Inside Greece's new AI Act framework

This summer, Greece established its national governance, innovation and enforcement framework for the EU AI Act through Law 5321/2026, which distributes oversight among existing sectoral regulators rather than creating a standalone AI authority.

The law takes effect on its 20 July publication date unless a specific provision states otherwise. Its publication arrived roughly two weeks before the European Commission and national authorities began enforcing the AI Act on 2 Aug., when new transparency rules took effect. 

The law's passage progressed quickly. Greece's Ministry of Digital Governance opened the bill for public consultation 21 June, and the text was finalized and enacted within two weeks of the consultation's 6 July closing.

A distributed model, not a new AI authority

The AI Act relies on several types of national authorities to oversee AI systems with general-purpose AI models centrally supervised by the Commission's AI Office. Member states have discretion over how to structure these authorities and, as a result, have taken a range of approaches.

Greece has designated the Hellenic Data Protection Authority as its market surveillance authority for prohibited AI practices, Annex III high-risk systems and Article 50 transparency obligations. The HDPA is also the country's single point of contact with the Commission and other member states, placing the enforcement of the AI Act and EU General Data Protection Regulation under the same regulator.

Legal commentators have noted that the HDPA's central role is not incidental: Many AI systems captured by the AI Act's Annex III process personal data or directly affect fundamental rights, giving the HDPA's existing data protection expertise direct relevance to its new AI Act mandate.