Cyprus
EU AI Act implementation, 2026
Cyprus designated its AI Act authorities by Council of Ministers decision in January 2025, centralising the notifying, market surveillance and single-point-of-contact roles in the Commissioner of Communications (OCECPR), and in August 2026 put a full 'Artificial Intelligence Law of 2026' with Article 99-level fines and a sandbox out for consultation; the law and penalty regime are not yet enacted.
- Implementing law
- In consultationAug 2026
- Penalty regime (Art. 99)
- Not adopted
- Regulatory sandbox
- Planned
- Readiness rank
- 12 of 27score 62 / 100
Key findings
- Cyprus chose a centralised model: OCECPR is notifying authority, market surveillance authority and single point of contact by Council of Ministers decision of 22 January 2025, well ahead of the August 2025 deadline.
- The designation rests on a cabinet decision, not statute; the Commission lists OCECPR as 'pending final adoption' and the AI Law of 2026 is meant to give it a legal base and an AI Regulation Directorate.
- National penalties mirroring Article 99 (up to EUR 35m or 7%), a complaints mechanism and a sandbox are all in the draft law, whose consultation closed 16 September 2026; parliamentary passage is still ahead.
- The Data Protection Commissioner and (under the draft law) the Central Bank of Cyprus hold sectoral market surveillance roles; Article 77 fundamental-rights bodies are designated separately.
- A separate deepfake law passed in March 2026 and a new 2032 AI strategy is in preparation, but the 2020 strategy remains the only adopted one.
National authorities
Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR / ΓΕΡΗΕΤ)
Market surveillance authority (general), notifying authority and single point of contact by Council of Ministers decision of 22 Jan 2025; a 2026 amending bill would create an AI Regulation Directorate within the Office
gov.cy (opens in new tab)Commissioner for Personal Data Protection
Market surveillance authority for high-risk AI systems in data-protection-sensitive Annex III areas (scope described differently across sources)
straitsai.institute (opens in new tab)Central Bank of Cyprus
Supervision of high-risk AI systems used by financial institutions (per the 2026 draft law)
cyprus-mail.com (opens in new tab)Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR)
digital-strategy.ec.europa.eu (opens in new tab)Commissioner of Communications (OCECPR) – listed by the Commission as 'pending final adoption'
Implementing law, penalties and sandbox
Ο περί της Τεχνητής Νοημοσύνης Νόμος του 2026 (Artificial Intelligence Law of 2026), with a parallel amending bill creating an AI Regulation Directorate at OCECPR
Aug 2026
oeb.org.cy (opens in new tab)No national penalty rules under Article 99 are in force; regulators rely on existing powers.
The 2026 draft law provides for an AI Regulatory Sandbox for startups and researchers to test systems under real-world conditions; not yet operational.
cyprus-mail.com (opens in new tab)National Artificial Intelligence Strategy of Cyprus (2020); successor 'National AI Strategy to 2032' in consultation during 2026
2020
ai-watch.ec.europa.eu (opens in new tab)Notable developments
-
Council of Ministers designates national competent authorities
Decision of 22 January 2025: the Deputy Ministry of Research, Innovation and Digital Policy becomes national coordinator and AI Board representative; the Commissioner of Communications takes the notifying, market surveillance and single-point-of-contact roles; the Data Protection Commissioner supervises high-risk systems in its domain. A National AI Taskforce under the Chief Scientist was created the same day.
straitsai.institute (opens in new tab) -
House approves deepfake amendment to copyright law
In March 2026 Parliament approved an amendment to the Copyright and Related Rights Law 59/1976 creating a sui generis right against unauthorised deepfake imitation of a person's likeness, voice and other characteristics, with civil remedies and criminal sanctions; it is separate from AI Act implementation.
legal500.com (opens in new tab) -
Draft National AI Strategy to 2032 opened for consultation
The National AI Taskforce and the Deputy Ministry put a draft strategy to make Cyprus an Eastern Mediterranean AI hub by 2032 through public consultation in 2026; on 15 October 2026 Deputy Minister Damianou presented it as 'our new AI Strategy', but formal adoption had not been confirmed.
cyprus-mail.com (opens in new tab) -
AI Law of 2026 put out for public consultation with EUR 35m fines
Two bills entered e-consultation until 16 September 2026: the AI Law of 2026 (fines up to EUR 35m/7% for prohibited practices, EUR 15m/3% for operator breaches, EUR 30,000 rising to 60,000 for minor/repeat offences, up to six months' imprisonment or EUR 10,000 for obstructing officials, a complaints route, administrative-court appeal and an AI regulatory sandbox) and an amending bill creating an AI Regulation Directorate in the Office of the Commissioner of Communications.
cyprus-mail.com (opens in new tab) -
Commission list records OCECPR as SPOC 'pending final adoption'
The Commission's single-point-of-contact list (7 Sept 2026) names the Commissioner of Communications for Cyprus with an asterisk indicating national adoption is not yet final.
digital-strategy.ec.europa.eu (opens in new tab)
Analysis
Cyprus is the clearest example in this group of a small state using a cabinet decision to meet the governance deadline on time and then backfilling the legislation. Concentrating the three Article 70 functions in the telecoms and postal regulator avoids the coordination problems that have paralysed Belgium and Austria, and OCECPR's lead on the 2026 bill shows the regulator itself is driving the design, including a dedicated AI Regulation Directorate inside its office.
What is still missing is the hard law. Without the AI Law of 2026, OCECPR cannot impose the Article 99 fines, run the statutory complaint procedure or operate the sandbox, which is why the Commission flags the designation as pending final adoption. The bill's fine schedule tracks the EU maxima and adds a Cypriot layer of minor-offence fines and criminal liability for obstructing officials, which is stricter than several larger member states have proposed.
The next milestones are cabinet approval of the post-consultation text and a House of Representatives vote, plausibly in late 2026 or early 2027, followed by formal notification to the Commission. With Annex III high-risk duties postponed to December 2027 by the Digital Omnibus, Cyprus has room to enact the law and stand up the Directorate before the obligations with the heaviest supervisory load take effect.
EU AI Act 2026 Q3 Report
All 27 member-state profiles including Cyprus, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.
Sources
- Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR / ΓΕΡΗΕΤ) (opens in new tab) gov.cy
- Commissioner for Personal Data Protection (opens in new tab) straitsai.institute
- Central Bank of Cyprus (opens in new tab) cyprus-mail.com
- Notifying authority: Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR) (opens in new tab) digital-strategy.ec.europa.eu
- Ο περί της Τεχνητής Νοημοσύνης Νόμος του 2026 (Artificial Intelligence Law of 2026), with a parallel amending bill creating an AI Regulation Directorate at OCECPR (opens in new tab) oeb.org.cy
- National Artificial Intelligence Strategy of Cyprus (2020); successor 'National AI Strategy to 2032' in consultation during 2026 (opens in new tab) ai-watch.ec.europa.eu
- House approves deepfake amendment to copyright law (opens in new tab) legal500.com
- Draft National AI Strategy to 2032 opened for consultation (opens in new tab) cyprus-mail.com