Framework in place GR Verified 21 Oct 2026

Greece

EU AI Act implementation, 2026

Greece enacted Law 5321/2026 (Government Gazette A' 114, 20 July 2026), making the Hellenic Data Protection Authority the main market surveillance authority and single point of contact and EETT the notifying authority and host of an AI coordination centre and sandbox, roughly a year after the designation deadline.

Implementing law
EnactedJul 2026
Penalty regime (Art. 99)
Adopted
Regulatory sandbox
Planned
Readiness rank
10 of 27score 74 / 100

Key findings

  • Law 5321/2026 (Gazette A' 114 of 20 July 2026) is Greece's complete AI Act implementing act, replacing the AI provisions of Law 4961/2022.
  • The HDPA is both principal market surveillance authority (prohibited practices, Annex III, Article 50) and single point of contact; sector product authorities keep Annex I products.
  • EETT is the notifying authority and hosts the AI Coordination and Expertise Centre and the regulatory sandbox, jointly run with the HDPA.
  • The law provides administrative sanctions, periodic penalty payments, publication of decisions and a criminal offence for stripping deepfake labels; specific fine amounts were not confirmed from the official text.
  • Resourcing of the HDPA is the open risk: its own opinion on the draft and commentators flag that the combined conformity-assessment and surveillance roles need staff and funding.

National authorities

Market surveillance

Hellenic Data Protection Authority (ΑΠΔΠΧ / HDPA)

Principal market surveillance authority for prohibited practices (Chapter II), Annex III high-risk systems and Article 50 transparency obligations; single point of contact; runs the unified complaints mechanism; also designated as notified body for certain law-enforcement/migration biometric systems.

ey.com (opens in new tab)
Market surveillance

Sectoral product authorities (e.g. EOF for medical devices, EETT for radio equipment)

Market surveillance of Annex I high-risk AI embedded in products under their existing product legislation, with HDPA coordinating.

ey.com (opens in new tab)
Notifying authority

Hellenic Telecommunications and Post Commission (ΕΕΤΤ / EETT)

ey.com (opens in new tab)
Single point of contact (Art. 70(2))

Hellenic Data Protection Authority (listed by the European Commission as Greece's single point of contact)

Implementing law, penalties and sandbox

Implementing law Enacted

Law 5321/2026 – Measures for the implementation of Regulation (EU) 2024/1689 and amendment of Law 4961/2022 (ΦΕΚ Α' 114/20.07.2026)

Jul 2026

taxheaven.gr (opens in new tab)
Penalty regime Adopted

National rules on penalties under Article 99 have been laid down.

Regulatory sandbox Planned

Law 5321/2026 establishes an AI regulatory sandbox at EETT, with EETT and the HDPA as joint competent authorities (confirmed by the HDPA's own press release); EETT is to issue calls for applications and eligibility criteria are left to secondary regulation. The law also provides for real-world testing of high-risk systems with explicit written approval from the HDPA or the relevant market surveillance authority. No operational cohort confirmed as of October 2026.

ey.com (opens in new tab)
National AI strategy

A Blueprint for Greece's AI Transformation (Special Secretariat for Foresight advisory committee)

2024

foresight.gov.gr (opens in new tab)

Notable developments

  1. National AI blueprint published

    The advisory committee under the Special Secretariat for Foresight released 'A Blueprint for Greece's AI Transformation', proposing central coordination by the Ministry of Digital Governance, a national AI supervisory authority and an interministerial committee, plus six flagship projects.

    foresight.gov.gr (opens in new tab)

  2. Draft implementing law put to public consultation

    The Ministry of Digital Governance consulted on the draft AI Act implementation law from 21 June to 6 July 2026; the HDPA's opinion on the draft (reported as Opinion 9/2026) stressed that its new mandate needs adequate staffing and funding.

    legal500.com (opens in new tab)

  3. Parliament adopts Law 5321/2026; published in the Gazette

    Adopted by the Hellenic Parliament in July 2026 and published in Government Gazette A' 114 on 20 July 2026, the law designates the HDPA and EETT, creates a unified complaints mechanism, establishes an AI Coordination and Expertise Centre at EETT, provides administrative sanctions and periodic penalty payments, criminalises removal of transparency labels from deepfakes, and creates a public-sector AI systems registry (Article 21).

    ai.gov.gr (opens in new tab)

  4. Digital Omnibus on AI defers high-risk obligations

    Regulation (EU) 2026/1744 (in force 27 July 2026) moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, so the HDPA's heaviest supervisory load is deferred while transparency and prohibited-practice enforcement apply now.

    actuia.com (opens in new tab)

  5. Public-sector AI registry deadline

    Public bodies must register AI systems already in operation in the new Unified Register of AI Systems by 31 December 2026, per the transitional provisions of Law 5321/2026.

    ey.com (opens in new tab)

Analysis

Greece went from 'authorities not yet appointed' on the FLI tracker to a fully enacted framework within weeks in summer 2026. The Ministry of Digital Governance's draft was consulted from 21 June to 6 July 2026, passed Parliament in mid-July and was gazetted on 20 July, eleven days before the AI Act's governance and penalty provisions applied. The design is data-protection-centric: the HDPA takes the fundamental-rights-heavy work (prohibited practices, Annex III high-risk, transparency) and the European contact-point role, while EETT, the telecoms regulator, takes the technical infrastructure (notifying authority, coordination and expertise centre, sandbox).

That split is coherent but concentrates a great deal on an authority that has historically been under-resourced. The HDPA's opinion on the draft explicitly conditioned success on staffing and funding, and the law also makes the HDPA a notified body for certain biometric systems used by law enforcement and migration authorities, combining assessment and surveillance roles in one body. The AI Coordination and Expertise Centre at EETT is meant to backstop this with technical support, training and help drafting codes of conduct.

For operators, the near-term items are concrete: a unified complaints channel at the HDPA, a criminal offence for removing deepfake labels, a public-sector AI register with a 31 December 2026 registration deadline, and a sandbox whose calls EETT has yet to issue. With the Digital Omnibus pushing Annex III enforcement to December 2027, Greece has enacted its framework ahead of the heaviest obligations, which is more than several larger member states can say, but the readiness score is held back by the absence of a running sandbox and unverified fine schedules.

PDF edition

EU AI Act 2026 Q3 Report

All 27 member-state profiles including Greece, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.

* You will also be subscribed to my newsletter. No spam, unsubscribe any time.

Sources

  1. Hellenic Data Protection Authority (ΑΠΔΠΧ / HDPA) (opens in new tab) ey.com
  2. Law 5321/2026 – Measures for the implementation of Regulation (EU) 2024/1689 and amendment of Law 4961/2022 (ΦΕΚ Α' 114/20.07.2026) (opens in new tab) taxheaven.gr
  3. A Blueprint for Greece's AI Transformation (Special Secretariat for Foresight advisory committee) (opens in new tab) foresight.gov.gr
  4. National AI blueprint published (opens in new tab) foresight.gov.gr
  5. Draft implementing law put to public consultation (opens in new tab) legal500.com
  6. Parliament adopts Law 5321/2026; published in the Gazette (opens in new tab) ai.gov.gr
  7. Digital Omnibus on AI defers high-risk obligations (opens in new tab) actuia.com