Skip to main content

    AI by country · Southern Europe

    AI in Greece: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Greece know before starting with AI?

    Greece adopted Law 5321/2026 in July 2026 to apply the EU AI Act, and it makes the Hellenic Data Protection Authority (HDPA) the main AI market surveillance authority. Personal data used by AI falls under the GDPR and Greek Law 4624/2019. Because one regulator now covers both data protection and most AI Act supervision, a company should treat its GDPR and AI Act work as one project.

    At a glance

    Greece at a glance

    Key facts about Greece
    Data protection lawGDPR (applies since 25 May 2018) plus Law 4624/2019 (Government Gazette A' 137, 29 August 2019), in force
    RegulatorHellenic Data Protection Authority (HDPA), for personal data and as main AI Act market surveillance authority
    AI policyLaw 5321/2026 on AI Act implementation (Government Gazette A' 114, 20 July 2026); Blueprint for Greece's AI Transformation (November 2024)
    Time zoneEET, UTC+2 in winter and UTC+3 in summer
    CurrencyEUR (euro)
    Business languageGreek; English widely used in business

    Why now

    Why Greece is worth watching

    Each point links to the document it comes from.

    • Eurostat data show 8.93% of Greek enterprises with 10 or more staff used at least one AI technology in 2025, down from 9.81% in 2024 and well below the EU figure of 19.95%.[7]

    • Law 5321/2026 was published in Government Gazette A' 114 on 20 July 2026 and took effect on publication.[3]

    • The law names the HDPA as market surveillance authority for prohibited AI practices, Annex III high-risk systems and Article 50 transparency duties.[3]

    • The same law repealed the AI chapter of Law 4961/2022 (Articles 3 to 14), which had set earlier Greek rules such as a workplace AI notice and a register for private firms.[4]

    • The Blueprint for Greece's AI Transformation, published on 25 November 2024 by a committee under the Prime Minister, proposes six flagship projects.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation, Regulation (EU) 2016/679

    In force2016People have a right not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches go to the HDPA within 72 hours where feasible (Article 33). Fines can reach 20 million euros or 4% of worldwide turnover.[2]

    Law 4624/2019 on the HDPA and GDPR implementing measures

    In force2019Minors can consent to online services on their own from age 15 (Article 21). Employee consent is an exception, not the normal basis (Article 27). Workplace CCTV is allowed only to protect people and goods, and footage may not be used to judge staff productivity, which rules out AI performance scoring from camera feeds.[5]

    Law 5321/2026, implementing measures for Regulation (EU) 2024/1689

    In force2026The HDPA supervises prohibited practices, Annex III high-risk systems and transparency duties; sector authorities cover AI in regulated products, and EETT is the notifying authority. It sets administrative sanctions, an AI sandbox and an AI systems register. Removing the transparency labels on deepfake content is a criminal offence (Article 23).[3]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI

    Phased2024Prohibitions and AI literacy have applied since 2 February 2025, and general-purpose AI rules since 2 August 2025. Article 50 transparency duties apply from 2 August 2026. High-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in Annex I products).[1]

    Where AI fits first

    Where AI fits first

    Tourism and shipping

    Multilingual booking support, guest messaging and document handling for crews and cargo.

    Chatbots must tell people they are dealing with AI under Article 50, which the HDPA supervises in Greece.[3]

    Retail and logistics

    Demand forecasting and warehouse planning.

    Under Law 4624/2019, workplace CCTV footage may not be used to assess staff productivity, so keep vision AI away from worker scoring.[5]

    Banking and insurance

    Summarising loan files and classifying claims in Greek.

    Credit scoring of individuals and life and health insurance pricing are Annex III high-risk uses, applying from 2 December 2027.[1]

    Media and marketing

    Drafting copy and producing images or video with generative AI.

    Deepfakes must be disclosed, and removing those labels is an offence under Article 23 of Law 5321/2026.[3]

    Your first steps

    Your first steps

    1. List every AI system you use and mark which fall under the AI Act's prohibited, high-risk or Article 50 transparency categories.
    2. Label AI-generated and deepfake content, and make sure no one in your workflow strips those labels.
    3. Check workplace tools against Article 27 of Law 4624/2019, especially any use of camera footage.
    4. Run one combined GDPR and AI Act review, since the HDPA supervises both for most uses.
    5. Give staff basic AI training so you can show the measures you took on AI literacy.
    6. Put a GDPR transfer mechanism, such as standard contractual clauses, in place before personal data leaves the EU.
    7. Watch the HDPA site for guidance and secondary acts under Law 5321/2026, including the AI systems register.

    AI services for Greece

    AI consulting and development for teams in Greece

    We work remotely with companies in Greece, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Greece is on UTC+2 in winter and UTC+3 in summer, and India is on UTC+5:30, a gap of 3.5 hours in winter and 2.5 hours in summer. Taking a 9:00 to 18:00 day in Athens and 9:30 to 18:30 in India, the overlap is 6 hours in winter (09:00 to 15:00 Athens time) and 7 hours in summer (09:00 to 16:00). India has no EU adequacy decision, so personal data we handle from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Greece

    Does Greece have its own AI law?

    Yes, Law 5321/2026, published on 20 July 2026. It does not replace the EU AI Act; it names the Greek authorities, sets sanctions and creates a sandbox and register.

    Who supervises AI in Greece?

    Mainly the HDPA, which covers prohibited practices, Annex III high-risk systems and transparency duties, and is listed by the European Commission as Greece's single point of contact. Sector authorities cover AI built into regulated products, and EETT is the notifying authority.

    Do the 2022 Greek AI rules still apply?

    The AI chapter of Law 4961/2022, Articles 3 to 14, was repealed by Article 26 of Law 5321/2026. Check with a lawyer whether any transitional rules affect you.

    What are the maximum AI Act fines?

    Up to 35 million euros or 7% of worldwide turnover for prohibited practices, and up to 15 million euros or 3% for most other breaches. For SMEs the lower of the two figures applies.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, AI Act Service Desk, 2026-10-29. Timeline for the implementation of the EU AI Act(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Timeline for the implementation of the EU AI Act. Primary. Accessed on this date; reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744). Fine caps were read on the Service Desk Article 99 page.

    2. [2] Boletín Oficial del Estado (copy of the Official Journal of the EU, L 119), 2016-05-04. Regulation (EU) 2016/679 (General Data Protection Regulation)(boe.es)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary GDPR text, read in the Spanish official copy because EUR-Lex could not be opened from our tools. Used for Articles 22, 33, 35 and 83.

    3. [3] Taxheaven (reproduction of the Government Gazette text), 2026-07-20. Νόμος 5321/2026 (ΦΕΚ Α 114/20.07.2026), Μέτρα εφαρμογής του Κανονισμού…(taxheaven.gr)
      Full title and what we used it for

      Νόμος 5321/2026 (ΦΕΚ Α 114/20.07.2026), Μέτρα εφαρμογής του Κανονισμού (ΕΕ) 2024/1689. Law text as reproduced by Taxheaven; we could not open the Government Gazette site directly. Used for the title, Gazette reference, Articles 3, 23 and 58 and the article list. Lawspot and PwC Greece summaries were read for context only.

    4. [4] Taxheaven (reproduction of the Government Gazette text), 2026-07-20. Law 5321/2026, Article 26, and Law 4961/2022 structure(taxheaven.gr)
      Full title and what we used it for

      Law 5321/2026, Article 26, and Law 4961/2022 structure. Used for the repeal of Chapter B of Part A of Law 4961/2022. The chapter's contents (Articles 3 to 14) were read at https://www.taxheaven.gr/law/4961/2022.

    5. [5] Taxheaven (reproduction of the Government Gazette text), 2019-08-29. Νόμος 4624/2019 (ΦΕΚ Α 137/29.08.2019)(taxheaven.gr)
      Full title and what we used it for

      Νόμος 4624/2019 (ΦΕΚ Α 137/29.08.2019). Law text as reproduced by Taxheaven. Used for Articles 21 and 27 (read on their own article pages).

    6. [6] Special Secretariat of Foresight, Presidency of the Government, 2024-11-25. A Blueprint for Greece's AI Transformation(foresight.gov.gr)
      Full title and what we used it for

      A Blueprint for Greece's AI Transformation. Primary. Used for the publisher, date and the six flagship projects.

    7. [7] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary dataset, read through the Eurostat API. Indicator E_AI_TANY, enterprises with 10 or more persons employed, excluding the financial sector.

    8. [8] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists the Hellenic Data Protection Authority as Greece's single point of contact, not marked as pending.

    This is general information, not legal advice. Law 5321/2026 is new and its secondary acts and HDPA guidance are still to come; we read its text through a reproduction, not the Gazette itself. Check with a qualified Greek lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Greece?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score