What the new Greek AI law means for citizens who never read the terms of service

Imagine you apply for a job at a large shipping firm in Piraeus. You submit your resume, but an automated algorithm rejects your application before a human ever sees it. You ask for a reason, but the company says their software simply determined you were not a fit. For years, this black-box approach left individuals with little recourse. Law 5321/2026, recently published in the Greek Official Gazette, aims to pull back that curtain.

This new legislation brings the European Union AI Act directly into Greek courtrooms and government offices. It treats artificial intelligence not as a magic trick, but as a tool that requires a driver's license and a set of working brakes. If you live or work in Greece, these rules now govern how technology interacts with your privacy, your career, and your basic rights.

The new digital sheriffs in town

One of the most immediate changes is the designation of specific authorities to watch over AI developers and users. The Hellenic Data Protection Authority (HDPA) and the Hellenic Telecommunications and Post Commission (EETT) now have the power to investigate how companies use these systems. The HDPA focuses on your personal information, while the EETT handles the technical and market-related aspects of communication systems.

These agencies act as a shield against the irresponsible use of technology. If a company uses AI to monitor employees in a way that violates privacy, the HDPA has the statutory authority to step in. This means you have a specific place to file a complaint if you suspect a machine is making unfair decisions about your life. The law is no longer a whisper in a dark room. It is a loud, enforceable set of standards.

A mandatory registry for the public sector

Transparency is a core pillar of Law 5321/2026. The Greek government must now maintain a Registry of AI Systems for the public sector. Before a government agency uses an AI tool to process citizen data, that tool must be listed in this registry. This is a public ledger that allows you to see what software the state uses and for what purpose.

Think of this registry as a library of digital tools. If the tax office or a public hospital starts using AI to categorize citizens, they cannot do it in secret. The law requires them to document the system, its purpose, and the risks it might pose. This registry prevents the government from hiding behind complex code when it makes decisions that affect your wallet or your health.

Banned practices and red lines

Not all AI is legal under the new framework. The law draws clear lines in the sand regarding what technology is strictly prohibited. For example, systems that use real-time biometric identification—like facial recognition in public spaces for law enforcement—are subject to very narrow exceptions. You cannot be tracked by a camera that identifies you instantly without a specific legal reason and prior authorization.

Social scoring is another forbidden practice. The Greek state cannot use AI to give you a grade based on your social behavior or personality traits. This prevents the creation of a system where a low "social score" might stop you from getting a loan or a permit. These prohibitions protect the fundamental dignity of the individual from being reduced to a data point.

Accountability and the price of failure

Laws only have teeth if they carry consequences. Law 5321/2026 establishes a regime of penalties that should make even the largest corporations take notice. If a provider or a deployer—the person or company using the AI—violates these rules, they face substantial fines. These penalties are not just administrative nuisances. They are designed to be high enough to discourage companies from treating compliance as an optional expense.

In the eyes of the law, a company is liable if its AI system causes harm because the company failed to follow the safety rules. This creates a robust framework for litigation. If an AI-driven medical device fails and causes injury, the victim has a clearer path to seek recourse through the Greek court system. The burden of proof still exists, but the new regulations provide the roadmap for what constitutes negligence in the digital age.

What small business owners need to know

If you run a small business in Greece and use AI tools for marketing, hiring, or customer service, you are now a "deployer" under the law. While the heaviest burdens fall on the people who build the AI, you still have responsibilities. You must ensure that you use these tools according to the instructions provided by the manufacturer.

You also need to keep records. If your AI system interacts with the public, you should be able to explain how it works if an authority asks. Ignorance of how the software functions is not a valid legal defense. Just as a restaurant owner is responsible for the safety of the food they serve, a business owner is responsible for the digital tools they deploy.

How to protect your rights today

You do not need a computer science degree to navigate these changes. The law is designed to empower the average person. If you feel that an AI system is treating you unfairly, there are concrete steps you can take to defend yourself.

• Ask for transparency: If a company tells you a computer made a decision, ask them to provide the human logic behind that decision. Law 5321/2026 supports the right to an explanation for high-risk systems.
• Check the registry: If you are dealing with a Greek government agency, look up their AI tools in the new public registry to ensure they are compliant.
• Report violations: Do not hesitate to contact the HDPA if you believe your personal data is being used by an AI in a way you did not authorize.
• Review your contracts: If you are a freelancer or a small business owner, check your service agreements with AI providers to see who is liable if the software fails.

Ultimately, Law 5321/2026 serves as a paved road through a previously wild digital forest. It does not stop progress, but it ensures that progress does not happen at the expense of human rights. By setting clear rules for transparency and accountability, Greece is making sure that as the machines get smarter, the citizens remain protected.

Sources

• Law 5321/2026 (Greek Official Gazette, July 20, 2026)
• Regulation (EU) 2024/1689 of the European Parliament and of the Council (EU AI Act)
• Constitution of Greece, Article 9A (Protection of Personal Data)
• Hellenic Data Protection Authority (HDPA) Enforcement Guidelines

Disclaimer: This article is for informational and educational purposes only and does not constitute formal legal advice. AI regulations are complex and subject to specific local interpretations. Please consult a qualified attorney in Greece for advice regarding your specific situation or business compliance needs.