Cyprus Draft AI Law 2026: How the AI Act Will Be Enforced Locally
Introduction
Cyprus has published a draft law that sets out how the EU Artificial Intelligence Act will be supervised and enforced locally. The draft Artificial Intelligence Law of 2026 (Ο περί της Τεχνητής Νοημοσύνης Νόμος του 2026), dated 12 August 2026, went to public consultation on the government's e-Consultation platform until mid-September 2026.
The AI Act (Regulation (EU) 2024/1689) applies directly in every Member State. What it leaves to national law is the machinery: who supervises, what powers they hold, how penalties are imposed and how firms can test AI under regulatory oversight. The Cyprus draft fills that gap. For CySEC- and CBC-regulated firms, it also confirms who will be knocking on the door when AI is used in high-risk financial processes.
The Big Picture
The draft is an enforcement statute, not a second AI rulebook. It adds no new Cypriot obligations on AI; it designates the authorities, gives them powers and sets the penalty regime the AI Act requires Member States to adopt.
Scope (Article 3): the law applies to the persons and sectors defined in Article 2 of the AI Act as providers, deployers, importers, distributors and authorised representatives of AI systems.
Primacy of the AI Act (Article 4): terms not defined in the law take their AI Act meaning, and where the two conflict, the Regulation prevails.
Structure: 25 articles covering competent authorities, the notifying authority, market surveillance, serious-incident reporting, information and investigation powers, sanctions, registration of high-risk systems, appeals, complaints, real-time biometric identification and the AI regulatory sandbox.
Companion bill: an amendment to the Electronic Communications and Postal Services Regulation Law creates a new AI Regulation Directorate within the Office of the Commissioner of Communications to carry out these functions.
Entry into force (Article 25): on publication in the Official Gazette of the Republic.
Who Will Supervise AI in Cyprus
Article 5 of the draft spreads supervision across three named authorities, with the Commissioner of Communications at the centre.
Supervisory Powers and Penalties
The competent authorities would receive familiar supervisory tools, backed by fines that mirror the AI Act ceilings.
Powers
Information requests (Article 12): authorities may require technical, financial and other information from any natural or legal person. The information is confidential, subject to proportionate disclosure.
Investigations (Article 13): on-site inspections and audits of any premises other than a dwelling, at any reasonable time, and summoning witnesses for oral or written statements.
Obstruction: obstructing an official is a criminal offence, punishable by up to six months’ imprisonment, a fine of up to €10,000, or both.
Administrative measures and fines
Measures scale with severity: a written warning with a deadline to remedy, withdrawal of the AI system from the market, or recall (including deactivation and return to the provider).
For undertakings the higher of the fixed amount and the turnover percentage applies. For SMEs and start-ups it is the lower, and the lower-of rule also extends to small mid-caps for the second and third tiers.
Due process: before a decision, the firm must be notified and given at least 10 working days to make written submissions or request a hearing. Decisions are reasoned and may be published. In urgent cases, measures can be taken first and the firm heard promptly afterwards.
The listed factors for setting a fine reward good conduct: self-reporting, cooperation, mitigation of harm and the technical and organisational measures already in place all count. Documented AI governance is therefore a direct mitigant.
Sandbox, Complaints, Appeals and Timing
AI regulatory sandbox (Article 22): run jointly by the Commissioner of Communications and the Commissioner for Personal Data Protection, with priority access for SMEs, start-ups and small mid-caps established in the EU. The authorities must also provide training, guidance channels and support for SME participation in standard-setting.
Complaints (Article 19): any person may complain about a suspected infringement.
Appeals (Article 18): decisions can be challenged before the Administrative Court under Article 146 of the Constitution.
Serious incidents and registration (Articles 11 and 16): the draft sets national arrangements for reporting serious incidents and registering high-risk AI systems.
The national law arrives against an EU timetable that the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) has moved back:
The extra time for high-risk systems is a window to prepare, not a reason to wait. Prohibitions and AI literacy duties already apply, and once the law is enacted Cyprus will have authorities empowered to enforce them.
What Firms Should Do Now
Build an AI inventory. Record every AI system you develop, buy or use, including AI features embedded in vendor platforms, and your role for each (provider, deployer, importer or distributor).
Classify by risk. Confirm that nothing falls under the Article 5 prohibitions, and flag Annex III uses such as creditworthiness assessment, life and health insurance pricing, recruitment and employee monitoring.
Identify your supervisor. CBC-supervised entities should expect CBC oversight of high-risk financial uses. CySEC-regulated firms should monitor how the final law allocates their supervision.
Close the AI literacy gap. Article 4 of the AI Act already requires staff who operate or use AI to have sufficient AI literacy. Document the training.
Embed AI in governance. Assign board-level accountability, add AI to the risk register, and align it with your DORA ICT-risk, outsourcing and GDPR frameworks.
Prepare the evidence file. Keep the technical documentation, risk assessments, human-oversight arrangements and transparency notices that an inspector would request under Articles 12 and 13 of the draft.
Review vendor contracts. Secure information, audit and cooperation rights from AI suppliers, so you can answer an authority’s request on time.
How ENAH Can Help
ENAH Services supports regulated firms with AI Act gap assessments, AI inventories and risk classification, AI governance policies, and AI Act training for boards and staff. Contact us to discuss your readiness.
