Ioanna Michalopoulou, Managing Partner LL.
M
Maro Polykarpou, Junior Associate LL. B, MSc.
Law 5321/2026, which implements the AI Act (Regulation (EU) 2024/1689), establishes for the first time at national level a comprehensive supervisory, enforcement and institutional framework for artificial intelligence systems in Greece.
On 16 July 2026, the Plenary Session of the Hellenic Parliament adopted Law 5321/2026, entitled “Measures for the Implementation of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Regulation) – Amendment of Law 4961/2022 and Other Provisions”.
According to Article 1, the purpose of the Law is to ensure a high level of protection of health, safety and fundamental rights, while also supporting innovation.
Under Article 3, the Hellenic Data Protection Authority (“HDPA”) is designated as the competent market surveillance authority for prohibited AI practices, high-risk AI systems as listed in Annex III and systems subject to transparency obligations. At the same time, Article 7 introduces strict deadlines for handling complaints, as the competent authority must determine whether it has the jurisdiction to assess the complaint within thirty days and ultimately assess the complaint within sixty days. In the event of inaction, the HDPA may, following the expiry of an additional ten-day period, assume exclusive responsibility for examining the case. This provision effectively shifts the burden on AI system operators, which must be able to provide documented and substantiated responses to supervisory inspections and complaints within these short time limits.
The HDPA will not, however, be the sole competent authority for every AI system. Where an AI system forms part of a product that is already subject to specific EU legislation, such as a medical device or an in vitro diagnostic medical device, the authority already responsible for supervising that particular category of products will also be responsible for its supervision under the AI Act, i.e. the National Medicines Organization (EOF). This distinction is particularly important for the healthcare sector, as the new Law introduces an additional layer of compliance arising from the AI Act, thereby creating a multi-level supervisory model.
The work of the HDPA will be supported by the designation of the Hellenic Telecommunications and Post Commission (“EETT”) as the notifying authority and the establishment within the EETT of an Artificial Intelligence Coordination and Expertise Centre. In addition, Article 12 provides for the operation of AI regulatory sandboxes by the EETT, which will offer a controlled environment for the development and testing of innovative AI systems. The Law also provides a framework for testing high-risk AI systems under real-world conditions outside AI regulatory sandboxes. In such cases, AI system providers must obtain express written authorisation from the HDPA or the competent market surveillance authority.
The new Law requires public-sector bodies, including public hospitals, to register the AI systems they use in a dedicated registry. The obligation to join the registry rests with the public hospitals in their capacity as deployers of the system, rather than with the private providers of the system. Nevertheless, the providers must supply the hospitals with the technical and regulatory information required for registration. This includes information concerning the system’s capabilities, technical characteristics and operating parameters, information on any general-purpose AI models that may be used, a documented risk classification in accordance with Article 6 of the Regulation, and, in particular, information on risks in relation to vulnerable groups, with express reference to persons with disabilities or chronic medical conditions. Public-sector bodies already using AI systems must complete the registration process by 31 December 2026.
It should be noted that the practical implementation of the new framework will depend to a significant extent on the implementation measures provided for under Article 24, which have not yet been adopted. These include complaint templates, joint decisions of the HDPA and the market surveillance authorities, and guidelines concerning the operation of the unified complaints system. Until these measures are adopted, organisations operating in the healthcare sector that already use, or intend to introduce, AI systems should proceed with the risk classification of their systems and prepare the relevant documentation so that they are ready to comply with the registry requirements, as well as the transparency and supervisory obligations introduced by the new Law.
Consequently, the timely legal mapping and assessment of AI systems has now become an essential component of compliance for every organisation operating in the healthcare sector.
