The EU AI Act in Greece: Authorities, Enforcement, and Business Obligations

A Greek shipping operator or tourism platform asking "do we wait for a Greek AI law?" is asking the wrong question. The EU AI Act — Regulation (EU) 2024/1689 — is directly applicable in Greece already. It does not wait for an Athens statute, and neither do its deadlines. What Greece must do is designate the authorities that enforce it, and that piece is still being assembled.

This guide sets out how the Act applies in Greece: the supervisory picture (and why the single competent-authority designation has to be stated carefully), the corrected timeline after the Digital Omnibus, the Article 99 penalty tiers, and a worked example for a Greek shipping-tech SME.

---

A Regulation, Not a Directive — No Greek Transposition Needed

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and applies directly in every Member State, Greece included, under Article 288 TFEU — without transposition into Greek law. The obligations bite on the Regulation's own calendar: the Article 5 prohibited practices have applied since 2 February 2025, and the obligations on general-purpose AI (GPAI) model providers under Chapter V since 2 August 2025.

What Greece supplies is the enforcement infrastructure: designated competent authorities, a single point of contact for the European Commission, and domestic penalty procedures. A national implementing measure determines who enforces — not what applies or when.

---

Who Supervises AI in Greece? (Read This Carefully)

Here is the honest state of play. The Act's Article 70 required each Member State to designate at least one notifying authority and at least one market surveillance authority — and a single point of contact — by 2 August 2025. Greece, like a number of Member States, did not complete that designation by the deadline, and the position is still settling as of mid-2026. No single Greek "AI Act authority" should be presented as definitively and exclusively designated, and there is no confirmed standalone Greek implementing act at the time of writing. Anyone claiming otherwise is over-stating a position that the primary sources do not yet support.

What can be said, grounded in how supervision is currently distributed:

• The Ministry of Digital Governance is the central body coordinating Greece's national AI strategy and is widely expected to anchor the AI Act governance structure. It is the natural candidate to host or coordinate the competent-authority function, but the formal Article 70 single-point-of-contact designation should be treated as still being finalised.
• The Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) supervises data-protection issues arising from AI — automated decision-making, profiling, and the processing of personal data that underlies most high-risk systems. Its role here is firm and independent of the AI Act designation.
• The Hellenic Authority for Communication Security and Privacy (ADAE) is relevant where AI affects the privacy, confidentiality, and security of communications.
• The Greek Ombudsman and the Greek National Commission for Human Rights (GNCHR) engage where AI-driven decisions touch maladministration or fundamental rights.

The practical takeaway for a Greek company: do not wait for the final designation before acting. The obligations apply regardless of which Athens authority ends up holding the enforcement pen, and the HDPA is already an active regulator over the personal-data dimension of any AI system.

The EU AI Office in Brussels, not a Greek authority, supervises GPAI model providers under Articles 53 and 55 — a point that rarely affects Greek SMEs, most of which are deployers rather than model builders.

---

The Timeline as It Applies in Greece

Two points for Greek businesses.

First, the high-risk deadline is no longer August 2026. Under the Digital Omnibus — the Commission amendment package adopted by Parliament and Council in June 2026 — stand-alone Annex III high-risk systems now have until 2 December 2027, and product-embedded high-risk AI until 2 August 2028.

Second, a point worth stating plainly: this deferral is now adopted. The European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on Official Journal publication, expected before 2 August 2026. Stand-alone high-risk Annex III obligations now apply from 2 December 2027. The new dates are fixed calendar dates, not the standards-contingent "stop the clock" idea that was floated and rejected.

What did not move: GPAI obligations, the Article 5 prohibitions, Article 4 literacy, and most Article 50 transparency duties. A Greek tourism platform running a customer-facing chatbot has an Article 50 disclosure duty from 2 August 2026, which the Digital Omnibus did not move.

---

Penalties: What Greek Companies Face

Penalty ceilings come from Article 99 of the Regulation and are applied by the Greek competent authority once enforcement powers are fully in place. There are exactly three tiers — each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

The third tier is 1%, not 1.5% — there is no 1.5% tier in the Regulation. Greece does not set its own fine amounts; the figures are the Regulation's.

For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount. A Greek shipping-tech firm with €8 million turnover cannot face the headline €15 million figure for a high-risk breach — 3% of €8 million is €240,000, and that is the ceiling. GPAI model-provider fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101.

---

Worked Example: A Greek Shipping-Tech SME

Take Aigaío Marine Analytics A.E., a fictional Piraeus shipping-tech SME — about 45 employees, roughly €7 million turnover — selling a route-optimisation and fuel-efficiency platform to ship operators, plus an internal AI tool that screens job applications for its growing engineering team.

Walking its systems through the Act:

• Route-optimisation / fuel-efficiency AI — this analyses vessel and weather data to recommend routes. It does not appear in any Annex III high-risk category and does not profile natural persons. It is minimal-risk: no mandatory AI Act obligations. Aigaío's customers are deployers of a non-high-risk tool. Sound data governance and clear documentation remain good practice, but the heavy regime does not apply.
• AI recruitment-screening tool — this is the one that bites. AI used to screen or filter job applications falls squarely within Annex III's employment heading, making it high-risk. As a deployer of this internal tool, Aigaío owes Article 26 duties: human oversight, using the system per its instructions, informing affected workers, and (because employment screening profiles candidates) it cannot rely on the Article 6(3) exemption. If Aigaío built or substantially modified the tool itself, it would also carry Article 16 provider obligations. The high-risk deadline for this system is 2 December 2027, now adopted under the Digital Omnibus, so Aigaío should plan against that date.

The verdict: one minimal-risk product, one high-risk internal system. The recruitment tool is where Aigaío's compliance budget goes — classification, human oversight, worker information, and documentation — while the route-optimisation engine needs little beyond good housekeeping. On the supervisory side, the HDPA is already relevant to the personal data in the recruitment tool, and the eventual AI Act competent authority will hold the high-risk enforcement powers.

---

How Confir Helps Greek Companies

A Greek compliance lead needs to separate the minimal-risk systems from the genuinely high-risk ones, settle the provider/deployer role, and produce records that hold up — without hiring consultants for a single high-risk tool.

Confir is EU-hosted compliance software built for this. Its classification engine is rule-based and deterministic: it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always produces the same finding, with a human-readable explanation of which rule fired — reproducible by design. It generates the Annex IV technical-documentation pack, the Article 47 / Annex V Declaration of Conformity, and the Article 27 FRIA, and keeps an org-wide AI register and audit log.

---

What Greek Companies Should Do Now

Immediately — audit for any Article 5 practice; it has been enforceable since 2 February 2025. Before 2 August 2026 — ensure every customer-facing chatbot or content tool meets Article 50 transparency. Through 2026-2027 — build the AI inventory, classify each system under Article 6 with the Article 6(3) filter, identify which systems actually land in Annex III (recruitment, credit scoring, biometrics are common triggers), settle provider/deployer roles, and begin documentation. Ongoing — watch for Greece's formal Article 70 designation and any national implementing measure, and remember the HDPA is already supervising the data-protection side of your AI.

Related guides

• EU AI Act fundamentals
• the corrected enforcement timeline
• Digital Omnibus and the 2027 deferral
• Article 99 penalties explained
• provider vs deployer roles
• Annex III high-risk use cases
• the EU AI Act in Italy