For a Greek business, three parts of the EU AI Act already apply in October 2026: the ban on prohibited AI practices and the AI literacy duty (both since 2 February 2025), and the transparency duties of Article 50, such as telling people they are talking to an AI (since 2 August 2026). The obligations for high-risk systems, such as AI that screens job candidates, were moved by the Digital Omnibus to 2 December 2027. In Greece, Law 5321/2026 implements the Act and names the Hellenic Data Protection Authority as the main supervisor, so AI Act and GDPR complaints now reach the same regulator.
What is the EU AI Act, in one paragraph?
The EU AI Act, Regulation (EU) 2024/1689, regulates AI by risk rather than by technology (EUR-Lex). A short list of practices is banned outright, such as social scoring and emotion recognition in the workplace. High-risk uses, listed in the Act's annexes, carry duties for documentation, human oversight and data quality. A middle group carries transparency duties, and most business uses of AI, such as drafting, summarising and classifying internal documents, carry no specific obligation beyond the general ones. The Act applies to anyone who places an AI system on the EU market or uses one in the EU, whatever the size of the company.
Which AI Act dates apply after the Digital Omnibus?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates that most 2025 guides still quote (EUR-Lex, European Commission). The calendar now reads:
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) |
| 2 August 2025 | Rules for general-purpose AI models, governance and penalties |
| 2 August 2026 | General application, including the Article 50 transparency duties |
| 2 December 2026 | Marking of AI-generated content for systems already on the market before August 2026 |
| 2 December 2027 | High-risk systems listed in Annex III, such as recruitment, credit scoring and education |
| 2 August 2028 | High-risk AI inside products already covered by EU safety law (Annex I) |
Selling a compliance project in 2026 on the old August 2026 high-risk deadline is now simply wrong. The transparency and literacy duties, on the other hand, are already live, and those are the ones that touch almost every business.
Who enforces the AI Act in Greece?
The Hellenic Data Protection Authority enforces most of the AI Act in Greece. Law 5321/2026, published in the Government Gazette on 20 July 2026, implements the Act nationally and repeals the earlier AI chapter of Law 4961/2022 (Law 5321/2026). Under it, the Authority is the market surveillance authority for prohibited practices, for the high-risk systems of Annex III and for the Article 50 transparency duties, the single point of contact with the European Commission, and the body that receives complaints about AI Act infringements (HDPA, 18 August 2026). It also co-runs the national AI regulatory sandbox with EETT.
The practical effect for a Greek company is simple: a complaint about your chatbot under the AI Act and a complaint about the same chatbot under the GDPR land on the same desk, read together.
Are you an AI provider or an AI deployer?
Most Greek businesses are deployers, not providers. A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system under its own authority in its work. A company that adds an AI assistant to its e-shop, or uses AI to sort its supplier invoices, is a deployer. A software house that sells an AI product under its brand is a provider, and carries the heavier duties. The same company can be both, so the question is asked per system, not per company.
What must a Greek business do about the AI Act today?
A Greek business should do six things now, most of them cheap:
- List every AI system in use, including AI features inside products you bought, with its purpose and who is responsible for it.
- Check the list against the prohibited practices, especially emotion recognition of employees and manipulative techniques. These have been banned since February 2025.
- Record your AI literacy measures. Article 4, as rewritten by the Omnibus, requires deployers to take measures that support the AI literacy of the staff who use AI, proportionate to their role. It no longer demands a guaranteed level, but it still demands measures, and a short training plus a record of who attended is the usual evidence.
- Label AI interactions. Under Article 50, a chatbot or voice assistant must tell people they are dealing with an AI unless it is obvious, at the latest at the first interaction, and synthetic images, audio and video must be marked (Article 50).
- Flag high-risk uses for 2027. CV screening, employee evaluation, credit decisions and exam scoring fall in Annex III. If you use or plan such a tool, prepare the documentation and human oversight before December 2027.
- Join it to your GDPR work. The same regulator, the same data map and often the same impact assessment. Doing them together costs less than doing them twice.
What are the fines under the AI Act?
The fines under Article 99 have three levels: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations, including transparency, and up to EUR 7.5 million or 1% for giving incorrect or misleading information to authorities (Article 99). For large companies the higher of the two amounts applies. For SMEs and start-ups the fine is the lower of the two, which is one of several places where the Act deliberately lightens the load on small companies.
What did the Digital Omnibus change for small companies?
For small companies the Omnibus changed three things beyond the dates. It introduced simplified technical documentation for SMEs. It narrowed the definition of a "safety component", so that features for user assistance or performance optimisation no longer count as one. And it added Article 4a, which allows the processing of special categories of personal data for bias detection under safeguards. None of these removes the literacy or transparency duties that are already live. How many Greek firms use AI at all, and how to read those figures, is covered in AI adoption in Greece.
I build AI systems that have to live with these rules, including a working EU AI Act conformity demo that assembles the evidence with every citation resolved. This article is a practical summary, not legal advice, and for a specific system your lawyer and the Authority's guidance come first.
Frequently asked questions
Does the AI Act apply to a small Greek company that uses ChatGPT?
Yes, as a deployer. Using ChatGPT or a similar tool for internal work mostly triggers the AI literacy duty of Article 4. If the company puts an AI chatbot in front of customers, the Article 50 transparency duty applies as well.
Does the chatbot on my website need to say it is an AI?
Yes, unless it is already obvious to a reasonably well-informed person. A clear label such as "AI assistant" at the start of the conversation is the simple way to meet Article 50, which has applied since 2 August 2026.
When do the high-risk rules apply?
For the high-risk uses listed in Annex III, such as recruitment and credit scoring, from 2 December 2027. For AI inside products covered by EU product-safety law, from 2 August 2028. Both dates come from the Digital Omnibus of July 2026.
If you want your AI systems listed and checked against these rules, tell me which AI tools your company uses. How I approach legal and compliance work with AI is on AI for legal and compliance.