolkit of escalating measures, including warnings, orders, reprimands, and the administrative fines set out in Article 99 of the AI Act. The distinctly Greek addition is a periodic penalty mechanism: where a breach is committed by an undertaking, recurring financial sanctions may be imposed of up to 2% of average daily global turnover or income for the preceding financial year — a per-diem pressure tool that goes beyond the AI Act's own fines. In all cases, the authorities are required to ensure that sanctions are effective, proportionate, and dissuasive on a case-by-case basis.
Cost recovery: The competent supervisory authority may recover its full investigation costs from infringers, including the costs of testing, corrective measures and related storage.
Public naming: Enforcement decisions (including the infringer’s identity, the nature of the violations and the sanctions imposed) are published on the market surveillance authorities’ websites.
Judicial protection: Decisions imposing administrative sanctions may be challenged before the Council of State. The same applies to other individual administrative acts and regulatory acts issued under Law 5321/2026.
Criminal liability
Under Law 5321/2026, removing machine-readable labels from AI-generated synthetic content or obstructing deepfake disclosure obligations is punishable by imprisonment (10 days – 5 years) and a monetary penalty.
Compliance as a mitigating factor
When imposing administrative sanctions, competent authorities may additionally take into account: (i) whether the provider or deployer has taken adequate measures to ensure AI literacy among its staff; and (ii) whether the operator has voluntarily admitted the violation, in the context of a dispute settlement procedure to be established by the HDPA. Neither factor is expressly listed in the AI Act's sanctioning criteria. Both create a concrete compliance incentive for operators — AI literacy programmes and early admission of non-compliance may meaningfully reduce exposure.
Stricter real-world testing requirements
Where high-risk AI systems are tested in real-world conditions outside a regulatory sandbox, Law 5321/2026 requires express written authorization from the competent authority. Crucially, Law 5321/2026 disapplies the 30-day tacit approval mechanism that the AI Act would otherwise allow. This is a meaningful departure from the EU baseline and directly affects providers planning real-world pilots of high-risk AI systems in Greece.
National AI Registry for public sector
Beyond the EU-mandated database for high-risk AI systems, Greece introduces a national registry for all AI systems used by public sector entities — regardless of risk classification. While the registration obligation falls on public bodies, suppliers to the public sector will in practice need to provide the technical documentation required to complete it. This is worth addressing contractually. Existing deployments face a 31 December 2026 deadline.
What this means for your business
The Law signals a proactive regulatory stance. Depending on your role in the AI value chain, the following practical steps are worth considering now:
| If you.. | Key actions |
Develop AI systems | Review your AI Act compliance obligations; note the national enforcement and supervisory framework introduced by Law 5321/2026 and engage with the AI regulatory sandbox if relevant. |
Deploy AI systems in your operations | Audit your AI systems for classification; implement AI literacy programmes (relevant as a mitigating factor in enforcement) |
Supply AI solutions to the Greek public sector | Anticipate the documentation required for the national AI registry |
Have a whistleblowing scheme | Ensure your internal reporting channels cover AI Act violations. These are now expressly within the scope of Greek whistleblowing law |
Invest in an AI company | Assess the target’s compliance posture: its AI system classification, documentation practices, and AI literacy measures |
Operate in the public sector | Register all AI systems in use in the national registry by 31 December 2026 - regardless of risk level |
If you would like to discuss how your business can navigate and position itself ahead of these changes, we are ready to help you turn regulatory compliance into a competitive advantage.