Skip to main content

    AI by country · Southern Europe

    AI in Cyprus: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Cyprus know before starting with AI?

    Cyprus applies the EU AI Act and the GDPR, with the GDPR filled in by Law 125(I)/2018. The Commissioner of Communications acts as Cyprus's AI Act authority, but the national Artificial Intelligence Law of 2026 that would set the local framework was still at the consultation stage as of 29 October 2026. A company should check its AI uses against the AI Act dates and note that Cypriot law bans some uses of biometric and genetic data outright.

    At a glance

    Cyprus at a glance

    Key facts about Cyprus
    Data protection lawGDPR (applies since 25 May 2018) plus Law 125(I)/2018, amended by Law 26(I)/2022, in force
    RegulatorCommissioner for Personal Data Protection for personal data; Commissioner of Communications for the AI Act, final designation pending
    AI policyDraft Artificial Intelligence Law of 2026, in consultation from August 2026. No national AI law in force as of 29 October 2026
    Time zoneEET, UTC+2 in winter and UTC+3 in summer
    CurrencyEUR (euro)
    Business languageGreek and Turkish are official; English is widely used in business

    Why now

    Why Cyprus is worth watching

    Each point links to the document it comes from.

    • Eurostat data show 9.27% of Cypriot enterprises with 10 or more staff used at least one AI technology in 2025, up from 7.9% in 2024 and well below the EU figure of 19.95%.[6]

    • The Commissioner of Communications announced a public consultation on 'The Artificial Intelligence Law of 2026' on 18 August 2026, to set Cyprus's framework for applying and supervising the AI Act.[4]

    • The AI Act's Article 50 transparency duties began on 2 August 2026, and Annex III high-risk rules now start on 2 December 2027.[1]

    • The Deputy Minister for Research, Innovation and Digital Policy said in October 2026 that the new AI strategy aims to make Cyprus a trusted AI hub in the Eastern Mediterranean by 2032.[7]

    • That strategy focuses on the public sector and five sectors: financial services, health care, tourism, legal services and shipping.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation, Regulation (EU) 2016/679

    In force2016People have a right not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches go to the Commissioner within 72 hours where feasible (Article 33). Fines can reach 20 million euros or 4% of worldwide turnover.[2]

    Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data

    In force2018Children can consent to online services on their own from age 14 (section 8). Processing genetic and biometric data for health and life insurance is banned (section 9), which rules out such AI pricing models. Fines on public bodies for non-commercial activity are capped at 200,000 euros (section 32).[3]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI

    Phased2024Prohibitions and AI literacy have applied since 2 February 2025, and general-purpose AI rules since 2 August 2025. High-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in Annex I products). Fines reach 35 million euros or 7% of turnover for prohibited practices, with the lower cap for SMEs.[1]

    The Artificial Intelligence Law of 2026 (draft)

    Draft2026This bill would set Cyprus's national framework for applying and supervising the AI Act. It went to public consultation in August 2026. We have not seen the text, so we do not describe its content, and its adoption is not yet confirmed.[4]

    Where AI fits first

    Where AI fits first

    Financial services and funds

    Onboarding document checks, report drafting and compliance search.

    Credit scoring of individuals is an Annex III high-risk use under the AI Act, applying from 2 December 2027.[1]

    Insurance

    Claims triage and summarising policy documents.

    Section 9 of Law 125(I)/2018 bans processing genetic and biometric data for health and life insurance, whatever the AI tool.[3]

    Shipping

    Reading bills of lading and crew documents, and planning maintenance.

    Shipping is one of the five focus sectors named for Cyprus's new AI strategy.[7]

    Tourism

    Guest messaging in several languages and review analysis.

    Chatbots must tell people they are dealing with AI under Article 50 of the AI Act, from 2 August 2026.[1]

    Your first steps

    Your first steps

    1. List every AI system you use and mark which fall under the AI Act's prohibited, high-risk or Article 50 transparency categories.
    2. Add AI notices to chatbots and label AI-generated content now, since Article 50 already applies.
    3. Check that no model uses genetic or biometric data for health or life insurance, which section 9 of Law 125(I)/2018 bans.
    4. Run a GDPR impact assessment before using AI for profiling, credit, hiring or health.
    5. Give staff basic AI training so you can show the measures you took on AI literacy.
    6. Put a GDPR transfer mechanism, such as standard contractual clauses, in place before personal data leaves the EU.
    7. Follow aiact.cy for the final Artificial Intelligence Law of 2026 and any guidance.

    AI services for Cyprus

    AI consulting and development for teams in Cyprus

    We work remotely with companies in Cyprus, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Cyprus is on UTC+2 in winter and UTC+3 in summer, and India is on UTC+5:30, a gap of 3.5 hours in winter and 2.5 hours in summer. Taking a 9:00 to 18:00 day in Nicosia and 9:30 to 18:30 in India, the overlap is 6 hours in winter (09:00 to 15:00 Cyprus time) and 7 hours in summer (09:00 to 16:00). India has no EU adequacy decision, so personal data we handle from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Cyprus

    Does Cyprus have its own AI law?

    Not yet in force as of 29 October 2026. A draft Artificial Intelligence Law of 2026 went to consultation in August 2026. The EU AI Act applies directly in the meantime.

    Who supervises AI in Cyprus?

    The Commissioner of Communications says it has been designated notifying authority, market surveillance authority and single point of contact. The European Commission's list marks the national designation as still pending final adoption. The Commissioner for Personal Data Protection handles personal data.

    Were the AI Act deadlines delayed?

    Partly. The Digital Omnibus on AI moved high-risk rules to 2 December 2027 and 2 August 2028. Article 50 transparency duties still apply from 2 August 2026.

    At what age can children use AI apps without parental consent?

    Where an online service relies on consent, Cypriot law sets the age at 14. Below that, a parent or guardian must give or approve consent.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, AI Act Service Desk, 2026-10-29. Timeline for the implementation of the EU AI Act(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Timeline for the implementation of the EU AI Act. Primary. Accessed on this date; reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744). Fine caps were read on the Service Desk Article 99 page.

    2. [2] Boletín Oficial del Estado (copy of the Official Journal of the EU, L 119), 2016-05-04. Regulation (EU) 2016/679 (General Data Protection Regulation)(boe.es)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary GDPR text, read in the Spanish official copy because EUR-Lex could not be opened from our tools. Used for Articles 22, 33, 35 and 83.

    3. [3] CyLaw (Cyprus Bar Association), consolidated text, 2018-07-31. Law 125(I)/2018 on the protection of natural persons with regard to the…(cylaw.org)
      Full title and what we used it for

      Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data (title shortened). Consolidated law text including Law 26(I)/2022, read in Greek. Used for sections 8, 9 and 32. The Commissioner's own site refused our requests. The date given is the year of the law; we did not confirm the Gazette date.

    4. [4] Office of the Commissioner of Communications, 2026-10-29. AI Act Cyprus (aiact.cy)(aiact.cy)
      Full title and what we used it for

      AI Act Cyprus (aiact.cy). Primary. Accessed on this date. Used for the 18 August 2026 consultation on the Artificial Intelligence Law of 2026 and the Commissioner's roles. The site does not give the bill's text or adoption date.

    5. [5] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists the Commissioner of Communications as Cyprus's single point of contact, marked as national designation pending final adoption. The AI Act Service Desk national resources page also lists aiact.cy.

    6. [6] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary dataset, read through the Eurostat API. Indicator E_AI_TANY, enterprises with 10 or more persons employed, excluding the financial sector.

    7. [7] Cyprus Mail, 2026-10-15. Cyprus sets sights on becoming Eastern Mediterranean AI hub by 2032, sa…(cyprus-mail.com)
      Full title and what we used it for

      Cyprus sets sights on becoming Eastern Mediterranean AI hub by 2032, says Damianou. Press report of the Deputy Minister's remarks. Used for the 2032 goal and the five focus sectors. The article does not say whether the strategy is formally adopted, so we treat its status as unconfirmed.

    This is general information, not legal advice. Cyprus's national AI law and strategy were both unfinished when we checked, and some details come from press reports. Check with a qualified Cypriot lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Cyprus?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score