Cyprus cannot choose whether it is bound by the EU AI Act—but it can choose whether national implementation becomes a burden or a competitive advantage.

Cyprus’s draft laws implementing the EU AI Act have recently made the news, particularly for their headline penalties.

The headline penalties need context. Fines for prohibited AI practices can reach €35 million or 7% of worldwide annual turnover, whichever is higher; for SMEs and start-ups, the lower ceiling applies. These are maximum penalties, not the standard response to an ordinary mistake. The reported imprisonment and €10,000 fine appear to concern obstructing an authorised official, not ordinary AI non-compliance; their exact scope should be confirmed against the proposed bill.

The proposed bills would establish national arrangements for supervision, enforcement, appeals and Cyprus’s AI regulatory sandbox—a supervised environment where businesses can test innovative AI systems with regulatory guidance. This differs from Cyprus’s draft National AI Strategy 2032: the strategy sets the country’s broader ambitions; the legislation sets the rules of the road. The strategy is under a separate consultation until 31 August.

The AI Act’s underlying aims are reasonable. Few would defend AI systems that manipulate people, exploit vulnerabilities, use prohibited social scoring or make consequential decisions without appropriate safeguards, oversight and avenues for challenge.

The more important questions are practical:

1. Will supervisory bodies have sufficient technical expertise to distinguish low-risk tools from genuinely high-risk systems?
2. Will Cyprus’s AI regulatory sandbox provide clear timelines, practical templates, secure testing, rapid classification guidance and meaningful support for SMEs and start-ups?
3. What information will companies need to disclose, and how will commercially sensitive material be protected? For high-risk systems, authorities may require documentation and relevant training, validation and testing data. Access to source code is permitted only under tightly limited conditions.
4. Will implementation be sufficiently clear, proportionate and predictable for Cyprus’s start-ups? Moving outside the EU does not necessarily avoid the Act when systems are placed on the EU market or their outputs are used in the Union.
5. Will public-sector AI be subject to equally effective safeguards, transparency and accountability in practice?

If implemented well, trust can become a market advantage. Regulators and innovators alike may need support through AI literacy, independent evaluation and compliance education.

The consultation on the proposed legislation is open until 16 September.

Can Cyprus make responsible AI easier to build—and easier to trust—than anywhere else?