EU AI Act compliance for companies in Greece.

Who the AI Act applies to: the roles

Under Article 2(1) the Regulation applies to providers that place AI systems or general-purpose AI models on the EU market, wherever they are established; to deployers established or located in the EU; to providers and deployers outside the EU where the output of the AI system is used in the EU; and to importers and distributors. It does not apply to individuals using AI in a purely personal, non-professional activity (Article 2(10)).

Article 3 defines the roles. A provider develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, other than for personal non-professional activity. An importer is established in the EU and places on the market an AI system bearing the name or trademark of a person established outside the EU. A distributor is any other person in the supply chain that makes an AI system available on the EU market.

Roles can shift. Under Article 25(1) a distributor, importer, deployer or other third party becomes the provider of a high-risk AI system if it puts its own name or trademark on it, makes a substantial modification to it, or changes the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk. A company that adapts a general-purpose chatbot for, say, screening job applicants should check this first.

Application timeline, as amended (position on 11 November 2026)

The AI Act entered into force on 1 August 2024. Article 113 sets staggered dates. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 24.7.2026), which entered into force on the third day after publication, amended Article 113 and Article 111. The current dates are:

• 2 February 2025: general provisions, including AI literacy (Article 4), and the prohibited practices (Article 5).
• 2 August 2025: rules on general-purpose AI models, governance, notified bodies and penalties (except the Commission's fines on general-purpose AI model providers under Article 101).
• 2 August 2026: general date of application, including the transparency duties of Article 50.
• 2 December 2026: the two new prohibitions added by Regulation (EU) 2026/1744 (non-consensual sexual deepfakes of identifiable persons and child sexual abuse material); and the deadline for providers of generative AI systems placed on the market before 2 August 2026 to comply with the marking duty of Article 50(2).
• 2 August 2027: deadline for providers of general-purpose AI models placed on the market before 2 August 2025 (Article 111(3)).
• 2 December 2027: high-risk rules (Chapter III, Sections 1 to 3, including deployer duties and the fundamental rights impact assessment) for systems high-risk under Article 6(2) and Annex III. The original date was 2 August 2026.
• 2 August 2028: the same rules for systems high-risk under Article 6(1) and Annex I (AI in regulated products). The original date was 2 August 2027.
• 2 August 2030: providers and deployers of high-risk AI systems intended for use by public authorities must comply, even for systems already in service (Article 111(2)).

Prohibited practices (Article 5)

Article 5 bans certain uses outright, whoever carries them out. They include AI that uses subliminal, manipulative or deceptive techniques causing significant harm; AI that exploits vulnerabilities due to age, disability or social or economic situation; social scoring leading to unjustified or unrelated detrimental treatment; predicting the risk that a person will commit a crime based solely on profiling or personality traits; building facial recognition databases by untargeted scraping of images from the internet or CCTV; inferring emotions in the workplace or in education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement, save narrow exceptions.

Regulation (EU) 2026/1744 added two prohibitions, applying from 2 December 2026: AI systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without that person's explicit consent, and AI systems that generate child sexual abuse material. For providers, the ban applies where that output is the intended purpose or a reasonably foreseeable outcome without adequate safeguards; for deployers, where they use the system for that purpose.

For an ordinary company the practical risk lies mainly in emotion recognition of staff, manipulative design in consumer-facing tools and biometric categorisation. These checks belong in the classification memorandum.

AI literacy (Article 4)

Providers and deployers must take measures to support the development of AI literacy of their staff and of other persons operating or using AI systems on their behalf, taking into account their technical knowledge, experience, education and training, the context of use and the persons on whom the systems are used. Since the amendment by Regulation (EU) 2026/1744, Article 4 states expressly that this does not require a company to guarantee any specific level of AI literacy of any individual.

The duty is therefore still mandatory for every provider and deployer, including a company whose only AI is a licensed chatbot, but it is an obligation of measures, not of result. In Greece, Article 16(3) of Law 5321/2026 allows the authorities, when imposing sanctions, to take into account whether the provider or deployer has taken sufficient measures to ensure AI literacy. Training records and policy acknowledgements are the evidence.

Transparency duties (Article 50)

Since 2 August 2026, providers must design AI systems that interact directly with people so that the people know they are dealing with AI, unless that is obvious; and providers of systems generating synthetic audio, image, video or text must mark the output in a machine-readable, detectable way (Article 50(1) and (2)). Generative systems already on the market before 2 August 2026 have until 2 December 2026 for the marking duty.

Deployers must inform people exposed to an emotion recognition or biometric categorisation system; must disclose that image, audio or video content constituting a deep fake has been artificially generated or manipulated; and must disclose AI-generated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility (Article 50(3) and (4)). The information must be given clearly at the latest at the first interaction or exposure (Article 50(5)).

High-risk AI systems (Article 6, Annexes I and III)

An AI system is high-risk in two ways. Under Article 6(1), where it is a product, or a safety component of a product, covered by the EU harmonisation legislation in Annex I and that product requires third-party conformity assessment. Under Article 6(2), where it falls in one of the Annex III areas: biometrics; critical infrastructure; education and vocational training; employment and workers' management, including recruitment, filtering of applications, promotion, termination and performance monitoring; access to essential private and public services, including creditworthiness assessment of individuals and risk assessment and pricing in life and health insurance; law enforcement; migration and border control; and the administration of justice and democratic processes.

An Annex III system is not high-risk if it poses no significant risk of harm, for example because it performs only a narrow procedural or preparatory task, but it is always high-risk where it profiles natural persons (Article 6(3)). A provider that relies on this exception must document its assessment before placing the system on the market and register it (Articles 6(4) and 49(2)).

Providers of high-risk systems carry the main duties under Article 16: compliance with the requirements on risk management, data, documentation, logging, transparency, human oversight, accuracy and cybersecurity; a quality management system; conformity assessment; EU declaration of conformity and CE marking; registration in the EU database; and corrective action. Importers must verify conformity assessment, technical documentation, CE marking and the authorised representative before placing a system on the market (Article 23); distributors must check CE marking, declaration of conformity and instructions before making it available (Article 24).

Deployers of high-risk systems: Article 26 and the fundamental rights impact assessment (Article 27)

A company using a high-risk system must use it in accordance with the instructions for use; assign human oversight to people with the necessary competence, training and authority; ensure that input data under its control is relevant and sufficiently representative; monitor operation and, where it suspects a risk, inform the provider and the market surveillance authority and suspend use; report serious incidents; keep automatically generated logs under its control for at least six months; and, as an employer, inform workers' representatives and affected workers before using a high-risk system at the workplace. Deployers of Annex III systems that make or assist decisions about people must inform those people (Article 26(11)). These duties apply to Annex III systems from 2 December 2027.

Before deploying an Annex III system, bodies governed by public law, private entities providing public services, and deployers of credit-scoring systems or of risk assessment and pricing systems for life and health insurance must carry out a fundamental rights impact assessment (Article 27(1)). Since Regulation (EU) 2026/1744, where part of the assessment is already covered by a GDPR data protection impact assessment, the deployer may cross-refer to or include the relevant parts of it (Article 27(4)), and the AI Office is to provide a template questionnaire (Article 27(5)).

General-purpose AI models

Providers of general-purpose AI models have been subject to Article 53 since 2 August 2025: technical documentation for the AI Office and national authorities, information and documentation for downstream providers integrating the model, a policy to comply with EU copyright law including text-and-data-mining opt-outs, and a public summary of the content used for training. Models placed on the market before 2 August 2025 must comply by 2 August 2027. The Commission, not national authorities, fines providers of general-purpose AI models, up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher (Article 101).

Most Greek companies are not model providers. They are deployers of systems built on such models, or providers of their own systems that integrate a third-party model. The site's guide on training data covers the Article 53 questions that model buyers raise.

Who enforces the AI Act in Greece

Law 5321/2026 (Government Gazette A' 114, 20.7.2026) lays down measures for the implementation of the AI Act. Under its Article 3, the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) is the market surveillance authority for prohibited practices under Article 5, for Annex III high-risk systems and for systems subject to the transparency duties of Article 50. The market surveillance authorities already designated under the EU harmonisation legislation in Section A of Annex I supervise high-risk AI systems linked to the products they cover. Under Article 4 the Hellenic Data Protection Authority is also the single point of contact under Article 70(2) of the AI Act, and under Article 5 the Hellenic Telecommunications and Post Commission (EETT) is the notifying authority.

On 12 November 2024 the Ministry of Digital Governance published the Greek list of authorities protecting fundamental rights for the purposes of Article 77 of the AI Act: the Hellenic Data Protection Authority, the Greek Ombudsman, the Hellenic Authority for Communication Security and Privacy (ΑΔΑΕ) and the Greek National Commission for Human Rights. As amended by Regulation (EU) 2026/1744, Article 77 allows them to request documentation from the market surveillance authority where needed for their mandate.

For AI systems based on a general-purpose AI model where the model and the system come from the same provider, and for AI in very large online platforms and search engines, Article 75(1) as amended by Regulation (EU) 2026/1744 gives the EU AI Office exclusive competence over the providers, subject to exceptions.

Fines and other sanctions

Article 99 sets the ceilings. Breach of the prohibitions in Article 5: up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Breach of the obligations of providers, authorised representatives, importers, distributors and deployers, of the transparency duties of Article 50, and, since Regulation (EU) 2026/1744, of the value-chain duties of Article 25(2) and (4): up to EUR 15 million or 3%. Supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1%. For SMEs, including start-ups, each fine is capped at the lower of the two figures (Article 99(6)); since the 2026 amendment the same applies to small mid-cap enterprises for the 3% and 1% tiers (Article 99(6a)).

Under Article 16 of Law 5321/2026, the Hellenic Data Protection Authority and the sectoral market surveillance authorities may, by reasoned decision and after hearing the operator, issue warnings, order compliance within a deadline, issue reprimands, impose the fines of Article 99 of the AI Act, and impose periodic penalty payments of up to 2% of average daily worldwide turnover of the previous financial year until the operator complies.

A Greek company using ChatGPT or another chatbot

A company that uses a licensed generative AI tool in its business is a deployer of an AI system. From that alone it must take AI literacy measures for the staff who use the tool, must not use it for any prohibited practice, and must make the Article 50 disclosures where it publishes deep fakes or AI-generated text on matters of public interest. The high-risk duties arise only if the tool is used for an Annex III purpose, such as screening candidates or assessing employees, and if the company changes the intended purpose of the tool in that way it may itself become the provider of a high-risk system under Article 25(1)(c).

The GDPR, confidentiality and intellectual property apply alongside the AI Act whenever business or personal data is entered into the tool, which is why the vendor review pack and the corporate AI policy are usually the first documents a deployer needs.

Reviewed

This page was reviewed on 11 November 2026. It describes the firm's work and is general information, not legal advice.