Inside Greece’s AI Act Law 5321/2026: Regulators, Sandbox, Penalties and a Public-Sector AI Register

Greece now has its national rulebook for the EU AI Act. Law 5321/2026, published in the Government Gazette on July 20, 2026 and in force from that day, fills in what the EU regulation leaves to member states: who supervises, how complaints move between regulators, how the regulatory sandbox works, which national penalties sit alongside the EU fines and what public bodies must disclose before they switch on an AI system. Greece did not create a new standalone AI agency. Instead, it gave the central role to its data protection authority, kept sector regulators in charge of AI built into regulated products, and placed the sandbox and technical expertise with its telecoms regulator. For any organisation deploying AI in Greece, and for vendors selling to the Greek public sector, the details matter now.

Who supervises what

The AI Act requires each member state to designate market surveillance authorities, a notifying authority and a single point of contact. Greece’s answer, set out in Articles 3 to 6 of the law as published in the Government Gazette (Issue A’ 114), looks like this:

• Hellenic Data Protection Authority (HDPA). Market surveillance authority for the Article 5 prohibited practices, the high-risk use cases in Annex III (such as employment, education, credit scoring, essential services, law enforcement and migration) and the Article 50 transparency obligations. It is also the single point of contact and the channel to the EU AI Office.
• Existing product regulators. Authorities that already supervise products under the EU harmonisation laws listed in Section A of Annex I, such as machinery, toys, medical devices and radio equipment, also supervise high-risk AI connected to those products.
• Hellenic Telecommunications and Post Commission (EETT). Notifying authority for conformity assessment bodies. It also hosts a new Coordination and Expertise Centre for AI, which supports the other authorities, trains their staff, helps prepare codes of conduct and gives guidance to SMEs and startups.
• Ministry of Digital Governance. Names Greece’s representatives to the European AI Board. Through its Special Secretariat for AI and Data Governance, it runs the public-sector AI register and a new AI Observatory that monitors the national AI strategy.

So the common description of the law as spreading oversight “among existing regulators” is accurate only in part. No new agency was created, but most of the AI uses that affect individuals now go to one body, the HDPA. Greek organisations already know the authority from GDPR enforcement and from initiatives like its joint work with Spain’s regulator on secure processing environments. Other countries have also given data protection authorities a large AI role. The Dutch authority’s work on algorithms used by debt collection agencies shows how that kind of supervision can look in practice.

The law also tells five ministries, including Education, Labour and Justice, and the bodies they oversee to cooperate with the HDPA and answer its information requests, especially for complaints and inspections. That matters because many Annex III uses happen in those areas.

One door for complaints, with deadlines

Article 7 sets up a single AI Act complaints system at the HDPA. People can file there, and complaints that belong to another regulator are forwarded, with the complainant told. If a complaint goes directly to a sector regulator, that regulator must log it in the central system. The deadlines are tight:

1. Within 30 days, the receiving regulator must decide whether the complaint falls within its remit. If it declines, the HDPA forwards it or, in some cases, takes the complaint over itself.
2. Within 60 days, the regulator must assess the complaint, report progress to the central system and set a timetable for its next steps.
3. If it misses that deadline, the HDPA may give it 10 more days and then take exclusive responsibility for the case, while respecting the company’s right to be heard.

For companies, this means a complaint about an AI system rarely gets lost between regulators. The HDPA acts as a backstop, so expect it to be involved even where your sector has its own supervisor.

The sandbox and real-world testing

Article 12 creates the national AI regulatory sandbox at EETT, with EETT and the HDPA as the competent authorities and sector regulators taking part within their remits. EETT will publish calls for providers and prospective providers. Each call will set the deadline, application format, scoring criteria, the maximum number of participants and any participation fees. The law allows the sandbox to work with Greece’s Pharos AI Factory, the Hellenic Centre for Defence Innovation and the European Digital Innovation Hubs.

Article 13 contains one of the law’s most practical choices. The AI Act allows high-risk systems to be tested in real-world conditions outside a sandbox, and it treats a test plan as approved if the authority stays silent for 30 days. Greece rejects that tacit approval. Real-world testing needs the authority’s express written permission, and silence does not count as approval. Providers planning pilots in Greece should build that into their timelines.

Penalties beyond the EU fines

The AI Act sets the maximum administrative fines. Article 16 of the Greek law adds a national toolkit on top. After hearing the company concerned, the HDPA and the relevant market surveillance authorities can:

• issue warnings that a system about to be placed on the market is likely to breach the rules;
• order compliance in a specified way and by a deadline;
• issue reprimands;
• impose the fines in Article 99 of the AI Act;
• impose recurring penalty payments for ignoring compliance orders, of up to 2% of a company’s average daily worldwide turnover or income in the previous financial year, until it complies.

These measures can also be imposed on public-sector bodies. When setting sanctions, authorities may take into account whether an organisation took adequate steps on AI literacy under Article 4 of the AI Act. They may also consider whether it admits the infringement under a settlement procedure the HDPA will define. Sanction decisions are published along with the offender’s identity, investigation costs can be recovered from the company, and challenges go to the Council of State. Article 20 adds breaches of the AI Act to the scope of Greece’s whistleblower protection law (Law 4990/2022), so people who report AI Act violations are protected.

Article 23 creates a criminal offence. Anyone who removes the machine-readable markings that providers must add to synthetic content, interferes with the technical tools that apply them, or removes or obstructs a deployer’s disclosure that content is a deepfake can face imprisonment and a fine, unless a heavier penalty applies under another law. It joins a wider trend of governments criminalising deepfake abuse, but it targets the transparency mechanism itself rather than only harmful content.

A register for public-sector AI

Article 21 may be the provision with the most immediate effect. Every public-sector body that plans to use an AI system must file a registration in a single register at the Ministry of Digital Governance before the system goes live. The filing must include at least:

• the system’s name, purpose, the problem it addresses and the public interest it serves, plus the planned timeline;
• the categories of data, including personal data, that it processes or produces;
• its capabilities and technical parameters, including any general-purpose models used;
• the types of decisions or acts it makes or supports;
• risks to rights, especially for groups such as people with disabilities or particular ethnic, social or age groups;
• its documented classification under the AI Act, including whether it is high-risk;
• security measures, and whether a fundamental rights impact assessment and a GDPR DPIA were carried out where required.

Systems already in use must be registered without delay and no later than December 31, 2026. Vendors should expect Greek public clients to ask them for this information. It is the same documentation that good AI governance programmes already keep.

What organisations should do now

Map your AI systems used in Greece to the right regulator: HDPA for Annex III and transparency duties, sector authorities for product-embedded AI. Add written-approval lead time to any real-world testing plans. If you supply the public sector, prepare a registration pack before the year-end deadline. Keep evidence of your AI literacy programme, since it can now affect sanctions. Watch for EETT’s first sandbox call and for HDPA decisions on complaint forms and settlement procedures, which the law leaves to secondary acts. The HDPA keeps the law and related texts on its AI legislation page. A curated list of AI governance resources can help teams build the supporting documentation. Remember too that the EU’s Digital Omnibus on AI, Regulation (EU) 2026/1744, changed when some high-risk obligations apply. Check EU deadlines before you plan Greek ones.

Frequently asked questions

Does Greece have a dedicated AI regulator?

No. The HDPA carries the main AI Act supervision role and EETT handles notification, the sandbox and technical expertise. Product regulators keep AI embedded in their products.

Do private companies have to use the public-sector register?

No. Article 21 applies to public-sector bodies. Private suppliers will still feel it through procurement requests for the required information.

Can an authority’s silence approve a real-world AI test?

Not in Greece. The law requires express written authorisation, overriding the AI Act’s 30-day tacit approval.

Are the Greek penalty payments in addition to AI Act fines?

Yes. Recurring penalty payments enforce compliance orders and sit alongside the Article 99 fines, along with warnings, reprimands, publication and cost recovery.

A map with many hands on it

Greece has chosen to build on institutions it already has rather than start from scratch, and to give them firm procedures: deadlines for complaints, written approval for testing and a public register for the state’s own AI systems. How well it works will depend on resources and secondary rules still to come. The obligations themselves are already law, and the first register deadline is less than two months away.