AI Regulation Tracker  /  Draft law, consultation closed

Albania Published a Draft AI Law Built on the EU AI Act

The National Agency for Information Society posted a full standalone AI statute for public consultation on May 29, 2026. It runs to 106 articles and 13 annexes, imports the EU risk tiers almost intact, reaches providers outside Albania, and carries fines in Albanian lek. It is a draft. Consultation closed on June 26, 2026 with one comment filed.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Draft law, consultation closed

Key facts

Regulatory briefing

Instrument

Projektligj "Per Inteligjencen Artificiale", a draft standalone AI statute of 106 articles and 13 annexes

Authority

Agjencia Kombetare e Shoqerise se Informacionit (AKSHI), publishing in the Government of Albania's Electronic Register of Public Notifications and Consultations

Jurisdiction

Albania, with extraterritorial reach drafted into Neni 2(1)(c)

Status

Draft. Consultation opened May 29, 2026 and closed June 26, 2026. The Council of Ministers' published list of draft laws approved for submission to the Kuvend does not include this bill as of August 3, 2026

Bindingness

None today. The enacting formula is prospective and entry into force is conditioned on a gazette publication that is not recorded

Effective date

Not set. Neni 106 would run 15 days from Fletorja Zyrtare publication

Primary source

konsultimipublik.gov.al, consultation 982

What is actually on the record

On May 29, 2026 AKSHI posted a draft law titled Projektligj "Per Inteligjencen Artificiale" in Albania's official register of public notifications and consultations. The register entry is short and does the two things a consultation notice has to do: it opens the process and it sets a clock.

The register page reads, with Albanian diacritics dropped here for plain-text fidelity:

Projektligj "Per Inteligjencen Artificiale" - Agjencia Kombetare e Shoqerise se Informacionit | Postuar me: 29.05.2026 | Data e Mbylljes: 26.06.2026 | Statusi: Konsultim i mbyllur | Nr.Komenteve: 1 ... Agjencia Kombetare e Shoqerise se Informacionit hap procesin e konsultimit publik per projektligjin "Per Inteligjencen Artificiale". Ju ftojme te dergoni komentet dhe sugjerimet tuaja brenda 20 diteve pune nga data e shpalljes se njoftimit per procesin e konsultimit publik.Electronic Register of Public Notifications and Consultations, entry 982, read August 3, 2026

Translated: AKSHI opens the public consultation process for the draft law on artificial intelligence, and invites comments and suggestions within 20 working days of the announcement. Posted May 29, 2026. Closing date June 26, 2026. Status: consultation closed. Number of comments: one. The view counter read 1,637 on the morning of August 3, 2026.

What hangs off that entry is a full legislative package, not a concept note. There are seven attachments: the draft law itself, an explanatory memorandum (Relacion), a document labelled as a draft regulatory impact assessment, a consultation plan, a consultative document template, a table of contents in Albanian, and a table of contents in English. The English table of contents is the practical starting point for a US compliance reader who does not work in Albanian, and it is worth downloading before the draft itself.

The draft is a finished legislative text of 106 numbered articles and 13 annexes. That matters for how you file this. A national AI strategy or a ministerial white paper tells you a government is thinking. A 106-article bill with a penalty schedule, a transitional-provisions article and an entry-into-force article tells you a government has already decided what it intends to do and is now arguing about the details.

What the record does not yet contain is any sign of adoption. The enacting formula is written in the future-facing form Albanian bills use before passage: in reliance on Articles 78 and 83(1) of the Constitution, on the proposal of the Council of Ministers, the Assembly of the Republic of Albania decided. That is a form drafted for a vote that has not been taken. Neni 106 conditions entry into force on publication in the Fletorja Zyrtare. There is no law number to cite and no compliance date to diary.

One checkable data point sharpens that. The Council of Ministers publishes the draft laws it approves for submission to the Kuvend. Its July 9, 2026 list includes a bill to ratify the Council of Europe Framework Convention on Artificial Intelligence, proposed by the Minister of Justice. It does not include the AI statute. So the government was moving an AI-adjacent instrument through the pipeline in July while this one was still sitting after consultation. Read that as sequencing information, not as a decision to shelve the bill.

It is the EU AI Act, in Albanian

The most useful thing about the draft is how little of it is original, and the drafters say so themselves. The text carries a footnote on its title:

Ky ligj eshte perafruar plotesisht me Rregulloren (BE) 2024/1689 e Parlamentit Evropian dhe e Keshillit e 13 qershorit 2024, e cila vendos rregulla te harmonizuara mbi inteligjencen artificiale.Projektligj "Per Inteligjencen Artificiale", title footnote, read August 3, 2026

That is the standard Albanian approximation footnote, and it says the law is fully approximated with Regulation (EU) 2024/1689 of June 13, 2024. Neni 1, the purpose and object clause, tracks Article 1 of that Regulation closely enough that reading them side by side is mostly an exercise in matching clauses.

The Albanian text states that the purpose of the law is to improve the functioning of the market and the legal environment of the Republic of Albania, and to promote the development, placing on the market, putting into service and use of human-centric and trustworthy artificial intelligence, while ensuring a high level of protection of health, safety, fundamental rights, democracy, the rule of law and environmental protection against the harmful effects of AI systems, and supporting innovation. Anyone who has read the EU Act's Article 1 will recognise the sentence.

The structure follows. Neni 4 carries an AI literacy duty on providers and users. Neni 5 carries the prohibited practices. The high-risk requirements and conformity assessment machinery are there, so are the transparency duties in Neni 50 and a general-purpose AI model chapter with a codes-of-practice section. Regulatory sandboxes appear in the fifties, with AKSHI told to run a single public information interface for them. Thirteen annexes carry the lists and technical schedules, in the same architectural role the EU annexes play. Annex I of the draft is unusual and worth reading: it lists the Albanian laws the bill is meant to sit beside, including Law 43/2023 on electronic governance as amended, Law 100/2024 amending it, and Law 124/2024 on personal data protection.

For a US compliance function that already has an EU AI Act program, this is the practical headline. If the draft is adopted in something like its current shape, the marginal work for Albania is jurisdictional rather than substantive: identify your Albanian exposure, appoint an authorised representative if you provide high-risk systems without an Albanian establishment, and map your existing technical documentation onto Albanian annex references. You would not be building a second control framework. You would be re-pointing the first one.

I want to be careful with the word near-complete. Transposition is not translation, and the places where a national drafter departs from the source text are exactly where the surprises live. The penalty currency is one obvious departure. The institutional design is another, and it is contested. There is also visible drafting churn in the file: at least one annex threshold, a 10,000-registered-user test for models with high impact, appears struck through in the published document. Nobody should read this draft as meaning that EU AI Act compliance automatically equals Albanian compliance until there is an adopted text to compare against.

The scope reaches outside Albania

The scope article is where a foreign vendor should start reading, because the drafters copied the EU's extraterritorial hook rather than limiting the law to conduct inside the country.

Neni 2(1)(c) applies the law to providers and users of AI systems who are domiciled or located in another country, where the output produced by the AI system is used in Albania. That is the same output-use trigger that made the EU Act reach beyond the Union, and it is the reason a US company with no Albanian entity, no Albanian server and no Albanian employee could still be inside the perimeter. Paragraph (a) covers providers placing systems or GPAI models on the Albanian market whether or not established in Albania. Paragraph (b) covers users domiciled or located in Albania. Paragraphs (d) and (e) reach importers, distributors and product manufacturers who place an AI system on the market together with their product and under their own name or trademark. Paragraph (f) covers authorised representatives of providers not established in Albania, and paragraph (g) names affected persons located in Albania.

The exclusions are equally worth knowing, because they are narrower than people assume. The draft carves out uses exclusively for military, defence or national-security purposes, including where only the output is used in Albania for those purposes; foreign public authorities and international organisations acting under law-enforcement or judicial cooperation with adequate safeguards; systems and models developed and put into service solely for scientific research and development; pre-market research, testing and development activities, with Neni 2(6) saying expressly that testing in real-world conditions is not covered by that exemption; natural persons using AI in a wholly personal, non-professional activity; and free and open-source systems, unless they are placed on the market or put into service as high-risk systems or fall within the prohibited practices of Neni 5.

Read that last one carefully if open-source is part of your defence. The exemption evaporates the moment the system is high-risk or touches a prohibited practice, which is the same design choice the EU made. Publishing weights is not a scope argument.

Two savings clauses run the other way and are easy to miss. Neni 2(9) says the law applies without prejudice to labour legislation, occupational health and safety legislation and collective agreements where those set more favourable standards for the protection of employees in relation to employer use of AI systems. Neni 105 says the law applies without prejudice to personal data protection, consumer protection and product safety legislation. If you deploy AI in an Albanian workplace, the draft is a floor and not a ceiling.

The numbers: fines, clocks and who holds the pen

The penalty schedule sits in Neni 97, 98 and 99, denominated in Albanian lek. None of it is in force, and I am deliberately not converting the figures into dollars or euros here, because an undated FX conversion in a compliance file is worse than no conversion at all. Do the conversion yourself, on a date you record.

Neni 97 is the operator schedule. Breach of the prohibited practices in Neni 5 draws an administrative fine of ALL 5,000,000 to ALL 40,000,000, and Neni 97(5) allows the fine to be set at up to 7 percent of the previous financial year's turnover where the offender is a legal person or undertaking and that figure is higher than the cap. Neni 97(6) covers the operator and conformity-assessment-body tier at ALL 2,000,000 to ALL 20,000,000 or up to 3 percent of turnover, and it is drafted as a closed list of cross-references: provider obligations under Neni 16, authorised representatives under Neni 22, importers under Neni 23, distributors under Neni 24, users under Neni 26, the requirements on conformity assessment bodies, and the transparency duties under Neni 50. Supplying inaccurate, incomplete or misleading information to competent authorities or conformity assessment bodies draws ALL 500,000 to ALL 10,000,000 or up to 1 percent under Neni 97(7). Neni 97(8) tells authorities to weigh proportionality for SMEs and start-ups and to apply the lower end of those ranges where appropriate.

Neni 98 is the one most summaries miss, and it is the one an Albanian public-sector buyer should read first. It sets a separate regime of administrative measures and fines against public institutions, bodies, agencies and public legal persons: up to ALL 15,000,000 for breach of the Neni 5 prohibitions and up to ALL 7,000,000 for other breaches of the law, with the institution's budget and financial capacity listed among the factors. Neni 99 gives GPAI model providers their own tier of up to 3 percent of total annual turnover for the preceding financial year, or ALL 150,000,000, whichever is higher, for breaches including refusing or obstructing the authority's access to the model or its technical documentation. Neni 100, separately, is the corrective-measures article: bring the system into conformity within a deadline, restrict its use, suspend it, withdraw it from the market, or stop its use permanently.

The clocks are in Neni 102 and 103, and this is where a partial reading does real damage. Neni 102(1) gives AI systems placed on the market or put into service before entry into force a 24-month transition period in which they may continue in use provided they are brought into conformity. Providers and users of high-risk systems must adapt within 12 months of entry into force. GPAI models get 12 months from the adoption of the relevant secondary legislation. Competent authorities must be created and functional within 6 months. Neni 103 requires the Council of Ministers to adopt implementing acts within 6 months, and it names the articles those acts must cover, including real-time biometrics, the organisation of the competent authorities, amendment of Annexes III, IV, VI, VII and XIII, conformity assessment procedures, codes of practice, the sandbox, the fine methodology and a national register of AI systems. Quoting only the 12-month high-risk figure understates the horizon for legacy estates by a year.

Two more provisions deserve a place in your notes. Neni 22 requires providers of high-risk AI systems, before making them available on the Albanian market, to appoint by written mandate an authorised representative established in Albania, who must hold the mandate and produce it to market surveillance authorities on request in Albanian or another language acceptable to the authority. Note the narrowing: as drafted this is a high-risk obligation, not a duty on every provider. And Neni 52 would require a provider whose general-purpose AI model meets the Neni 51 threshold to notify AKSHI, in its capacity as the Structure for AI, without delay and in any event within two weeks. That is a fourteen-day clock with a named recipient, which is the kind of obligation that fails on process rather than on substance.

Finally, Neni 104 contains a partial self-repeal tied to Albania's future accession to the European Union: on the date of accession the provisions transposing directly applicable rules of Regulation (EU) 2024/1689 fall away, except those governing institutional organisation, competent authorities, national registers, administrative procedure and matters the EU act leaves to member state discretion, with the Council of Ministers to publish the list within 6 months. That tells you what this bill is for. It is an accession-alignment instrument as much as an AI-governance one.

The one comment, and what it says about the fight ahead

Exactly one comment was filed during the consultation, on June 25, 2026, by the American Chamber of Commerce in Albania. In a process with more than 1,600 recorded views and one submission, that single comment carries more weight than it normally would, and it is a structured legal critique rather than a courtesy letter. It runs to seven sections and sorts its objections by severity: two amendments it calls critical, two it calls important, four it says can be handled by secondary legislation, plus a recommendation to run a regulatory impact assessment and a proposal for a shared Western Balkans AI regulatory sandbox.

The two critical ones are the ones to watch. The first is institutional. The draft treats AKSHI as the "Strukture per IA-ne" and as a coordinating and competent authority; the definition of competent authority in Neni 3 lists the notifying authority, the market surveillance authority, the Commissioner for the Right to Information and Personal Data Protection, and AKSHI in that capacity, plus any other body designated by decision of the Council of Ministers. AKSHI is also the state's own IT builder and operator. AmCham argues that combining the regulator and operator roles in one body conflicts with the independence requirement in Article 70 of the EU AI Act, and proposes moving the supervisory role to the Commissioner, with AKSHI kept as technical support that does not decide, penalise or supervise. The second is definitional. AmCham says the draft's Neni 3 definition of provider folds the developer and the integrator into one category, fails to draw the line Article 25 of the EU Act draws, and states that this point affects more than 95 percent of Albanian companies active in the technology sector.

Those figures and characterisations are the commenter's, not the government's, and the same goes for the EU AI Act timing points AmCham cites in support. I am reporting what the comment says, not endorsing its arithmetic. One of its claims is directly checkable against the draft and does not survive the check: AmCham says the bill has no phased entry into force and that everything would apply immediately on adoption and promulgation. The published text has Neni 102, which stages 24 months, 12 months and 6 months for different populations. AmCham may be arguing that those transitions are too crude, and that is a fair argument, but as written the objection overstates. When a submission is the only one on the file, it is worth reading against the text rather than through it.

Here is my read. The provider-versus-integrator objection is the one with commercial teeth. In any market, most companies buying and configuring AI are integrators, not model builders, and a statute that collapses the two puts full provider obligations onto systems integrators and resellers who have no ability to discharge them. The EU drew that line deliberately. A transposition that blurs it is not a lighter law, it is a broader one, and the burden lands on exactly the mid-sized firms least able to carry it. If you sell AI through Albanian channel partners, this is the clause to watch, because it determines whether your reseller inherits your obligations or its own.

The regulator-design objection matters for a different reason. Whether AKSHI ends up as the supervisor is genuinely open. Do not write AKSHI into your compliance register as Albania's AI regulator yet. The designation is in a draft, it is the subject of the only filed objection, and it is a normal thing for a legislature to change. Note also that the draft's own governance design is more crowded than the headline suggests: it creates a National Board for Artificial Intelligence drawn from the responsible ministries, with the Commissioner sitting as an observer and AKSHI providing the technical secretariat, and it leaves the responsibilities, tasks and cooperation arrangements of all the competent authorities to be fixed later by Council of Ministers decision. Even if the bill passed tomorrow, you would not know from the statute alone who your day-to-day counterpart is.

Separately, and often confused with this file: Albania signed the Council of Europe Framework Convention on Artificial Intelligence, CETS No. 225, on June 15, 2026. The Treaty Office chart, read on August 3, 2026, shows no ratification recorded for Albania, 20 signatures not followed by ratification, and a single ratification, by the European Union on May 15, 2026. The Convention enters into force only on five ratifications including at least three Council of Europe member states, so that threshold is not met. Ratification is moving, though: on July 9, 2026 the Council of Ministers decided to propose a ratification bill to the Kuvend. Keep the two files apart. The Convention is a treaty obligation on the state; the draft AI law is the instrument that would create duties for you.

What do you actually do on Monday? If you have no Albanian revenue, exposure or partner, nothing beyond recording that a draft exists and who published it. If you do, four things. Check whether your systems' outputs are used in Albania, because that is the trigger in Neni 2(1)(c) and it does not require an Albanian entity. Work out whether anything you supply would be high-risk under the draft, since that single classification drives the Neni 22 representative duty and the 12-month adaptation clock. Decide provisionally who would act as that representative, since it is the one obligation with a lead time you cannot compress. And put a monitoring item on the Council of Ministers agenda, the Kuvend calendar and the Fletorja Zyrtare, because the only event that turns any of this into duty is a vote followed by a gazette publication, and the first date that matters after that is 15 days later.

Last verified: August 3, 2026 against the primary sources listed above.