03/07/2026
The AI Act is coming for your company
In 30 days, the EU starts enforcing its AI law. Does it apply to your business?
From 2 August 2026, Regulation (EU) 2024/1689 — the EU AI Act — comes into full effect. As an EU Regulation, it applies directly in Cyprus without requiring a vote in Parliament — exactly like the GDPR.
🔍 WHAT AI DOES THIS LAW COVER?
This is not only about tech companies. It applies to any business that uses AI tools — even off-the-shelf — to:
→ Evaluate or select employees or job applicants
→ Grant or deny credit, insurance, or financial products
→ Influence educational decisions
→ Manage access to public or essential services
→ Process biometric data
These are classified as "high-risk" AI systems and carry the strictest obligations.
📋 WHAT MUST BUSINESSES DO?
✦ Know which AI tools you use and which risk category they fall into
✦ Ensure meaningful human oversight — no AI system should make significant decisions alone
✦ Inform users when they are interacting with AI (chatbots, automated responses, etc.)
✦ Clearly label AI-generated content — text, images, video, deepfakes (Article 50)
✦ Train staff on basic AI literacy — this has been mandatory since February 2025
✦ Review contracts with AI vendors and suppliers for compliance obligations
⚠️ WHAT IF YOU DON'T COMPLY?
Penalties are set at EU level by the Regulation itself:
→ Up to €35 million or 7% of global annual turnover for prohibited practices
→ Up to €15 million or 3% for other violations
Note: Cyprus is expected to pass secondary legislation to finalise the national enforcement regime. The Commissioner of Communications has been designated as the national Market Surveillance Authority.
💡 A PRACTICAL EXAMPLE
If you use software that filters CVs or scores job applications, this is classified as "high-risk" AI. It requires full documentation, transparency toward candidates, and human oversight before any decision is made.
If you have not yet assessed your position, now is the time.
📩 Contact us or visit www.eklaw.com.cy