Cyprus Moves to Enforce EU AI Rules With Fines of Up to €35 Million
Cyprus is taking a major step toward establishing a national regulatory framework for artificial intelligence, as the country moves to implement and supervise the European Union’s AI rules. Two proposed bills are currently under public consultation and could introduce penalties of up to €35 million or 7% of a company’s global annual turnover for the most serious violations.
The public consultation is scheduled to remain open until September 16, 2026, giving businesses, technology companies, researchers and other stakeholders an opportunity to comment on the proposed framework before it moves further through the legislative process.
Cyprus Establishes a National AI Oversight System
The legislation is designed to support the national implementation and enforcement of EU Regulation 2024/1689, commonly known as the EU AI Act.
Under the current proposal, Cyprus’ Office of the Commissioner for Electronic Communications and Postal Regulation (OCECPR) would become the country’s central AI regulator, notifying authority and main point of contact for matters related to the European regulation.
The regulator would receive significant enforcement powers. Authorised officials could inspect business premises, request documents and information, and require individuals to provide statements during investigations.
Companies found to be violating the rules could receive warnings or orders requiring them to stop certain activities. Regulators could also order AI systems to be withdrawn or recalled from the market.
Penalties Could Reach €35 Million
The proposed penalty system reflects the risk-based approach of the EU AI Act.
Minor violations could result in administrative fines of up to €30,000, increasing to €60,000 for repeated offences.
More significant violations involving providers, importers, distributors and authorised representatives could result in penalties reaching €15 million or 3% of worldwide annual turnover.
The most serious violations, including prohibited AI practices, could carry fines of as much as €35 million or 7% of global annual turnover, whichever is higher.
The scale of these penalties means AI compliance is likely to become an increasingly important issue for Cyprus-based technology companies, financial institutions and businesses integrating artificial intelligence into their products and operations.
High-Risk AI Will Face Additional Scrutiny
Not every AI application will be treated in the same way.
The regulatory framework pays particular attention to high-risk AI systems — applications capable of significantly affecting areas such as health, safety, fundamental rights or economic wellbeing.
OCECPR would cooperate with specialised regulators depending on where these systems are deployed. The Central Bank of Cyprus, for example, is expected to supervise high-risk AI applications used by financial institutions, while the country’s Personal Data Protection Commissioner would have responsibilities related to relevant systems involving personal data.
This is particularly relevant for Cyprus because of the country’s substantial financial and professional-services sectors, where AI is increasingly being considered for fraud detection, compliance, risk analysis and automated customer services.
A Regulatory Sandbox for AI Startups
Cyprus is not approaching artificial intelligence regulation exclusively through restrictions.
The proposed framework also includes an AI Regulatory Sandbox, which would provide startups, researchers and other innovators with a controlled environment for testing new AI technologies under regulatory supervision.
Regulatory sandboxes could become particularly valuable for smaller technology companies. Instead of developing a product and discovering compliance problems only when it reaches the market, developers can potentially identify regulatory and technical risks earlier.
For Cyprus, such an environment could also become a competitive advantage as the country attempts to attract AI companies seeking access to the European market.
Cyprus Wants to Become an Eastern Mediterranean AI Hub
The legislation arrives alongside a much broader national effort to accelerate artificial intelligence development.
Cyprus recently presented its National AI Strategy 2032, which aims to position the country as a trusted AI hub in the Eastern Mediterranean and as a bridge between the European Union and neighbouring markets. The strategy emphasizes AI infrastructure, governance, skills, research and adoption across both government and industry.
One of the biggest challenges is the country’s relatively low starting level of corporate AI adoption.
According to the draft strategy, only 9.27% of Cypriot enterprises used AI in 2025, compared with an EU average of 19.95%. Cyprus therefore intends to accelerate adoption while simultaneously developing the regulatory safeguards needed for responsible use.
The country also aims to build a talent pool of approximately 3,000 AI professionals by 2032, supported by university programs, professional training, reskilling initiatives and efforts to attract specialised technology talent.
AI Could Transform Cyprus’ Key Industries
The national strategy identifies several areas where artificial intelligence could have a particularly significant impact.
Financial and fintech companies could deploy AI for compliance, fraud detection, risk assessment and personalised services. Healthcare organisations could use intelligent systems for diagnostics, resource planning and research, while the tourism industry could introduce AI-powered travel planning and personalised visitor services.
Shipping, education, public administration and professional services are also among the sectors where Cyprus sees opportunities for greater AI adoption.
Government itself is expected to become an important testing ground. The strategy envisions AI-powered public services, including multilingual digital assistants, automated document processing and decision-support systems.
Regulation Could Become a Competitive Advantage
Cyprus’ approach highlights an important shift taking place across the global technology industry.
Governments increasingly face the challenge of encouraging artificial intelligence innovation while establishing safeguards around privacy, transparency, accountability and potentially harmful applications.
Cyprus appears to be attempting both simultaneously.
The proposed penalties demonstrate that serious violations could have substantial financial consequences. At the same time, regulatory sandboxes, investment in AI skills and the National AI Strategy indicate that the country wants to encourage the development of a domestic AI ecosystem rather than simply restrict the technology.
For technology companies operating in Cyprus, this means AI compliance is likely to become part of product development itself. Developers may increasingly need to consider risk classification, data protection, transparency, documentation and human oversight from the earliest stages of building an AI-powered service.
If Cyprus successfully combines clear regulation with a startup-friendly environment and stronger digital infrastructure, the country could use its position inside the European Union to attract companies looking for a regulated base from which to develop and deploy AI services.
The coming months will therefore be important for the country’s technology sector. The final shape of the legislation will determine not only how artificial intelligence is supervised in Cyprus, but potentially how attractive the island becomes as a European destination for the next generation of AI companies.