EU AI Act governance in Cyprus

What it is

The EU AI Act (Regulation (EU) 2024/1689) applies directly in Cyprus, as in every member state. What each country decides for itself is who supervises it and with what powers. Article 70 of the Act required member states to designate their national competent authorities and a single point of contact by 2 August 2025.

Cyprus did this early. In January 2025 the Council of Ministers designated the authorities and chose a centralised model, with one body at the centre and others working alongside it in their own fields. The Office of the Commissioner of Communications runs the national AI Act website, aiact.cy, which sets out the structure, the risk categories and how to submit a complaint.

Who does what

• Commissioner of Communications. Notifying authority, market surveillance authority and single point of contact. It supervises and enforces the Act, including prohibited practices and the rules for high-risk systems, and sets up and monitors the procedures for notified bodies. Its powers include access to premises, information requests, testing, corrective orders, withdrawal from the market and penalties.
• Commissioner for Personal Data Protection. A market surveillance authority for high-risk systems in Annex III point 1 when used for law enforcement, and points 6, 7 and 8, which cover law enforcement, migration, asylum and border control, and the administration of justice and democratic processes. It also covers prohibited practices under Article 5 that relate to those areas. It remains the GDPR supervisory authority for any AI that processes personal data.
• Deputy Ministry of Research, Innovation and Digital Policy. Sets policy direction, coordinates the national AI governance framework and represents Cyprus on the European AI Board.
• Cyprus Organisation for the Promotion of Quality (CYS-CYSAB). The national accreditation body for the conformity assessment bodies that test and certify high-risk systems.
• Fundamental rights authorities. Under Article 77, the Commissioner for Personal Data Protection, the Ombudsman and the Attorney-General can request documentation and information about high-risk Annex III systems in their fields.

Cyprus has said a separate framework is being developed to set out the responsibilities of its other national market surveillance authorities. That matters most in financial services, where Article 74(6) of the Act makes the financial supervisor the market surveillance authority for high-risk AI used by regulated institutions.

The draft Artificial Intelligence Law of 2026

The designations rest on a Council of Ministers decision. To give the authorities statutory powers over inspections, supervision and administrative sanctions, Cyprus has drafted an Artificial Intelligence Law of 2026. It was published on the government’s e-Consultation platform with comments due by 16 September 2026.

The draft covers the national AI governance framework, the designation of competent authorities, a market surveillance and monitoring framework, compliance procedures and administrative enforcement, and an AI regulatory sandbox. A second bill would set up a dedicated Artificial Intelligence Directorate inside the Office of the Commissioner of Communications. Neither bill creates obligations beyond the EU AI Act.

What it means for organisations in Cyprus

The obligations come from the EU AI Act, on its timetable as amended by the 2026 Digital Omnibus. Prohibited practices and the AI literacy duty have applied since February 2025. General application, including the Article 50 transparency duties for chatbots and generated content, began on 2 August 2026. Obligations for Annex III high-risk systems apply from 2 December 2027, and for AI embedded in regulated products from 2 August 2028.

The Cypriot layer tells you who will ask the questions. A provider or deployer of a high-risk system in Cyprus will deal with the Commissioner of Communications on most matters, and with the Commissioner for Personal Data Protection where the system sits in law enforcement, migration or justice. Serious incidents under Article 73 are reported to the market surveillance authority for the system concerned.

In practice that points to the same groundwork everywhere in the EU. Keep an inventory of AI systems with each one’s risk classification, run the deployer duties for any high-risk use, and know who to notify when something goes wrong.

How it relates to other frameworks

The EU AI Act page covers the obligations themselves. Cyprus’s draft National AI Strategy 2032 proposes a National AI Authority and an internal control framework for government AI, which would sit alongside these supervisory roles rather than replace them. Organisations building an AI management system often use ISO/IEC 42001 to structure the controls the Act expects.

A note on this page

This is Aicura’s summary of how Cyprus supervises the EU AI Act, as published by the Office of the Commissioner of Communications. It is not legal advice. Check aiact.cy and the final text of the Artificial Intelligence Law once enacted, and take advice on how the Act applies to your organisation.