AI Companies in Cyprus After the AI Act: What Buyers Should Ask in 2026

Published 25 May 2026 Updated 2 October 2026 9 min read 1653 words

The AI Act has applied in general since 2 August 2026, and the rules for high-risk systems now apply from December 2027. The dates, the two roles and the questions a buyer in Cyprus puts to a supplier.

The EU's AI Act, Regulation (EU) 2024/1689, has applied in general since 2 August 2026, and its rule that people are told when they are dealing with an AI system has applied since that date. The stricter rules for high-risk systems were postponed by an amending regulation and now apply from 2 December 2027 or 2 August 2028. A business in Cyprus that buys an AI system should ask its supplier which party holds which role under the Regulation, whether the intended use is a high-risk one, and how people are informed.

This guide states what the Regulation and the European Commission's pages said on 2 October 2026. It is not legal advice, and a business should take its own legal advice on its own case.

The dates as they stand

Date	What applies	Position on 2 October 2026
1 August 2024	The Regulation entered into force	In force
2 February 2025	The prohibited practices and the AI literacy obligations	In application
2 August 2025	The governance rules and the obligations for general-purpose AI models	In application
27 July 2026	The amending regulation, known as the AI Omnibus, entered into force	In force
2 August 2026	The Regulation in general, including the transparency obligations of Article 50	In application
2 December 2026	A further prohibited practice, added by the amending regulation	Ahead
2 December 2027	The rules for high-risk uses in the listed areas, among them employment, education and critical infrastructure	Ahead
2 August 2028	The rules for high-risk systems built into regulated products	Ahead

The dates are those on the European Commission's page on the AI Act, last updated on 3 August 2026, which records that the amending regulation was adopted as a proposal on 19 November 2025 and entered into force on 27 July 2026. They agree with Article 113 as the Commission's AI Act Service Desk displays it. Each article page opened on the Service Desk for this guide carried a notice that its text had not yet been updated for the amending regulation, while marking some paragraphs as amended. The articles quoted below are given as displayed on that day.

The authorities in Cyprus

The Commission's page states that from 2 August 2026 the AI Office and the authorities of the Member States are responsible for implementing, supervising and enforcing the Regulation. In Cyprus, the AI Cyprus site of the Commissioner of Communications states that the Commissioner is the designated Notifying Authority and Market Surveillance Authority under the Regulation and acts as the Single Point of Contact. Its page on governance adds that in January 2025 the Council of Ministers gave policy direction to the Deputy Ministry of Research, Innovation and Digital Policy, and that the Commissioner for Personal Data Protection was also designated as a market surveillance authority.

The Commission's questions and answers on Article 50 state that the transparency rules will mainly be enforced by national market surveillance authorities, and that fines can reach €15 million or 3 per cent of total worldwide turnover for the preceding financial year, with proportionality taken into account for small and medium-sized enterprises and small mid-cap companies.

Provider and deployer

The Regulation assigns its duties by role. Article 3 defines a deployer as a "natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". A business that uses an AI agent in its work is therefore a deployer. The same article defines the provider as the body that develops a system, or has one developed, and places it on the market or puts it into service under its own name or trademark.

Two consequences follow for a buyer. A business that commissions a system and puts it into service under its own name can meet the definition of a provider, so the contract should state which party holds that role. The Commission's questions and answers add that a business "remains a deployer even if third parties (e.g. contractors, freelancers) are involved in the operation of the system on its behalf and under its responsibility and control", and that a provider established outside the EU is subject to the Regulation if the output of its system is used in the EU.

High-risk uses

The Commission's page describes four levels of risk and states that the Regulation introduces no rules for AI of minimal or no risk, the category into which it places the vast majority of AI systems now used in the EU. Its high-risk examples include "AI tools for employment, management of workers and access to self-employment (e.g. CV-sorting software for recruitment)" and uses that decide access to essential services, such as credit scoring. An assistant that answers customers is given as a case of transparency risk: "when using AI systems such as chatbots, humans should be made aware that they are interacting with a machine".

A business whose intended use is in a high-risk area carries duties of its own from 2 December 2027. Article 26 requires a deployer to use the system in accordance with its instructions for use, to assign human oversight to persons "who have the necessary competence, training and authority", to keep the logs under its control for at least six months, and, where it is an employer, to inform workers' representatives and the affected workers before the system is used at the workplace.

Questions for a supplier

Ask which party is the provider and which the deployer of the system, and have the contract say so.
Ask whether the intended use falls in one of the high-risk areas, and if it does, ask for the instructions for use and the oversight the supplier expects of your staff.
Ask how a person is told that they are dealing with an AI system, and see or hear that notice before the system is put into service.
Ask whether the system produces text, images, audio or video, and whether that output is marked as artificially generated.
Ask which general-purpose AI model the system is built on. The Commission's page on those models states that their providers must give the businesses that build on them the information needed to understand the model's capabilities and limitations, so a supplier should hold that documentation.
Ask what training the supplier gives the staff who will use the system. Article 4, as amended, requires providers and deployers alike to "take measures to support the development of AI literacy of their staff".
Ask what the system does when it cannot complete a task, and who in your business then takes it over.
Ask where data is stored and processed, who may access it, and who owns the system and its accounts when the contract ends.

What a person must be told

Article 50 contains four duties of disclosure, and a buyer should establish which of them its system brings into play.

Direct interaction. Paragraph 1 requires that a system intended to interact directly with people is built so that they are informed that they are interacting with an AI system. Our guide to AI telephone agents quotes the paragraph and applies it to a telephone line. The Commission's questions and answers place outside this duty "AI systems operating solely in the background, through machine-to-machine communication, or without direct contact with people". An agent that files invoices is therefore treated differently from one that replies to customers on WhatsApp.
Generated content. Paragraph 2 requires providers of systems that generate synthetic audio, image, video or text to ensure that the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated".
Emotion recognition and biometric categorisation. Paragraph 3 requires a deployer of such a system to inform the people exposed to it.
Deep fakes and published text. Paragraph 4 requires a deployer to disclose a deep fake, and to disclose that text "published with the purpose of informing the public on matters of public interest" was artificially generated. The duty for text does not apply where the content "has undergone a process of human review or editorial control" and a person or company holds editorial responsibility for its publication. The Commission states that spell-checking and grammatical correction do not count as such a review.

The exception in paragraph 1, for cases where the use of AI is obvious, is one the Commission says "should be interpreted in a restrictive manner, given that it deprives people of transparency". Paragraph 6 leaves in place every other duty of transparency that Union or national law lays on a deployer.

Where data is held

The data protection rules continue to apply beside the AI Act: Article 26 refers a deployer of a high-risk system to its obligations under the General Data Protection Regulation, and the AI Cyprus site lists the Commissioner for Personal Data Protection among the authorities that protect fundamental rights where high-risk systems are used. A buyer should therefore know, before signing, in which country its data is stored and processed and which of the supplier's staff and subcontractors may access it.

Our own practice is stated on this site. Hosting, access and data-handling requirements are agreed with the client before development, the client retains ownership of its code, data and accounts, and data is held within the EU.

Qualia Solutions builds AI agents and voice agents from its office at Digeni Akrita 54 in Nicosia. An agent we build refers a task it cannot complete to a member of the client's team, with the conversation, the customer history and the actions attempted.

Sources

Checked on 2 October 2026.

Written by Qualia Solutions