Act no. 5321/2026: The Greek Legal Framework for the Supervision of Artificial Intelligence Systems

National Implementing Measures and Supplementary Provisions to the AI Act

The Act no. 5321/2026 establishes the national framework for the implementation of Regulation (EU) 2024/1689 (AI Act) in Greece and sets out the supervisory framework applicable to AI systems at national level.

Regulation (EU) 2024/1689 ("AI Act"), which was adopted on 12 July 2024, lays down a uniform legal framework to foster the uptake of human-centric and trustworthy artificial intelligence ("AI"), while safeguarding health, safety and fundamental rights, and supporting innovation across the internal market. The bulk of the AI Act's provisions became applicable on 2 August 2026. Although the Regulation is directly applicable in all EU Member States, its effective operationalization at national level requires additional implementing measures. In Greece, on 20 July 2026, Law 5321/2026 was published in the Government Gazette (GG Α’/114/20.07.2026), introducing the national measures for the implementation of Regulation (EU) 2024/1689 (AI Act). This new supplementary domestic law aims to shape a national supervisory framework for AI systems and to promote innovation, in line with the requirements of the Regulation. Law 5321/2026 particularly regulates: (a) the designation and staffing of the national market supervisory authorities, the Single Point of Contact and the notifying authority; (b) cooperation and coordination among the competent authorities; (c) AI regulatory sandboxes and the testing of AI systems in real-world conditions; (d) enforcement procedures and administrative sanctions; (e) judicial and administrative remedies; (f) the establishment of a registry of AI systems used by public sector bodies; (g) the operation of the Artificial Intelligence Observatory; and (h) specific transparency obligations relating to synthetic or manipulated audio-visual content (deepfakes). 


1. The HDPA as National Supervisory Authority

The Hellenic Data Protection Authority ("HDPA") is designated as the competent market surveillance authority in relation to: (a) AI systems falling within the prohibited practices under the Regulation; (b) high-risk AI systems listed in Annex III; and (c) systems subject to the transparency obligations under Article 50 of the Regulation.

In addition, the HDPA:

• acts as the Single Point of Contact, with the primary role of ensuring coordination and communication among the national competent authorities, the European Commission, the EU AI Office and other Member States;
• is responsible for managing the Single Complaints Submission System for infringements of the AI Act;
• is designated as a Notified Body for the conformity assessment of high-risk biometric AI systems intended to be put into service by law enforcement, migration and asylum authorities. The role of notified bodies is to carry out ex-ante conformity assessments of high-risk AI systems, in accordance with the Regulation, prior to their placing on the market; and
• cooperates with other authorities and bodies for the purposes of the AI Act and the Greek implementing Law.
   

2. Other national authorities and bodies

•  Sectoral supervisory authorities: Existing market surveillance authorities already designated in Greece under legislation transposing another EU Directive or implementing another EU Regulation are designated as the market surveillance authorities for high-risk AI systems associated with the products covered by that Union harmonisation legislation. By way of example, these include the National Organisation for Medicines (EOF) (for medical devices and in vitro diagnostic medical devices), the Hellenic Telecommunications and Post Commission (EETT) (for radio equipment) and DIMEA / the General Secretariat for Trade and Consumer Protection (for toys), among others.
• Notifying Authority: Law 5321/2026 designates the Hellenic Telecommunications and Post Commission (EETT) as the notifying authority. Its principal responsibility is to set up and carry out the necessary procedures for the assessment, designation and notification of conformity assessment bodies (notified bodies), as well as their ongoing monitoring.
• Notified Bodies: Law 5321/2026 lays down the procedure through which a conformity assessment body for AI systems may be assessed, designated and formally notified to the European Commission. In Greece, this assessment is carried out by EETT, acting as Notifying Authority, in accordance with the procedures and conditions set out in the Law and the Regulation.
• AI Coordination and Expertise Centre: This Centre is established within EETT. Its role is to provide technical support to the market surveillance authorities and to EETT; to provide advisory support to the HDPA in relation to its coordinating role; to train and build the capacity of the market surveillance authorities; to contribute to the drawing-up of codes of conduct; and to support the operation of the AI Regulatory Sandbox.

Law 5321/2026 also establishes several dedicated governance and oversight mechanisms designed to facilitate the implementation, monitoring and supervision of AI systems, including the following:

• The Public-Sector AI Systems Registry: is intended to record the AI systems used by public sector bodies and thereby enhance transparency, accountability and effective oversight of AI use in public administration. This registry is considered as one of the Greek Law's most notable innovations. For systems already in operation, registration must be completed by 31 December 2026;
  
• The AI Observatory: will operate the central mechanism for monitoring the implementation of the National AI Strategy and the evolution of the relevant ecosystem in Greece. Its purpose is to support evidence-based policymaking and the responsible development of artificial intelligence.
• Single Complaints Submission System at the HDPA: this operates as a central point of reference for potential infringements of the AI Act, with the aim of facilitating the lodging of complaints, ensuring that they are handled more effectively and enhancing coordination among the competent supervisory authorities. Any natural or legal person with grounds to consider that the provisions of the AI Act and the supplementary national law have been infringed may lodge a complaint.
  
  Where a complaint concerns a matter falling within the competence of a market surveillance authority other than the HDPA, the HDPA forwards the complaint to the competent authority and informs the complainant of that transmission. Where a complaint is lodged directly with a market surveillance authority other than the HDPA, the receiving authority notifies the single complaints submission system without undue delay, in compliance with the applicable transparency obligations, and rules on the complaint where it considers itself competent. In case of a lack of competence, the HDPA refers to the competent authority or rules on it itself.

3. Accountability, enforcement and administrative sanctions

This newly established Law lays the national framework for the implementation of the AI Act, providing for administrative sanctions, the publication of decisions, the recovery of supervisory costs and the availability of judicial remedies in cases of non-compliance. In this context, Law 5321/2026 also introduces the possibility of imposing periodic penalty payments, while, in determining the level of sanctions, consideration may be given, among other factors, to measures taken to promote AI literacy and to the voluntary disclosure of infringements.

Furthermore, the scope of the whistleblower protection legislation is extended to cover infringements of the AI Act as well, thereby enabling the effective enforcement of the new regulatory framework.
 

4. Fostering innovation

Law 5321/2026 places particular emphasis on fostering innovation and facilitating the responsible development of AI technologies by establishing, among other measures:

• The AI Regulatory Sandbox: The regulatory sandbox provides a controlled environment that fosters innovation and facilitates the development, training, testing and validation of innovative AI systems for a limited period before they are placed on the market or put into service, in accordance with a specific sandbox plan agreed between the provider (or prospective provider) and the competent authority. EETT and the HDPA are designated as the competent authorities responsible for the operation of the AI regulatory sandbox, which is to be established within EETT. EETT will issue a call inviting providers or prospective providers of an AI system to apply to take part, in accordance with the Law and Articles 57, 58 and 59 of the AI Act. Its operation is supported by the AI Coordination and Expertise Centre.

The law further provides the cooperation between the regulatory sandbox and entities such as "PHAROS AI FACTORY", "ELKAK" and the European Digital Innovation Hubs.

• Testing of high-risk AI systems in real-world conditions: The new law establishes the framework for testing high-risk AI systems in real-world conditions outside the regulatory sandbox, adopting a stricter approach than that of the AI Act. The HDPA and the competent market surveillance authorities monitor, within the scope of their respective competences, the conduct of real-world testing of high-risk AI systems and may request information from providers or prospective providers in relation to such testing. Both real-world testing and its testing plan require the prior written approval of the HDPA or the competent market surveillance authority before testing can begin. 

5. Deepfakes: enhancing transparency and protection against misleading synthetic content

Law 5321/2026 also introduces a notable safeguard for deepfake content by prohibiting the removal of transparency markings from synthetic or manipulated image, audio and video content. The measure is intended to strengthen transparency and facilitate the identification of AI-generated or AI-manipulated content. Any breach of this obligation is liable to a term of imprisonment and a fine, unless subject to a more severe penalty under another provision.

6. Repeal of provisions of Act on “Emerging Information and Communication Technologies, enhancement of digital governance and other provisions”

As of the entry into force of Law 5321/2026, Chapter B of Part A of Law 4961/2022 (Government Gazette A' 146), entitled "Provisions for the Development of Artificial Intelligence", is repealed. In particular, the following are repealed:

• the general provisions on the use of AI systems by public-sector bodies;
• the algorithmic impact assessment for public-sector bodies using AI systems;
• the transparency obligations for public-sector bodies using AI systems;
• the obligations of AI-system contractors in the context of public contracts for the design or development of an AI system, as well as in supply or service contracts;
• the obligation of each public-sector body to maintain its own registry of the AI systems it uses;
• the obligation to provide information on the use of AI in the employment context;
• the provisions on the obligation of each private-sector undertaking to maintain a registry of AI systems and a policy on the ethical use of data in relation to the AI systems it uses;
• the AI Coordination Committee;
• the Supervisory Committee for the National Strategy for the Development of Artificial Intelligence;
• the AI Observatory and its obligations as previously provided for under that law.

7. What this means for businesses

• Artificial intelligence is brought within a structured framework of regulatory compliance and supervision, at both European and national level.
• Enhanced accountability, oversight and record keeping requirements apply to those involved in both the development and the deployment of AI systems.
• Failure to comply with the transparency obligations and the other requirements of the Regulation and the law may give rise to administrative sanctions, the recovery of supervision costs and financial penalties.
• The Single Complaints System, together with the role of the market surveillance authorities, enhances transparency and reinforces the need for AI-system providers to comply with the requirements of the AI Act.
• Reports of infringements of the AI Act now fall within the scope of the whistleblower protection regime.
• The use of generative AI and of synthetic or manipulated image, audio or video content (deepfakes) is now subject to enhanced transparency obligations, breach of which attract significant sanctions.
• Innovation, safety and the compliance of AI systems intended to be placed on the market are strengthened through the possibility of testing and validating such systems within the AI Regulatory Sandbox, as well as in real-world conditions (in the case of high-risk AI systems).
• Conformity assessment bodies for AI systems seeking designation as notified bodies apply to EETT (the notifying authority) for verification that they satisfy the conditions laid down in the Regulation. 
• For providers of biometric AI systems, certification of compliance with the Regulation should preferably be obtained from a notified body rather than by way of internal assessment.

Conclusions

Law 5321/2026 constitutes the first comprehensive national legislative framework introducing measures supplementary to the Artificial Intelligence Act in Greece, including the establishment of competent authorities, supervisory mechanisms and the core governance structures for artificial intelligence. The new provisions have direct implications for providers, developers, deployers and users of AI systems, as well as for individuals affected by their use. With the national regulatory framework now established, the emphasis shifts to its consistent enforcement and effective supervision by the competent authorities, as well as to the timely alignment of organisations with the compliance, transparency, governance and risk management obligations arising under the AI Act. The Law is available here .