AI Regulation in Cyprus: 2026 Update

AI regulation in Cyprus is governed primarily by the EU AI Act, which applies directly in all EU member states, including Cyprus, without requiring separate national transposition. For businesses developing, deploying or using AI systems in Cyprus, this means a binding, tiered compliance framework is already in force. The stakes are significant: non-compliance can result in substantial fines, market access restrictions, and reputational damage. This guide covers the legal framework applicable in Cyprus, the roles of national authorities, sector-specific overlays, compliance obligations by risk tier, and the practical steps businesses must take to operate lawfully.

The EU AI Act is a directly applicable EU regulation. It entered into force in stages, with the most critical provisions - including prohibitions on unacceptable-risk AI and obligations for high-risk AI systems - now binding across the EU. Cyprus, as a full EU member state, applies these rules without any local legislative gap. Businesses cannot rely on the absence of a Cyprus-specific AI statute as a reason to delay compliance.

The AI Act classifies AI systems into four risk tiers: unacceptable risk, high risk, limited risk, and minimal risk. Each tier carries distinct obligations. Unacceptable-risk systems - such as social scoring by public authorities or real-time remote biometric identification in public spaces for law enforcement - are prohibited outright. High-risk systems, which include AI used in critical infrastructure, employment decisions, credit scoring, and certain medical devices, must meet strict requirements before being placed on the market or put into service.

For Cyprus-based operators, the practical implication is that any AI system they develop, import, distribute or deploy must be assessed against the AI Act';s classification criteria. A common mistake is assuming that because a product was developed outside the EU, it falls outside the regulation';s scope. The AI Act applies on the basis of where the AI system';s output is used or where the affected persons are located - not where the developer is incorporated.

The AI Act also introduces obligations for providers of general-purpose AI models, including transparency requirements and, for models with systemic risk, additional technical documentation and incident reporting duties. Cyprus-based companies building or fine-tuning large language models or other foundation models must assess whether these provisions apply to them.

Cyprus has designated the Commissioner for Personal Data Protection as the national supervisory authority responsible for coordinating AI Act oversight at the national level. This designation aligns with the existing data protection infrastructure, given the significant overlap between AI regulation and data protection law under the General Data Protection Regulation (GDPR).

The Commissioner';s office is responsible for receiving notifications, handling complaints, conducting investigations, and coordinating with the European AI Office, which sits at EU level and has direct supervisory authority over general-purpose AI model providers. For most businesses operating in Cyprus, the Commissioner is the primary point of contact for AI compliance matters.

In practice, enforcement in Cyprus is still developing. The national authority is building its technical capacity, and formal enforcement actions against AI systems are at an early stage. However, this does not reduce legal exposure. The AI Act';s fines are set at EU level - up to a significant percentage of global annual turnover for the most serious violations - and the European AI Office can act directly in cases involving general-purpose AI models.

Sector-specific regulators also play a role. The Central Bank of Cyprus supervises AI used in financial services, including credit scoring and fraud detection systems. The Cyprus Securities and Exchange Commission (CySEC) has issued guidance on the use of AI in investment services and algorithmic trading. The Ministry of Health oversees AI used in medical devices and clinical decision support. Businesses operating in these sectors must satisfy both the AI Act';s horizontal requirements and the vertical requirements of their sector regulator.

High-risk AI systems attract the most detailed compliance obligations under the AI Act. For businesses in Cyprus, understanding whether their AI system falls into a high-risk category is the first and most consequential step.

The AI Act';s Annex III lists the categories of high-risk AI systems. These include AI used in biometric identification, management of critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration and border control, and administration of justice. If a Cyprus-based company deploys an AI system in any of these areas, it is subject to the full high-risk compliance regime.

The obligations for high-risk AI providers include:

• Establishing and maintaining a risk management system throughout the AI system';s lifecycle.
• Ensuring training, validation and testing data meets quality criteria and is relevant, representative and free of errors.
• Preparing technical documentation sufficient to demonstrate conformity with the AI Act.
• Implementing logging and record-keeping capabilities that allow post-market monitoring.
• Providing clear instructions for use to deployers.
• Registering the AI system in the EU database for high-risk AI systems before placing it on the market.

Deployers of high-risk AI systems - businesses that use such systems in their operations - also carry obligations. They must conduct a fundamental rights impact assessment where required, ensure human oversight is in place, and notify the relevant authority if they identify a serious incident or malfunctioning.

A non-obvious requirement is that deployers who customise or fine-tune a high-risk AI system may themselves become providers under the AI Act, triggering the full provider obligations. Many Cyprus businesses that integrate third-party AI tools and adapt them for their specific use case underestimate this risk.

AI regulation in Cyprus cannot be understood in isolation from the GDPR. The two frameworks interact closely, particularly for AI systems that process personal data - which covers the vast majority of commercially deployed AI.

The GDPR, enforced in Cyprus by the Commissioner for Personal Data Protection, imposes requirements on automated decision-making that directly affect AI deployments. Article 22 of the GDPR restricts solely automated decisions that produce legal or similarly significant effects on individuals, requiring either explicit consent, contractual necessity, or a specific legal basis. Businesses using AI for credit decisions, hiring, or personalised pricing in Cyprus must have a lawful basis under both the GDPR and the AI Act.

Data minimisation, purpose limitation, and storage limitation principles under the GDPR constrain how training data can be collected and retained. A common mistake among AI developers is treating data governance as a post-development concern. In practice, data governance decisions made at the design stage - what data to collect, how to label it, how long to retain it - determine whether the resulting AI system can be lawfully deployed in Cyprus and across the EU.

The AI Act introduces its own data quality requirements for high-risk systems, which overlap with but do not replace GDPR obligations. Businesses must satisfy both regimes simultaneously. Where a data protection impact assessment (DPIA) is required under the GDPR, it should be coordinated with the fundamental rights impact assessment required under the AI Act to avoid duplication and ensure consistency.

If you are building or deploying an AI system in Cyprus and are uncertain whether your data governance framework satisfies both regimes, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Beyond the horizontal AI Act framework, several sectors in Cyprus have developed specific guidance or requirements for AI use. Understanding these overlays is essential for businesses operating in regulated industries.

Financial services. CySEC has been active in addressing AI in investment services. Its guidance covers the use of AI in client suitability assessments, robo-advisory services, and algorithmic trading. Firms using AI to generate investment recommendations must ensure the system';s outputs can be explained to clients and that human oversight is maintained for material decisions. The Central Bank of Cyprus has separately addressed AI in credit underwriting, requiring that models used in lending decisions are explainable, auditable, and subject to regular validation.

Healthcare. AI systems used as medical devices or in clinical decision support are subject to the EU Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR) in addition to the AI Act. The Ministry of Health in Cyprus is the competent authority for medical device registration. Businesses developing AI-powered diagnostic tools or treatment recommendation systems must navigate both the AI Act';s high-risk classification and the MDR';s conformity assessment requirements.

Employment. AI used in recruitment, performance monitoring, or workforce management falls within the AI Act';s high-risk category. Cyprus employment law, including the Termination of Employment Law and the Equal Treatment in Employment and Occupation Law, imposes additional constraints on automated employment decisions. Employers using AI to screen CVs, assess performance, or manage shift allocation must ensure compliance with both the AI Act and domestic employment legislation.

Public sector. The Cyprus government has been developing a national AI strategy aligned with the EU';s coordinated plan on AI. Public authorities deploying AI in administrative decisions - such as benefit assessments or permit processing - must comply with the AI Act and with administrative law principles of transparency and proportionality.

For businesses already operating in Cyprus or planning to enter the market, the compliance journey under the AI Act follows a logical sequence. The following steps reflect current best practice for organisations at various stages of AI deployment.

The first step is an AI inventory. Businesses should catalogue all AI systems they develop, deploy or use, including third-party tools integrated into their operations. Many organisations discover during this exercise that they are using AI systems they did not formally classify as such - automated scoring tools, recommendation engines, or predictive analytics platforms.

The second step is risk classification. Each identified AI system must be assessed against the AI Act';s classification criteria. This requires legal and technical input. The classification determines the compliance obligations that apply and the timeline for meeting them.

The third step is gap analysis. For high-risk systems, businesses should assess their current documentation, data governance, human oversight arrangements, and logging capabilities against the AI Act';s requirements. For general-purpose AI models, the gap analysis should cover transparency obligations and, where applicable, systemic risk requirements.

The fourth step is remediation. Gaps identified in the analysis must be addressed before the relevant AI Act deadlines. For some businesses, this will require significant investment in technical documentation, model validation, and governance infrastructure. For others, the primary work is contractual - ensuring that agreements with AI vendors and deployers correctly allocate responsibilities under the AI Act.

The fifth step is ongoing monitoring. The AI Act requires continuous post-market monitoring for high-risk systems. Businesses must establish processes to detect and report serious incidents, update technical documentation when systems are modified, and conduct periodic reviews of their risk management systems.

In practice, founders and compliance teams should consider engaging legal counsel early in the product development cycle rather than treating AI Act compliance as a pre-launch checklist. Retrofitting compliance into a deployed system is significantly more costly and disruptive than building it in from the start.

A practical scenario: a Cyprus-based fintech company develops an AI credit scoring model for use by partner banks across the EU. The model falls within the AI Act';s high-risk category. The company must register the model in the EU database, prepare technical documentation, implement a risk management system, and ensure its partner banks - as deployers - receive adequate instructions for use. If the company fine-tunes the model for a specific bank';s portfolio, that bank may itself become a provider under the AI Act, requiring its own conformity assessment.

A second scenario: a Cyprus-based HR technology startup builds an AI tool that screens job applications for a multinational employer. The tool falls within the high-risk category under Annex III. The startup must comply with the full provider obligations, including data quality requirements and registration. The employer, as deployer, must conduct a fundamental rights impact assessment and ensure human oversight of final hiring decisions. Both parties must coordinate their compliance obligations contractually.

For assistance navigating these obligations, contact info@vlolawfirm.com. We can assist with AI system classification, documentation, and regulatory filings in Cyprus.

Does the EU AI Act apply to small businesses and startups in Cyprus?

The AI Act applies to all providers and deployers of AI systems within the EU, regardless of company size. However, the regulation includes some proportionality measures for small and medium-sized enterprises (SMEs) and startups, including simplified technical documentation requirements and access to regulatory sandboxes. Cyprus has been developing a regulatory sandbox framework in line with the AI Act';s requirements, which allows SMEs to test AI systems in a controlled environment under the supervision of the national authority. Despite these accommodations, the core obligations - particularly for high-risk AI systems - apply to all businesses. A startup that develops a high-risk AI system cannot rely on its size to avoid conformity assessment or registration requirements.

How long does it take to achieve AI Act compliance for a high-risk system, and what does it cost?

The timeline and cost depend heavily on the complexity of the AI system and the maturity of the organisation';s existing governance infrastructure. For a well-documented system with existing quality management processes, achieving compliance may take several months of focused effort. For a system with limited documentation or significant data governance gaps, the process can take considerably longer. Professional fees for legal and technical compliance support vary widely depending on the scope of work. Businesses should budget for legal counsel, technical documentation, model validation, and potentially third-party conformity assessment. Treating compliance as a one-time project is a mistake - the AI Act requires ongoing monitoring and periodic review, which creates a recurring cost that must be factored into operational budgets.

What happens if a Cyprus business uses an AI system provided by a non-EU vendor?

If a Cyprus business deploys an AI system provided by a non-EU vendor, the Cyprus business - as the deployer - carries its own obligations under the AI Act. Where the non-EU vendor has no EU representative, the deployer may in some circumstances be treated as the provider for compliance purposes, triggering the full provider obligations. This is a significant risk that many businesses overlook when procuring AI tools from US or other non-EU providers. Contracts with AI vendors should clearly allocate AI Act responsibilities, require the vendor to provide necessary technical documentation, and include representations about the system';s compliance status. Due diligence on AI vendors is now a standard part of procurement for any regulated or high-risk use case.

AI regulation in Cyprus is substantive, enforceable, and already in force. The EU AI Act applies directly, the national supervisory authority is operational, and sector regulators are actively developing AI-specific guidance. Businesses that treat compliance as a future concern rather than a current obligation face real legal and commercial risk.

VLO Law Firms advises international clients on AI regulation in Cyprus. We can assist with AI system classification, risk assessments, technical documentation, regulatory filings, and vendor contract review. To request a consultation, contact: info@vlolawfirm.com