Law 5321/2026 | Greece’s AI Act Implementing Framework

Greece now has its national implementation framework for the EU AI Act.

• Law 5321/2026 — Measures implementing Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Amendment of Law 4961/2022 and other provisions
• Passed by the Plenary of Parliament on 16 July 2026
• Published in the Government Gazette — ΦΕΚ Α΄ 114/20.07.2026
• 58 articles, of which Part A (Arts. 1–26) implements the AI Act; Parts B and C carry unrelated provisions

Greece is among the first Member States with a complete national mechanism. It lands thirteen days before the AI Act’s general application date of 2 August 2026.

Why this matters even though the AI Act is directly applicable

The Regulation applies of its own force. What a Member State must supply is the machinery:

• Which authority supervises which obligations
• How a complaint is filed
• What sanctions attach, and how they are imposed and published
• How the sandbox and real-world testing operate
• What the national courts review

Law 5321/2026 supplies all of it. A national framework does not create the obligation — it creates the enforcer.

The governance architecture (Arts. 3–7)

• Hellenic Data Protection Authority (ΑΠΔΠΧ / HDPA) — market surveillance authority (Art. 3) and single point of contact (Art. 4)
• EETT (Hellenic Telecommunications and Post Commission) — notifying authority (Art. 5)
• AI Coordination and Expertise Centre — established at EETT (Art. 6)
• Single complaints-submission system under the AI Act (Art. 7) — one national channel rather than a scatter of sectoral routes

What HDPA supervision means in practice:

• The regulator that already enforces the GDPR now also supervises prohibited practices, high-risk systems and Art. 50 transparency
• The AI Act and GDPR analyses converge in one authority — one file, one inspection, one enforcement theory
• Expect data-protection reasoning to shape early AI Act enforcement in Greece

Cooperation (Arts. 8–9)

• Art. 8 — cooperation between market surveillance authorities
• Art. 9 — HDPA cooperation with other authorities

Relevant where sectoral regulators (finance, health, transport, telecoms) already supervise the same product.

Notified bodies (Arts. 10–11)

• Art. 10 — procedure for assessing whether existing notified bodies under Union harmonisation legislation meet the Art. 31 AI Act conditions
• Art. 11 — designation of a notified body for the conformity assessment of certain high-risk AI systems

Practical read: Greece is building conformity-assessment capacity through the bodies that already exist, rather than from zero. Relevant to anyone whose product route runs through third-party assessment.

Innovation support (Arts. 12–15)

• Art. 12 — AI regulatory sandbox
• Art. 13 — real-world testing of high-risk AI systems outside the sandbox
• Art. 14 — documentation retention
• Art. 15 — designation of Greek representatives to the European AI Board

Note the timing: the AI Act requires national sandboxes to be operational by 2 August 2027. Greece has legislated the basis a year early.

Sanctions and remedies (Arts. 16–20)

• Art. 16 — Administrative sanctions. Effective, proportionate and dissuasive, and — significantly — capable of being imposed on public sector bodies
• Art. 17 — Publication of sanctions. Reputational exposure sits alongside the financial exposure
• Art. 18 — Recovery of supervision costs by market surveillance authorities. The supervised entity may carry part of the cost of being supervised
• Art. 19 — Right to judicial protection against decisions taken under the framework
• Art. 20 — AI Act infringements added to the scope of Law 4990/2022, by amendment of its Annex

Art. 20 is the sleeper provision. Law 4990/2022 is Greece’s whistleblower-protection statute, transposing Directive (EU) 2019/1937. Adding AI Act breaches to its Annex means:

• An employee reporting an AI Act infringement is a protected reporting person
• Organisations above the relevant thresholds must be able to receive and handle internal reports about AI Act compliance
• Retaliation exposure attaches to how you respond to an internal AI complaint
• Your internal reporting channel and your AI governance programme are now the same compliance problem

Most commentary on this law has not picked that up. It should be in your board briefing.

Public sector rules (Arts. 21–23)

• Art. 21 — Register of AI Systems. Held at the Special Secretariat for AI and Data Governance. Every public sector body intending to use an AI system must file a registration declaration before the system goes live
• Art. 22 — AI Observatory. Monitors implementation of the national AI strategy
• Art. 23 — Prohibition on removing the Art. 50 transparency markings on deepfake content

On Art. 23 — three points:

• It attaches to Art. 50, which applies from 2 August 2026 and did not move under the Digital Omnibus. This provision bites first, not on the deferred high-risk calendar
• It is a national addition with no direct AI Act equivalent — the Regulation obliges marking; Greece separately prohibits stripping it
• It sits in the chapter on public sector use of AI. Whether the prohibition is general or confined to that context is a question for the enacted text, not the press release

What happens to Law 4961/2022

• Law 5321/2026 amends Law 4961/2022 (Α΄ 146), Greece’s earlier horizontal technology statute
• The Special Secretariat describes the effect as replacing its AI-related provisions so that national law aligns fully with the AI Act
• Art. 26 carries the repealing provisions for Part A

Do not assume continuity. Anyone whose compliance documentation still cites Law 4961/2022 duties — algorithmic impact assessments, AI registries, employer notification of AI-assisted workplace decisions — needs to check each one against Arts. 25 and 26 rather than presume survival.

Also in the law, and easy to miss

Part B is a mixed vehicle. Two provisions are worth noting:

• Art. 38 — the first accounting period of the Hellenic Artificial Intelligence Factory S.A.
• Art. 47 — use of AI systems in the evaluation and management of State aid under the Partnership Agreement for Regional Development (adding Art. 59A to Law 4914/2022)

Art. 47 is a live example of the State deploying AI in a decision-making process with direct financial consequences for applicants — exactly the territory Annex III is concerned with.

The Digital Omnibus interaction

• Law 5321/2026 was published on 20 July 2026
• Regulation (EU) 2026/1744 — the Digital Omnibus on AI — entered into force on 27 July 2026
• The Greek law therefore implements the AI Act as it stood before the amendment

What follows:

• The moved Chapter III deadlines (2 December 2027 and 2 August 2028) flow from the Regulation and apply directly regardless of the national text
• The new prohibitions on non-consensual intimate imagery and CSAM (from 2 December 2026) likewise apply directly
• But read the national provisions against the amended Regulation, not the original — particularly anything drafted by reference to a date or a classification the Omnibus has since changed
• Expect corrective national amendment in due course

Immediate action points

For every organisation using AI in Greece:

• Map your systems against Art. 50 — the disclosure, labelling and marking duties apply from 2 August 2026
• Add AI Act breaches to your Law 4990/2022 internal reporting channel and to the training for whoever handles those reports
• Check whether your Law 4961/2022 documentation survives Arts. 25–26
• Identify your regulator contact route — HDPA for supervision, EETT for notification matters
• Do not treat the deepfake-label prohibition as remote — it is one of the first provisions with teeth

For public sector bodies:

• File the Art. 21 registration declaration before go-live — not after
• Registration is a precondition of operation, not a reporting formality

For providers routing through conformity assessment:

• Track the Art. 10 assessment of existing notified bodies
• Confirm which body will handle your product category before you need it

We advise providers, deployers, importers and distributors on:

• AI Act classification and conformity
• HDPA and EETT engagement
• Art. 50 transparency implementation
• The GDPR and whistleblowing interface
• Public sector registration and procurement
• Supplier and vendor contracting