1. What are your countries legal definitions of "artificial intelligence"?
According to the National Artificial Intelligence Strategy of Cyprus, Artificial Intelligence (AI) refers to the systems that display intelligent behaviour, by analysing their environment and taking actions with some degree of autonomy in order to accomplish specific tasks.
Currently the main definition of AI is the one provided for in the Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the "AI Act") which entered into force on 1 August 2024. The purpose of the AI Act is to establish a harmonised market for AI throughout the EU, foster responsible AI development and deployment in the EU, with safeguards for people's fundamental rights. The AI Act introduces a definition of AI, based on a product safety and risk-based approach in the EU. According to the AI act:
"AI system' means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;"
2. Has your country developed a national strategy for artificial intelligence? If so, has there been any progress in its implementation? Are there plans for updates or revisions?
In January 2020, the Council of Ministers launched the National Artificial Intelligence Strategy of Cyprus and outlined its priorities, which focus on the following areas:
- Further to the above, the Council of Ministers approved the formation of a National Artificial Intelligence (AI) Taskforce in January 2025. Cyprus is also planning to revise its National Artificial Intelligence Strategy.
- In addition, Cyprus signed the MED9 Joint Declaration on Artificial Intelligence in 2023 at a meeting which focused around harnessing the potential of artificial intelligence to address critical issues among others research and innovation utilising reliable artificial intelligence.
- Cultivating talent, skills and lifelong learning
- Increasing the competitiveness of businesses through support initiatives towards research and innovation and maximising opportunities for networking and partnerships
- Improving the quality of public services through the use of digital and AI-related applications
- Creating national data areas
- Developing ethical and reliable AI
3. Has your country implemented rules or guidelines (including voluntary standards and ethical principles) on artificial intelligence? If so, please provide a brief overview of said rules or guidelines. If no rules on artificial intelligence are in force in your jurisdiction, please (i) provide a short overview of the existing laws that potentially could be applied to artificial intelligence and the use of artificial intelligence, (ii) briefly outline the main difficulties in interpreting such existing laws to suit the peculiarities of artificial intelligence, and (iii) summarize any draft laws, or legislative initiatives, on artificial intelligence.
The AI Act which came into force on August 1, 2024 and is directly enforceable in Cyprus, provides that the AI Office and the Member States will encourage the drawing up of codes of conduct and related governance mechanisms. There are no specific guidelines including voluntary standards and ethical principle on artificial intelligence in Cyprus currently. However, the High-Level Expert Group on AI presented the Ethics guidelines for trustworthy AI (the "AI guidelines") in 2019 which among others provide that trustworthy AI should be, lawful, ethical, and robust, suggesting 7 key requirements that AI systems should follow in order to be deemed trustworthy. The AI guidelines also referred to existing Standards at the time, which could assist interested parties in establishing ethical conduct such as the ISO Standards or the IEEE P7000 standards series. Furthermore, the GDPR and guidelines issued by the European Data Protection Board regarding Artificial Intelligence should be also followed by interested parties. In the absence of any other specific code of conduct or legislation, existing common law principles may be applied to projects involving AI products and services.
4. Which rules apply to defective artificial intelligence systems, i.e. artificial intelligence systems that do not provide the safety that the public at large is entitled to expect?
On 28 September 2022, the European Commission published the proposal for a Directive on liability for defective products which was published in the EU's Official Journal on 18 November 2024 and entered into force on 9 December 2024. According to the Directive on liability for defective products all types of software are covered by the new directive, including applications, operating systems and AI systems. It should be noted that member states will have to transpose the directive into national law by December 2026.
5. Please describe any civil and criminal liability rules that may apply in case of damages caused by artificial intelligence systems. Have there been any court decisions or legislative developments clarifying liability frameworks applied to artificial intelligence?
AI is an ever-evolving field, characterised by uncertainty and unpredictability. As of now, Cyprus has not introduced a specific tortious liability regime covering the deployment and use of AI systems and the nature of harm they cause; therefore, the general provisions of civil and criminal liability apply. In Cyprus, potential avenues for liability concerning AI systems may involve contractual liability, the tort of negligence (where a duty of care exists between the parties and causation), and the product liability.
6. Who is responsible for any harm caused by an AI system? And how is the liability allocated between the developer, the deployer, the user and the victim?
In the absence of a dedicated framework to regulate AI liability, the allocation of liability is determined on a case-by-case basis and according to the civil and criminal rules, taking into consideration the facts of each case and the role and actions of the parties involved.
7. What burden of proof will have to be satisfied for the victim of the damage to obtain compensation?
As there is no statutory framework in place for determining claims in AI-related cases, the burden of proof will depend on causation, like in cases with general civil and criminal claims. It should be further noted that the directive on liability of defective products, is based on 2 main principles: (i) the manufacturer has to compensate the damage caused by a defective product of theirs (ii) the victim has to prove the product's defectiveness, the damage that was caused and establish that this defectiveness was the cause of the damage.
8. Is the use of artificial intelligence insured and/or insurable in your jurisdiction?
Currently, there is no specific insurance coverage tailored for the use of AI.
9. Can artificial intelligence be named an inventor in a patent application filed in your jurisdiction?
According to the Patent Law 16(I)/1998 which is the law governing patent protection in Cyprus, only a natural or legal person may register an application for a patent in Cyprus.
10. Do images generated by and/or with artificial intelligence benefit from copyright protection in your jurisdiction? If so, who is the authorship attributed to?
The relevant law protecting copyright in Cyprus is the The Intellectual Property Right and Related Rights Law of 1976 (the "Intellectual Property Law"). Copyrighted work includes among others scientific works, literary works, musical works, artistic works, photographs. The Intellectual Property Law defines that the producer of a work is a person and includes among others the author, composer, painter, designer, illustrator, sculptor, draftsman, engraver, computer programmer, and database builder;" According to the Intellectual Property Law copyright shall be conferred on every work eligible for copyright to a person who is a citizen of the Republic or has his habitual residence in the Republic of Cyprus, a legal entity, established under the Laws of the Republic of Cyprus or a national of a Member State of the European Union.
11. What are the main issues to consider when using artificial intelligence systems in the workplace? Have any new regulations been introduced regarding AI-driven hiring, performance assessment, or employee monitoring?
There are extensive benefits in using artificial intelligence systems in the workplace but there are challenges as well. Among others AI tools can improve employee skills, well-being and connectivity in the workplace. One of the first issues to be considered is the protection of personal data of employees and confidentiality regarding clients' matters, since AI systems use a great amount of personal data. Personal data processing should be made in accordance with the provisions of the GDPR. Cybersecurity is of paramount importance when it comes to using AI in the workplace. Companies should implement and adhere to all the necessary measures in order to protect their systems, networks and devices from cyber-attacks. Training regarding AI tools, should be provided to the employees so that they are able to understand the benefits and the risks of using AI systems.
12. What privacy issues arise from the development (including training) and use of artificial intelligence?
As many AI applications involve the processing of personal data to train machine learning systems, data protection has a special relationship with AI. The privacy issues that arise with regard to AI include among others compliance with the data protection principles, with the information provided to the data subjects prior to collection and processing of personal data and the security of the personal data. Oftentimes the processing of personal data through AI systems is not so clear especially due to the complexity of algorithms and processes used for training AI systems. Personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject in accordance with Article 5(1)(a) of the GDPR. Users will need to be informed in case personal data is being used and understand the way in which an AI system was designed to handle their personal data. In order to achieve this AI systems should provide the users with a set of clear information as specifically provided for in Articles 13 and 14 of the GDPR at the stage in which personal data are collected. It is likely that through the use of AI many decisions could be based solely on automated decision-making. Article 22 of the GDPR refers to automated decision-making, and specifically states that the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Furthermore, data subjects should always have the means to exercise their rights as provided for in Articles 12-23 of the GDPR. Specific issues might arise with the use of AI, particularly regarding the right to erasure (right to be forgotten), and erasure. As data are being transferred in various AI systems, issues of security of the data inevitably arise. For this reasons appropriate technical and organizational measures should be implemented by design and by default in accordance with the GDPR. In general, deployers of AI systems should ensure the lawfulness of the data processing, carry out data protection impact assessment when this is deemed necessary, inform the data subjects about the processing of their personal data and facilitate the exercise of data subjects' rights.
13. How is data scraping regulated in your jurisdiction from an IP, privacy and competition point of view? Are there any recent precedents addressing the legality of data scraping for AI training?
From a data protection perspective scraping is considered as processing when the data in question are considered personal data. GDPR makes it clear that personal data collection or any other processing shall be lawful only if it is based on the lawful grounds provided by the GDPR. Compliance with the principles relating to lawfulness of processing is one aspect of the process of ensuring respect for the protection of personal data. Various other principles need to be adhered to such as the need to inform the data subjects, and compliance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation and integrity and confidentiality. More specifically when the processing concerns special categories of personal data, the consent of the data subject is mandatory. From an IP perspective, scraping is also used more frequently with regards to the extraction of data from a website. These data constitute intellectual property which is protected by the Intellectual Property Law. According to this law only the holders of intellectual property rights have the exclusive right to reproduce their work in any way.
14. To what extent is the prohibition of data scraping in the terms of use of a website enforceable?
Existing legislation or national caselaw is not clear on whether scraping is banned in its entirety. Besides infringement of the GDPR when data is considered personal data, scraping might sometimes amount to contractual or intellectual property infringement. A good practice that can protect against scraping is to ensure that terms of use prohibit scraping of any kind entirely. Use of browsewrap or clickwrap agreements are one way for the user to be notified and agree to the terms of use of a website. The difference between the browsewrap and clickwrap agreements is that with the former the user consents to the website terms by continuing to use the website(this should be clearly stated in the Website terms of use) while with the latter the user needs to click or check a box which specifically states that he accepts the Website terms of use.
15. Have the privacy authorities of your jurisdiction issued guidelines on artificial intelligence?
Currently no specific guidelines were issued specifically on artificial intelligence from the office of the Commissioner for personal data protection (CPDP). The CPDP issued a guidance for complying with GDPR and guidelines and decisions regarding various matters concerning personal data since compliance with legal obligations arising from the General Data Protection Regulation (GDPR) is a precondition for AI systems to being allowed to enter the European market. Furthermore, the European Data Protection Board issued guidance regarding Artificial Intelligence among others the Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, and the AI Auditing project which aimed to help parties understand and assess data protection safeguards in the context of the AI ACT.
16. Have the privacy authorities of your jurisdiction discussed cases involving artificial intelligence? If yes, what are the key takeaways from these cases?
The CPDP did not discuss any artificial intelligence cases specifically to date. AI systems will inevitably have to comply with the GDPR and the principles relating to processing of personal data.
17. Have your national courts already managed cases involving artificial intelligence? If yes, what are the key takeaways from these cases?
No cases where managed specifically regarding artificial intelligence to date.
18. Does your country have a regulator or authority responsible for supervising the use and development of artificial intelligence?
The Communications Commissioner in Cyprus is designated as the Notifying Authority and as the Market Surveillance Authority, which acts as the Single point of contact for the AI Regulation. The Commissioner for Personal Data Protection in Cyprus is also designated as the Market Surveillance Authority for issues related to the areas of the application of her competence.
19. How would you define the use of artificial intelligence by businesses in your jurisdiction? Is it widespread or limited? Which sectors have seen the most rapid adoption of AI technologies?
No official statistics have been published up to date regarding the use of artificial intelligence by businesses. Thus, it is estimated that businesses in Cyprus have already started to implement solutions based on AI. For what is worth, Cyprus ranked 13th classified as "Strong Innovator" in the European Innovation Scoreboard 2024 report, and has an AI preparedness score of 0.63 in the IMF AI Preparedness Index 2023.
20. Is artificial intelligence being used in the legal sector, by lawyers and/or in-house counsels? If so, how? Are AI-driven legal tools widely adopted, and what are the main regulatory concerns surrounding them?
Despite the fact that there are no official data publicly available regarding the use of AI by lawyers in Cyprus, it is expected that lawyers have started to use AI in some ways as is the case with many other professionals. It is expected that AI will reshape the legal profession with the advent of new legal tools. Lawyers may already use AI today among other for the following:
- Translations
- Document review
- Research
- Document summaries
In general AI automates time-consuming tasks, allowing lawyers to focus on identifying potential risks earlier and focusing on relationships with their clients. AI has the ability to analyse vast amounts of documentation, improve the preparation of legal documents, enhancing productivity and efficiency allowing lawyers to deliver higher-quality legal services.
Use of AI in the legal profession should be made in compliance with local laws and regulation, the professional code of conduct, with respect to ethical considerations, and legal privilege-confidentiality.
21. What are the 5 key challenges and the 5 key opportunities raised by artificial intelligence for lawyers in your jurisdiction?
Tools that incorporate AI will have a great impact on the legal profession in general, but at the same time many different factors should be considered when using these tools. The opportunities that derive from the use of AI in the legal profession are numerous. Among others, AI and tools that incorporate AI have the ability to increase productivity and through the various AI tools that were developed within the last few years to contribute to the provision of efficient services, automate repetitive and time-consuming tasks, assist with document management and lead to innovative legal services. In addition to the opportunities introduced by these systems, there are also several challenges that should be addressed for the correct use of AI tools. For the correct use of AI in the legal profession lawyers would need to ensure that human rights, democracy and the rule of law are respected when using AI. Having in mind the processing of personal data the lack of transparency regarding functionality and training of the data used, adherence to the Professional code of conduct, the GDPR, other related regulations and ethics is of the utmost importance.
22. Where do you see the most significant legal developments in artificial intelligence in your jurisdiction in the next 12 months? Are there any ongoing initiatives that could reshape AI governance?
The publication of the National Strategy demonstrates the country's dedication to the development of responsible AI which safeguards human rights and social values in accordance with the law. Further to the publication of the AI Act, Cyprus will need to align the National strategy both with the AI Act and the various guidelines issued by the European Union. The AI Act which entered into force on August 1, 2024 presents a framework for responsible AI development, by fostering innovation and propelling Europe to the forefront of the industry. It is expected that in the near future we will start to see fast progress and advancements in education, healthcare, transportation and other critical sectors. It is further expected that various stakeholders will need to be informed and comply with the various codes of conduct, guidelines and related laws and regulations prior to utilising any Ai tools in addition to ensuring safety, transparency and non-discrimination standards.
Originally published by Legal 500 Guides.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
