GreeceLaw 5321/2026, National AI Act Implementation Law
Law 5321/2026, arts. 3-5, 16, 23 (FEK A' 114/20.07.2026)
In force since .
An AI transparency rule binding public and private bodies.
- Obligation class
- Content labelling
- Audit expectation
- on_request
- Who audits it
- Regulator
- Setting the rule reaches
- General
What it requires
- Do not remove or interfere with the machine-readable marking your AI system embeds in synthetic audio, image, video, or text output under EU AI Act Article 50(2).
- Do not remove or interfere with a deployer's disclosure that content is a deepfake or has been artificially generated or manipulated, under EU AI Act Article 50(4).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Removing the machine-readable marking on synthetic output, obstructing the AI system provider's technical labelling solution, or removing or obstructing a deployer's deepfake disclosure, is punished with imprisonment and a fine, unless the act is punished more severely under another provision (art. 23).
Who enforces it
Enforcement body
Hellenic Data Protection Authority (HDPA), designated the market surveillance authority under AI Act Article 70(1) for Article 5 prohibited-practice systems, Annex III high-risk systems, and Article 50 transparency systems, and the single point of contact under Article 70(2); the Hellenic Telecommunications and Post Commission (EETT) is the notifying authority under Article 28(1).
Settledness
- As of
- Open questions
- Does the offence in Article 23 of Law 5321/2026 apply to removing the machine-readable marking from the output of a generative AI system placed on the market before , given that Article 111(4) of the AI Act, as inserted by Regulation (EU) 2026/1744, gives such providers until to comply with Article 50(2)?
- Does 'παρακωλύει την εύρυθμη λειτουργία των τεχνικών λύσεων του παρόχου' (obstructs the proper operation of the provider's technical solutions) in Article 23 reach a deployer whose ordinary editing, cropping or compression strips the marking, or only deliberate removal?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 3-5 designate the HDPA, the EETT and the single point of contact under the AI Act; Article 23 criminalises removing an AI Act Article 50 marking or disclosure; neither imposes a record duty of its own. Article 16 paragraph 5 is different: it applies by analogy paragraphs 4 and 5 of Article 15 of Law 4624/2019, and paragraph 4(δ) of that article orders and compels the surrender to the HDPA of documents, filing systems, equipment or means of processing personal data. That is a party-facing production duty, not a bare grant of inspection power to the authority (unlike Italy's Law 132/2025 Article 20, which names only the regulator's own vigilanza and inspection activity): a party ordered to hand over documents on demand cannot comply without having kept them.
- Kind
- Implicit
- As of
- Provision
- Article 16 paragraph 5, incorporating by reference Law 4624/2019 Article 15 paragraph 4(δ)
What this law does
Article 3 designates the Hellenic Data Protection Authority (HDPA) as the market surveillance authority under AI Act Article 70(1) for systems within the Article 5 prohibited practices, the Annex III high-risk list, and the Article 50 transparency duties; Article 4 makes the HDPA the AI Act's single point of contact, and Article 5 names the Hellenic Telecommunications and Post Commission (EETT) as the notifying authority for conformity-assessment bodies.
Article 16 gives the HDPA and other market-surveillance authorities warning, reprimand, and Article 99 fining powers on top of the AI Act's own machinery, plus a periodic financial penalty of up to 2 percent of an undertaking's average daily worldwide turnover for continuing non-compliance.
Article 23 makes it a crime, punished by imprisonment and a fine unless a more severe provision applies, to remove or obstruct the machine-readable marking an AI system embeds in synthetic output under AI Act Article 50(2), or to remove or obstruct a deployer's disclosure under Article 50(4) that content is a deepfake or has been artificially generated or manipulated.
When LexLint raises it
When your app profile says your app generates audio with AI, generates content with AI, generates images with AI, generates text with AI or generates video with AI.
Back to the example · Lint your app
Page updated .