Part of the AI Regulation News hub.
Cyprus has opened public consultation on a draft Artificial Intelligence Law of 2026 that would build the national governance, supervision and penalty framework for the EU AI Act
A draft bill is not law, and this one is out for comment until the middle of September. What is worth reading now is the table of contents: twenty-five articles, and the enforcement machinery sits in the middle of it.
Bottom line: A draft bill in public consultation. It binds nobody. Comments are open on the e-Consultation platform until 16 September 2026 and the text can change before anything goes to the House.
Who this affects: Cyprus-admitted advocates advising AI providers and deployers, in-house counsel at Cyprus-registered technology and financial firms, and compliance officers at entities that will fall under national AI market surveillance.
Issue date: Draft posted for comment 16 August 2026 at 00:00; the consultation closes 16 September 2026 at 23:50. The draft PDF carries the date 12.08.2026 in its filename.
What changed: Cyprus now has a published article-by-article draft of its national AI Act implementing law, with named competent authorities, market surveillance powers, an administrative fines regime, a serious-incident notification duty and an AI regulatory sandbox all in one instrument.
Analysis: The consultation page exposes the structure, and the structure is the story. Articles 12, 13 and 14 create powers to obtain information, to investigate and to impose sanctions, and Article 21 carves out real-time biometric identification. Those are the provisions worth commenting on now, because they are the ones that will be hardest to reopen once the bill is tabled.
Primary sources: Consultation listing (EL) · Consultation page for the draft AI Law (EL)
- Instrument (EN)
- Draft Artificial Intelligence Law of 2026
- Authority
- Published on the Republic of Cyprus e-Consultation platform; consultation officer Leda Tsiourtou, leda.tsiourtou@ai.ee.cy
- Jurisdiction
- Republic of Cyprus
- Status
- Open public consultation on a draft bill
- Bindingness
- None. A draft bill under consultation creates no obligation on anyone.
- Issue date / next deadline
- Posted 16 August 2026; comments close 16 September 2026 at 23:50
- Structure
- 25 articles, listed individually on the consultation page
- EU instrument implemented
- Regulation (EU) 2024/1689
- Primary source
- https://e-consultation.gov.cy/diavouleuseis/
What the bill is for
The consultation notice states the object of the draft plainly: implementation of Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. The stated purpose is to establish the national framework needed for the effective application and supervision of that Regulation in the Republic of Cyprus.
Six things are listed as the substance. The bill would fix the national governance framework including the competent authorities and their respective competences; establish the supervision and market surveillance framework and the necessary powers of those authorities; regulate the national procedures and mechanisms required to apply the Regulation; establish a compliance and sanctions framework including administrative fines; create an AI Regulatory Sandbox aimed at supporting responsible innovation; and lay down supplementary national arrangements needed to make the European Regulation work.
None of that is unusual for a national implementing law. What Cyprus has done that many member states have not is publish the whole article list, one row per article, with a comment counter next to each.
Reading the table of contents
The twenty-five articles run from short title, object and scope through interpretation, and then into the machinery. Article 5 is Competent Authorities. Article 6 covers the internal organisation of the Commissioner. Articles 7 to 9 deal with the notifying authority, applications for notification, and that authority's powers and competences.
Article 10 is market surveillance. Article 11 is notification of serious incidents. Article 12 is the power to obtain information, Article 13 the power of investigation, Article 14 the power to impose sanctions and Article 15 the collection of administrative fines.
Articles 16 and 17 cover registration of high-risk AI systems and retention of documentation. Articles 18 and 19 create a right of appeal and a right of complaint. Article 20 deals with the application of delegated or implementing acts. Article 21 is an exemption for the use of real-time biometric identification. Article 22 is the AI Regulatory Sandbox, Article 23 the issuing of regulatory decisions, Article 24 public consultations and Article 25 entry into force.
One article had drawn a comment when we looked, and it was Article 5, the one naming the competent authorities. That is where the fight usually is.
The companion bill
The consultation page carries two attachments, and the second is not the AI bill. It is a draft amendment to the existing Law N.112(I)/2004 on the regulation of electronic communications and postal services, filed alongside so that the AI competences land somewhere institutional.
The two consultations opened on the same day, close on the same day and share a consultation officer. Anyone commenting on the AI bill in isolation is commenting on half the package.
What a practitioner should do with a month of comment time
Comments go through the e-Consultation platform and require an account to post. The platform accepts comments article by article, which means a submission can be targeted rather than a general letter.
If your client provides or deploys an AI system with a Cyprus nexus, the articles worth an hour each are 10 through 15. Those establish who can walk in, what they can demand, what they can fine and how the fine gets collected. Article 16 matters to anyone whose system may be classified high-risk, because registration duties fall out of it.
There is no substitute for reading the attached PDF text. The article titles on the consultation page tell you where the provisions sit; they do not tell you what the thresholds are.
What we did not verify
We opened the e-Consultation listing page and the dedicated consultation page for the draft Artificial Intelligence Law of 2026 in full, and took the object, the six listed purposes, the twenty-five article titles, the dates, the comment count and the consultation officer's details from them.
We did not open the attached draft bill PDF itself, so we have read no operative text, no definitions, no fine ceilings and no commencement provision. We did not open any explanatory memorandum, any impact assessment or any House of Representatives record.
We will not state what fines the bill proposes, which body is named as the competent authority in Article 5, what conditions attach to the Article 21 biometric exemption, or when the law would enter into force. The consultation page does not say and we did not read the text that does.
Cyprus has published a complete article map of its AI Act implementing bill and left a month for comment. For anyone with a Cyprus-facing AI product, the value of this window is that comments attach to individual articles, so a narrow, well-evidenced objection to the investigation and sanctions provisions has somewhere to land. After 16 September 2026 the drafting conversation moves indoors.
Source File
https://e-consultation.gov.cy/diavouleuseis/
Open the e-Consultation listing and find the entry titled O peri tis Technitis Noimosynis Nomos tou 2026. Confirm the status marked Open, the posted date of 16 August 2026 and the closing date of 16 September 2026, then open the entry and count the rows in the Contents table; there are twenty-five, ending with Entry into Force.
The purpose is to establish the national framework necessary for the effective application and supervision of the Artificial Intelligence Regulation in the Republic of Cyprus. (translated from the Greek original) ยท e-Consultation notice for the draft Artificial Intelligence Law of 2026, posted 16 August 2026
FAQ
Is this law in force in Cyprus?
No. It is a draft bill published for public consultation. It imposes no obligations, and the text can change before it is tabled.
When do comments close?
16 September 2026 at 23:50, according to the consultation page. The same deadline applies to the companion amending bill published alongside it.
How many articles does the draft contain?
Twenty-five, listed individually on the consultation page from Short Title through to Entry into Force.
Does the draft create an AI sandbox?
The consultation notice lists the creation of an AI Regulatory Sandbox to support responsible innovation among the bill's six stated purposes, and Article 22 is titled Artificial Intelligence Regulatory Sandbox. We have not read the article text.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.