EU AI Act in Cyprus: Authorities, Enforcement, and What Companies Must Do

Cyprus is one of the EU's early movers on the AI Act. While several Member States blew through the 2 August 2025 deadline in Article 70, Cyprus designated its national authorities by Council of Ministers decision in January 2025 — ahead of schedule. The lead body is the Commissioner of Communications, with the data protection authority co-supervising the most rights-sensitive systems. That clarity is unusual for a small state, and it is good news for Cypriot companies: you know who to deal with.

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Cyprus. This guide sets out the designated authorities, how the timeline reads after the Digital Omnibus, the penalties, and what Cypriot providers and deployers should do now.

---

A Regulation, Not a Directive: No Cypriot Transposition Needed

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and applies directly in Cyprus under Article 288 of the Treaty on the Functioning of the European Union — no Cypriot statute is required for the obligations to bind. Article 5's prohibited practices have applied since 2 February 2025, Article 4 AI literacy since the same date, and the Chapter V GPAI duties since 2 August 2025.

What Cyprus had to provide — and did, early — is the enforcement infrastructure: a designated market surveillance authority, a notifying authority, and a single point of contact for the EU AI Office. Dedicated national implementing legislation, which fleshes out domestic procedure, was still in preparation as of mid-2026, but the authority designations are already in force.

---

Who Enforces the EU AI Act in Cyprus?

By a Council of Ministers decision of January 2025, Cyprus set a centralised model with a defined co-supervisor for sensitive domains.

The Commissioner of Communications: The Central Authority

The Commissioner of Communications — operating through the OCECPR — is the hub of Cyprus's model: it is the notifying authority, the market surveillance authority, and the single point of contact for the EU AI Office, all in one body. It runs a dedicated AI Act portal (in Greek and English) with a notification process and a complaint channel. For most Cypriot companies, this is the authority you will engage with on conformity, registration, and enforcement.

The Data Protection Commissioner: Co-Supervisor for Sensitive Systems

The Commissioner for Personal Data Protection wears two hats under the Cypriot model. It is an additional market surveillance authority for high-risk AI systems in data-sensitive areas — think biometrics and other rights-intensive Annex III use cases — working alongside the Commissioner of Communications. It is also one of the Article 77 fundamental-rights authorities. So a Cypriot company deploying, say, a biometric system should expect the data protection commissioner's interest in addition to the Commissioner of Communications' market surveillance function.

DMRID: Policy, Not Enforcement

It is worth being precise here, because the names invite confusion. The Deputy Ministry of Research, Innovation and Digital Policy sets the national AI policy direction and coordinates the governance framework, and represents Cyprus on the European Artificial Intelligence Board. It is not the market surveillance or notifying authority — those are the Commissioner of Communications' roles. Do not treat DMRID as the body that audits or fines.

GPAI Is Supervised From Brussels

As across the EU, providers of general-purpose AI models are supervised directly by the EU AI Office in Brussels, not by any Cypriot body. Cypriot foundation-model developers should engage with the AI Office's codes of practice process.

---

National Strategy and Implementing Legislation

Cyprus was an early policy mover here too: it adopted its first National AI Strategy by Council of Ministers decision in January 2020, built on pillars covering investment, data, skills, and trustworthy AI. A refreshed strategy is being prepared by a National AI Taskforce established in 2025 but had not been published as of mid-2026.

On the legal side: the authority designations are in force (the January 2025 Council of Ministers decision), but a dedicated national AI implementing law — setting out detailed procedures and domestic enforcement specifics — was still in preparation as of mid-2026. The substantive obligations and penalty tiers come from the Regulation itself and do not wait for that national law.

---

The EU AI Act Timeline as It Applies in Cyprus

Two points for Cypriot businesses.

First, the high-risk deadline is no longer 2 August 2026. Under the Digital Omnibus — the Commission's amendment package, adopted in June 2026 — stand-alone high-risk Annex III systems are deferred to 2 December 2027 and product-embedded systems to 2 August 2028. The deferral is now adopted: the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on Official Journal publication, expected before 2 August 2026. Stand-alone high-risk Annex III obligations now apply from 2 December 2027.

Second, because Cyprus's authorities are already designated, there is no "no regulator yet" grace here. The Commissioner of Communications can already act on Article 5 prohibitions, and the GPAI layer is enforced from Brussels.

---

Penalties: What Cypriot Companies Face

The fine ceilings are set by Article 99 of the Regulation and apply Cyprus-wide. There are exactly three tiers; no Cyprus-specific fine figures should be cited.

• €35,000,000 or 7% of total worldwide annual turnover (whichever is higher) — for the Article 5 prohibitions. Art 99(3).
• €15,000,000 or 3% — for most other obligations: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency. Art 99(4).
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to authorities or notified bodies. Art 99(5).

For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed sum or the percentage. A Cypriot company with €4M turnover cannot face a €15M fine for a high-risk breach — 3% of €4M is €120,000, the applicable ceiling. The third tier is 1%, never 1.5%. GPAI model providers face a separate instrument: up to €15 million or 3% under Article 101, imposed by the Commission.

---

Worked Example: A Cypriot iGaming Deployer

Consider Aphrodite Interactive Ltd, a fictional Limassol online-services company — about 120 employees, ~€18M turnover — that deploys an AI tool to verify customers' identities via facial matching at onboarding.

Biometric identity verification is in the Annex III biometrics territory, and biometrics is the one Annex III area routed to the third-party Annex VII conformity assessment, not self-assessment. As a deployer under Article 26, Aphrodite Interactive owes human oversight under Article 14, must follow the provider's instructions, and must give the Article 50(3) notice where biometric categorisation is in play. Crucially, Cyprus's structure means two authorities are in frame: the Commissioner of Communications as the general market surveillance authority, and the Commissioner for Personal Data Protection as the co-supervisor for biometric/data-sensitive high-risk systems. Aphrodite Interactive should map both relationships now — and check whether one-to-one identity verification ("phone face-login"-style matching) even reaches the high-risk threshold for its specific use, because not every biometric check is automatically high-risk. That classification call is exactly where the Article 6 analysis earns its keep.

---

How Confir Helps

Cypriot teams have the advantage of named authorities but still face a documentation-heavy obligation set. Confir is an EU-hosted compliance tool built for this work. Its classification engine is deterministic and rule-based — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake yields the same finding with a human-readable explanation of which rule fired. It builds the AI inventory, derives the provider/deployer role, generates the Annex IV technical documentation and the Article 27 FRIA, and runs a structured assessment across risk classification, data robustness, transparency and human oversight, and post-market monitoring — useful when two Cypriot authorities may both take an interest in the same system.

---

What Cypriot Companies Should Do Now

Immediately: Audit for Article 5 prohibited practices — social scoring, untargeted facial-image scraping, biometric categorisation by sensitive traits, workplace or education emotion recognition. The Commissioner of Communications can act on these now; the GPAI layer is enforced from Brussels.

Before 2 August 2026: Prepare for Article 50 transparency — label chatbots, mark synthetic content, disclose deepfakes, and give the biometric/emotion-recognition notices. This date was not deferred.

Through 2026–2027: Build the AI inventory, classify each system, apply the Article 6(3) filter, assign roles, and start the high-risk documentation. Build against 2 December 2027, the now-adopted high-risk deadline. For biometric or data-sensitive systems, engage both the Commissioner of Communications and the data protection commissioner early.

Ongoing: Watch for the dedicated national implementing law, which will add domestic procedural detail, and follow the Commissioner of Communications' AI Act portal for guidance and notification requirements.

---

Related guides

• EU AI Act fundamentals
• Compliance for small businesses
• Article 5: prohibited practices
• Article 99 penalties explained
• Article 50 transparency obligations
• The Digital Omnibus, defined
• Market surveillance authority, defined