EU AI Act in Lithuania: Who Enforces It, and What Lithuanian Companies Must Do

Lithuania is one of the cleaner and earlier EU AI Act implementations. While many Member States missed the August 2025 deadline to name their authorities, Lithuania's parliament had already legislated in January 2025 — splitting the job between the Communications Regulatory Authority (RRT), which became the market-surveillance authority and single point of contact, and the Innovation Agency, which became the notifying authority and runs the AI regulatory sandbox. Both designations are confirmed in national law and recorded at EU level.

This guide sets out the Lithuanian enforcement architecture, the obligations already binding companies, the one genuinely open question, the corrected timeline after the Digital Omnibus, and what Lithuanian businesses should do now.

---

A Regulation, Not a Directive: Direct Effect in Lithuania

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Lithuania under Article 288 of the Treaty on the Functioning of the European Union. It entered into force on 1 August 2024, and its early obligations bind Lithuanian companies regardless of national law: Article 5 prohibited practices and Article 4 AI literacy since 2 February 2025, and general-purpose AI (GPAI) obligations under Chapter V since 2 August 2025.

Because it is a Regulation, Lithuania did not transpose it. What Lithuania did instead — and notably ahead of schedule — was designate its authorities by amending two existing laws rather than passing a single stand-alone "AI Act". The Seimas (parliament) approved the implementing amendments on 14 January 2025, naming the competent authorities. This is what makes Lithuania a settled case.

---

Who Enforces the EU AI Act in Lithuania?

RRT: Market-Surveillance Authority and Single Point of Contact

The Communications Regulatory Authority (RRT — Ryšių reguliavimo tarnyba) is Lithuania's designated market-surveillance authority and single point of contact for the EU AI Office under Article 70. The amendment to the Law on Information Society Services assigns RRT this role; RRT is confirmed on the European Commission's published list of single points of contact. RRT is already Lithuania's regulator for electronic communications and certain digital services, which gives it a base of technical-regulatory experience to bring to AI Act enforcement.

One important nuance, drawn straight from Lithuania's own Ministry of Economy and Innovation: RRT is not the sole market-surveillance authority. It is the coordinating single point of contact, but sectoral market-surveillance authorities will also supervise directly-applicable AI Act provisions within their own domains. So the headline designation is settled, while the precise division of labour — which body polices which AI system in practice — is still settling. RRT itself has flagged a capacity gap, having found in a survey that many authorities are not yet ready to supervise, and has proposed strengthening a national competence centre. That is capacity-building, not a change to the designation.

The Innovation Agency: Notifying Authority and Sandbox

The Innovation Agency (Inovacijų agentūra) is designated as Lithuania's notifying authority under Articles 28 and 70 — responsible for assessing and overseeing the notified bodies that carry out third-party conformity assessment — through the amendment to the Law on Technology and Innovation, with functions effective in August 2025.

The Innovation Agency is also statutorily tasked under Article 57 with running Lithuania's AI regulatory sandbox (DI smėliadėžė) — a supervised environment, backed by EU funding, in which Lithuanian SMEs can test AI systems against the rules before launch. For a small Lithuanian company, the sandbox is a genuinely useful route: Article 58 gives SMEs priority and free access.

VDAI: The Data Protection Authority

Lithuania's data protection authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), the GDPR supervisor since 1997. VDAI is unavoidable for any AI system that processes personal data — which covers most Annex III high-risk use cases — but it is not the designated AI Act market-surveillance authority. That role sits with RRT. The two run in parallel: VDAI under the GDPR, RRT under the AI Act.

The AI Office (Brussels): GPAI Stays at EU Level

General-purpose AI model providers are supervised by the EU AI Office in Brussels under Articles 53 and 55, with fines imposed by the Commission under Article 101 — not by RRT. A Lithuanian company that merely uses a general-purpose model is a deployer of the system it builds, not a GPAI provider answerable to the AI Office for the model itself.

---

The Lithuanian Enforcement Timeline (After the Digital Omnibus)

The high-risk dates carried a caveat that is now resolved. Under the Digital Omnibus, the European Parliament adopted the deferral in its plenary vote on 16 June 2026 and the Council adopted it on 29 June 2026, deferring stand-alone high-risk Annex III systems to 2 December 2027 and product-embedded high-risk AI to 2 August 2028. The package enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality, since the dates themselves are settled. Plan against 2 December 2027 for stand-alone high-risk Annex III. The deferral is fixed calendar dates — not contingent on harmonised standards.

---

Penalties: What Lithuanian Companies Actually Face

The penalty framework is Article 99 of the Regulation, enforced in Lithuania through RRT and the sectoral authorities. The ceilings are EU-wide; Lithuanian law supplies the procedure, not different figures. Three tiers, each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

• €35,000,000 or 7% — for breaching the Article 5 prohibitions.
• €15,000,000 or 3% — for most other breaches: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to a notified body or authority.

The third tier is 1%, not 1.5% — there is no 1.5% tier in the Regulation, and no Lithuania-specific fine amounts. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. A Lithuanian company with €5 million turnover does not face a €15 million fine for a high-risk breach — 3% of €5 million is €150,000, and that is the ceiling.

GPAI-specific fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101 on the model provider, not by RRT.

---

Worked Example: A Vilnius EdTech Company

Consider Mokymas UAB, a fictional Vilnius EdTech firm — about 35 employees, roughly €4 million annual turnover — whose AI tool scores student exams and helps decide admission to a vocational programme.

AI used to evaluate learning outcomes or determine access to education is an Annex III high-risk use case (education and vocational training). Because Mokymas builds the tool and places it on the market under its own name, it is a provider under Article 16: Article 9 risk management, Annex IV technical documentation, an Article 43 conformity assessment, Article 14 human oversight, and Article 49 registration.

For Mokymas, the Lithuanian setup is an advantage. Its AI Act market-surveillance authority is clear — RRT — and as an SME it can apply to the Innovation Agency's regulatory sandbox to test the system against the rules with priority, free access before launch. Because the tool processes students' personal data, VDAI also supervises it under the GDPR, and a GDPR Article 35 Data Protection Impact Assessment is required. The sensible path: enter the sandbox early, build the AI Act documentation against the 2 December 2027 high-risk date, and keep the GDPR and AI Act assessments aligned. On €4 million turnover, its worst-case high-risk exposure is 3% — about €120,000.

---

How Confir Helps Lithuanian Companies

A Lithuanian compliance team has a documentation-heavy obligation set: an AI inventory, Article 6 classification with the Annex III logic, role assignment, Article 9 risk records, the Annex IV technical file, the Article 27 assessment where it applies, and Article 72 post-market monitoring.

Confir is EU-hosted compliance software built for this work. Its classification engine is rule-based and deterministic — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It generates the Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity, and runs the Article 27 assessment. The structured review spans four areas: risk classification, data and technical robustness, transparency and human oversight, and governance and post-market monitoring.

---

What Lithuanian Companies Should Do Now

Immediately: Audit for any Article 5 prohibited practice — enforceable since February 2025. If a system fits a prohibited category and no exemption applies, stop or restructure it.

Before 2 August 2026: Bring chatbots, voice assistants, and AI content tools into line with Article 50 transparency — users must be told when they are interacting with AI or with synthetic content.

Through 2026–2027: Build the AI inventory, classify systems under Article 6 with the Article 6(3) filter, assign provider or deployer roles, and begin high-risk documentation, planning against 2 August 2026 until the Omnibus deferral becomes law. If you are an SME with a high-risk system, consider the Innovation Agency's sandbox.

Ongoing: Watch RRT's guidance and first enforcement actions, and follow which sectoral authorities take supervisory roles in your domain — that division of labour is still settling.

---

Related guides

• Who enforces the EU AI Act
• EU AI Act fundamentals
• EU AI Act penalties explained
• Provider vs deployer obligations
• Compliance guide for small businesses
• The EU AI Act in Poland
• The EU AI Act in the Czech Republic