Greece's AI Act Implementation: HDPA as Market Surveillance Authority

Greece has opened its AI Act implementation law for public consultation and the most consequential choice in it is about who enforces.

Under the draft, the Hellenic Data Protection Authority (HDPA) becomes the lead market-surveillance authority for the parts of the EU AI Act that reach most businesses: prohibited practices (Art. 5), Annex III high-risk systems, and the transparency obligations (Art. 50). In plain terms, the regulator that already holds your GDPR file would also hold your AI file.

Three features worth reading closely

• Sanction decisions are published with the infringer's identity, the nature of the breach and the penalty imposed.
• Where a sanction is imposed, the authority can charge the operator the full cost of the investigation — testing, measures, storage — on top of the fine.
• For real-world testing of high-risk systems outside the sandbox, silence is not consent: a lapsed 30-day period does not count as authorisation.

A twist that's easy to miss: under the draft law, reporting an employer's AI Act breach would fall under whistleblower protection (Law 4990/2022), thus turning non-compliance into a protected, reportable matter inside the organisation itself.

This is a draft, not yet law, with the public consultation closing on 6 July 2026, yet the direction is clear, and public-sector bodies already using AI face a registration deadline of 31 October 2026.

Our full breakdown of Part A (Arts. 1-25) is available for download.