Εθνική Στρατηγική για την Τεχνητή Νοημοσύνη (ΤΝ) της Κυπριακής Δημοκρατίας

Our full submission is available here: https://www.ai-3.org/blog/cyprus-national-ai-strategy-submission

The AI Integrity Institute (AI³) is a non-profit organisation working on AI governance. We connect research, industry, the public sector and civil society so that AI is developed and used responsibly and in ways that work in practice. Cyprus is the starting point for our international work.

We regard the draft Strategy as a serious and candid document. The comments below are intended to strengthen it rather than to redirect it.

We set out twenty-six comments. Each names the sections of the Strategy it affects, states what the draft currently says, sets out the change we recommend, and explains the reasoning. Fourteen of the twenty-six require no new institution and no significant new expenditure.

Comment 1
Affected sections: 1.1, 1.4.8, 2.5.7, 3.1.2, 3.4.3, 3.9.3 to 3.9.6, Annex A, Annex F

The Strategy already contains most of the substance of citizen rights. Section 3.9.6 embeds rights to explainability, contestation and human review in health, credit, employment and social benefits, and states that no system whose decisions significantly affect individuals should operate without human oversight.

Our observation concerns form rather than substance. Section 3.9.6 frames these as mandates on organisations. A mandate on an organisation and an entitlement of a person are not the same instrument. A mandate is discharged through compliance documentation and is visible to a regulator. An entitlement must be findable, intelligible and enforceable by the individual. There is no single statement of what a person may demand, no time limit attached to any commitment, and no named point of contact.

We propose a Citizen AI Charter, published as a short document in Greek and English within three months of adoption. It should state the right to be told AI is in use, to a meaningful explanation, to human review by a named body, to challenge a decision and obtain correction, to an alternative service route, and to know where to complain. Each right should carry a maximum response time and a responsible contact point. The Charter should distinguish rights that already exist in law from commitments made by the Strategy, and should describe the explanation right as Article 86 of the AI Act does.

Comment 2
Affected sections: 3.3.2, 3.4, 3.9.3, 3.9.6, Section 5 item 4, Annex B

The Strategy proposes three registration instruments. Section 3.9.6 mandates registration in the European database. Section 5 proposes a national application and certification registry, and separately a registry cataloguing AI solutions on the market. All three are compliance or market instruments. None is a national list of the systems that Cypriot public bodies use on the people they serve.

The European database does not meet this need. It covers high-risk systems only, it is populated by providers rather than by the deploying public bodies, and it is structured for conformity rather than public comprehension. A citizen asking whether AI shaped a decision about their benefits would not find the answer there.

We propose a single public register of AI systems used by ministries, public law bodies and local authorities. Scope it by risk, covering systems that are operational or approved and that materially affect rights, health, safety, eligibility or access to public services, together with pilots involving live personal data or direct public interaction. For each system publish the purpose, responsible body and contact point, supplier, data categories, risk classification and legal basis, human oversight arrangements, lifecycle stage, impact assessment summary, routes to challenge, and any serious incidents or withdrawals. Justified exceptions should apply for national security, cybersecurity and legitimate commercial confidentiality. Registration should be a condition of passing the control gates in Annex B.

Cyprus should adopt an existing international schema rather than design its own. The Netherlands, the United Kingdom, France, Norway and Scotland all operate national registers, and a group of European cities has developed a shared data schema.

Comment 3
Affected sections: 2.5.4, 3.1.1, 3.4.1, 3.4.3, Annex A, Annex C

The Strategy commits to human oversight of high-risk systems and refers to multilingual support and inclusive access tools. It does not commit that a citizen who cannot or does not wish to use an AI-mediated channel retains a route to the service.

We propose a commitment structured by the significance of the service. For essential public services, and for any service where an AI system makes or materially informs a decision affecting a person’s rights, eligibility, entitlements or effective access, the responsible body should guarantee timely access to human assistance, and where appropriate human review or an alternative route. The alternative should carry no additional charge and should not place the person at an unjustified disadvantage in timeliness or completeness. It may be delivered by digital, telephone or in-person channels, and need not require a wholly separate service infrastructure where AI performs only a back-office function.

Accessibility requirements under the European Accessibility Act should apply to AI-enabled interfaces from design stage rather than as remediation. AI-enabled citizen services should be tested with older users, users with disabilities and users with low digital confidence before deployment, with results published in summary.

Cyprus records 44.2 per cent generative AI use among people aged 16 to 74, but that figure conceals a wide spread by age and circumstance. A strategy that improves service for confident digital users while degrading it for everyone else will reduce trust even as it raises efficiency.

Comment 4
Affected sections: 2.5.6, 3.2, 3.5, 3.7, 3.8.6, Annex C

The Strategy refers to multilingual services in eighteen places. It does not name the Greek language anywhere in the document. It does not refer to Cypriot Greek, and it does not refer to Turkish, which is an official language of the Republic.

We propose that the language position be stated explicitly, supported by a national language resources programme with four components. First, assembly and open publication of Greek-language corpora and terminology resources for public administration, health, law and tourism, with clear licensing and in compliance with data protection, copyright and confidentiality rules. Second, creation of Greek-language evaluation datasets and benchmarks, including Cypriot Greek usage, so that procurement can distinguish a system that genuinely performs in Greek from one that is machine translated. Third, participation in European multilingual model initiatives rather than an attempt to build a national foundation model. Fourth, a stated commitment on the official languages of the Republic and on the practical language needs of residents and visitors.

This is where the citizen agenda and the sovereignty agenda meet. If public services run on models that perform poorly in Greek, the citizen experience degrades and the state depends on suppliers whose language performance it cannot verify. Evaluation infrastructure is a public good. Without it, the phrase “supports Greek” is a claim on a sales document that procurement has no means to test.

Comment 5
Affected sections: 2.5.4, 3.3.1, 3.4, 3.4.4, Annex C

The Strategy is written almost entirely for central government. Ministries carry the obligations, AI Officers sit inside ministries, and the Applied AI Strategy requirement is directed at ministries and public bodies. Local authorities appear only marginally.

We propose that local authorities be included explicitly in Section 3.4 and in the governance structure, through a proportionate route. A municipality cannot reasonably produce an Applied AI Strategy on the same terms as a ministry. We suggest three elements. First, a shared services model in which local authorities consume national capabilities such as the citizen assistant, document intelligence and translation rather than procuring their own. Second, a simplified adoption template and a single point of support within the National AI Authority. Third, representation of local government in the governance structure.

In most European countries local government is where public sector AI meets the citizen most often, in permits, waste, local planning, social support and local information. It is also where capacity is weakest. A strategy that assumes ministry-level capability throughout will produce a two-speed public sector, in which the services citizens use most often are the least well governed.

Comment 6
Affected sections: 3.3.1, 3.3.1.3, 3.3.1.5, 3.3.1.6, 3.11.3, 4.1.6

The Strategy places considerable weight on public trust, human-centred AI and ethics. The governance architecture provides no institutional role for civil society. Every proposed body is drawn from government, academia, research and industry.

We propose three measures. First, civil society representation on the National Ethics and Values Committee. Section 3.3.1.5 gives that Committee responsibility for ethical principles and public trust, which cannot be discharged credibly by a body composed entirely of state, academic and industry representatives. Second, representation on the National AI Taskforce. Section 3.3.1.5 provides that the Committee’s recommendations are submitted to the Taskforce, so representation at Committee level has limited effect unless the body receiving those recommendations also includes a civil society voice. Third, a standing Civil Society and Stakeholder Engagement Mechanism, comprising transparent open calls for representatives, periodic structured consultation, and a permanent channel for submissions during implementation.

Participation should attach to three fixed points: comment on the annual implementation report, consultation before deployment of high-impact citizen-facing systems, and an independent opinion before any substantial revision of the Strategy. Transparency and conflict of interest rules should apply, and participation should complement rather than displace accountable decision-making by the responsible public bodies.

This introduces no new objective. It gives effect to objectives the Strategy has already adopted. Multi-stakeholder models at European Union, Council of Europe and UNESCO level have involved civil society alongside academia, industry and public authorities.

Comment 7
Affected sections: 1.4.10, 2.3.3, 3.11.2, 3.12.1, Section 5, Annex A

The Strategy cites the AI Act as Regulation 2024/1689. It gives one compliance date, in the Section 5 table, asking for risk management, auditability and governance maturity ahead of 2 August 2026. That date has passed and the obligations behind it have changed. The Strategy makes no mention of Regulation (EU) 2026/1744, which amended the AI Act on 27 July 2026, six days before that deadline.

We propose three changes. Update the citation to read Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Replace the 2 August 2026 milestone with the dates that now apply. Add a short compliance calendar to Annex A.

Some obligations are already in force. The Article 5 prohibitions have applied since 2 February 2025, with new provisions added by the amending Regulation from 2 December 2026. General purpose AI model obligations have applied since 2 August 2025, with earlier models to comply by 2 August 2027. Article 50 transparency obligations have applied since 2 August 2026, with systems already on the market having until 2 December 2026 to mark synthetic content in machine readable form.

The remaining dates fall ahead. At least one national AI regulatory sandbox must be operational by 2 August 2027. Stand-alone high-risk systems under Annex III come into scope on 2 December 2027, and high-risk AI inside regulated products on 2 August 2028. High-risk systems already used by public authorities have until 2 August 2030.

The Strategy proposes a unified government knowledge assistant, a Citizen 2032 portal and multilingual ministry assistants. All are citizen-facing conversational systems already within Article 50.

Comment 8
Affected sections: 3.3.1 and Figure 2, 3.3.1.1, 3.3.1.5, 3.9.6, Annex A

The Strategy contains two institutional maps that do not reference each other. Section 3.3.1 and Figure 2 set out the governance structure. Annex A separately states that the Communications Commissioner and the Commissioner for Personal Data Protection are the competent authorities for the AI Act. Neither Commissioner appears in Figure 2 or in the Section 3.3.1 list.

This leaves several questions open. Section 3.3.1.1 proposes a National AI Authority acting as policy coordination body, execution body and governance and control gatekeeper, without stating how that relates to authorities holding statutory enforcement powers. Figure 2 describes the National Ethics and Values Committee as overseeing compliance with the EU AI Act, which is a function of the designated authorities rather than of an advisory committee. Section 3.9.6 refers to an annual audit by a Cyprus AI Security and Certification Authority, a body that appears nowhere else and is not defined.

We propose that the two maps be merged, with Annex A carrying a single institutional map and Figure 2 redrawn to show the designated authorities and their interface with the Strategy bodies. The Strategy should state clearly what the National AI Authority is and is not. The draft is currently inconsistent, since Section 3.3.1.1 says the Authority does not assume operational control while Section 5 assigns it standards, enablement, compliance oversight and platform operations. Enablement and platform functions should be separated from any compliance assessment role. Regulated entities should have a single point of contact, formal escalation arrangements and predictable decision timelines.

The same principle should apply within ministries. The person or team delivering an AI use case should not be the person or team performing its risk, ethics and compliance review.

Comment 9
Affected sections: 3.8.5, Section 5 item 2, Annex A

The Strategy refers to sandboxes in many places, including industry sandboxes, sectoral sandboxes and a maritime sandbox. No date, responsible authority or funding is attached, and the Article 57 obligation is not mentioned.

Article 57 of the AI Act requires each Member State to ensure that at least one AI regulatory sandbox is established at national level. The original deadline of 2 August 2026 was moved by Regulation (EU) 2026/1744, and the obligation now stands at 2 August 2027. The obligation may be met jointly with another Member State, or by participating in an existing sandbox providing equivalent national coverage.

We propose that the Strategy name the responsible authority, state the operating model, commit to an operational date within the deadline, and state whether Cyprus intends to meet the obligation alone or jointly. It should confirm the priority access for small and medium enterprises and start-ups required under Articles 58 and 62. Participation should remain voluntary and support testing and compliance readiness. It should not become a precertification mechanism or a prerequisite for procurement, deployment or market access.

Cyprus has a live legal deadline eleven months away with no named authority, no operating model and no date in its national strategy. A sandbox that is genuinely operational ahead of August 2027, well documented and open to foreign small and medium enterprises, would be a concrete demonstration of the trusted jurisdiction proposition.

Comment 10
Affected sections: 3.9, 3.3.2, 3.4.2, Annex B, Annex F

The Strategy requires mandatory legal, ethical and data protection assessments for high-impact systems and approval gates before procurement, deployment and scaling. It specifies no methodology, template, publication requirement or consultation requirement.

We propose a single national methodology for an integrated impact assessment covering fundamental rights, ethics, data protection and, where material, environmental and workforce effects. It should be required for high-risk systems and for any system materially affecting rights or access to public services, whether or not classified as high risk under the AI Act. It should be completed before Control Gate 2 in Annex B, with a non-confidential summary published in the public register, and repeated after substantial modification, material drift, a serious incident or a significant change of context. Proportionate consultation with affected groups and frontline professionals should apply where impact is material.

Three operational points matter. There should be one methodology rather than several, so a public body completes a single assessment. The assessment must attach to a gate in the delivery lifecycle, or it becomes documentation produced after decisions are already made. The template must be usable without specialist support, or small bodies and local authorities will not complete it. The assessment should be prepared by a person independent of the delivery team, or where the size of a body makes that impractical, reviewed independently before the gate.

The methodology governs the public sector’s own use of AI. It should not impose obligations on private organisations beyond Union and sectoral law.

Comment 11
Affected sections: 3.3.2, 3.9.5, 3.11.3, 3.13, Annex B, Annex F

The commitment to redress exists in four places. Section 1.1 refers to clear redress mechanisms. Section 3.9.6 commits to mechanisms for redress. Annex A describes an aspiration to establish a robust and accelerated legal mechanism. The control framework refers to procedures for incident reporting, escalation and remediation. None states to whom an incident is reported, how a citizen reports harm, what is published, or within what period.

We propose that the incident pathway be defined in operational terms. Establish a single reporting channel for citizens, public servants and suppliers. Define what constitutes a serious incident, aligned with Article 73 of the AI Act, so that a single report discharges both national and Union obligations where the law permits. State the internal reporting timeline and the escalation route. Publish an annual account of serious incidents, systems suspended or withdrawn, corrective actions and time to remediation, in aggregated and anonymised form that protects personal data, trade secrets and security-sensitive information. Include reversal and override rates, and the number and resolution time of requests for human review, in the measurement framework.

The Strategy should state explicitly that transparent incident reporting is treated as evidence of good governance rather than as failure. If reporting an incident is treated as an admission of fault, incidents will be resolved quietly and the national record will show a safety performance that does not exist.

Comment 12
Affected sections: 3.4.1, 2.5.8, 3.1.2, 3.3.2, 3.6.3, Annex B, Annex F

Section 3.4.1 states that the government will work towards AI-first procurement models by 2032. The control framework refers to approval gates and to approved and certified delivery partners. There are no standard contractual requirements.

We propose two changes. First, replace the AI-first framing with a problem-first framing, committing that procurement will assess whether AI is the appropriate solution to a defined problem and that AI-enabled options are evaluated on outcomes rather than on technology category. Section 3.1.2 already states that AI initiatives will be selected on measurable outcomes and not on technological novelty. The AI-first formulation states the opposite, and it appears twice, in Section 3.4.1 and in the description of the Government Innovation Hub.

Second, mandate a standard set of contractual requirements for AI procurement. These should cover technical documentation sufficient for oversight, rights of independent audit, ownership and deletion of data, portability of exportable data and digital assets in interoperable formats, substitutability of models and components where technically and legally feasible, avoidance of lock-in, open standards, documented accuracy and fitness for purpose, continuous monitoring of failure and bias, liability and remediation, tested exit, complete audit logs, publication of lifecycle cost, and environmental impact where material. Audit rights should be scoped to the oversight objective and should protect trade secrets, with recognised certifications accepted where they provide sufficient evidence.

We would add one point on lot sizing. Large tenders normally require minimum turnover and evidence of comparable prior contracts. Applied to national AI programmes that test is circular, because a company can only qualify by having already delivered a programme of similar scale, and Cyprus has never run one. Every domestic supplier is excluded before its capabilities are examined. Dividing flagship programmes into lots that a small domestic supplier can bid for requires no additional funding, no new institution and no legislation, only a decision taken when the tender is drafted.

Comment 13
Affected sections: 3.4.2, 3.5, Annex A, Annex C

The Strategy states that private-sector AI adoption is voluntary. Other provisions qualify that significantly. Section 3.4.2 provides that every sizeable organisation must formalise an AI adoption plan. Annex C provides that in regulated sectors institutional AI strategies become part of supervisory reporting with the same legal weight as risk-management frameworks, and that private enterprises dealing with critical and high-risk systems must share their AI strategy and acceptable use policy in order to obtain or renew participation in state-subsidised programmes, access to national compute or datasets, and new or renewed operating licences in strategic sectors. The terms sizeable organisation, critical and high-risk systems, strategic sectors and basic compliance are not defined.

We propose four changes. Preserve the voluntary character of private-sector adoption, and recast the requirement that every sizeable organisation formalise a plan as guidance. Remove the connection between disclosure of an enterprise AI strategy and the grant or renewal of operating licences. Do not give institutional AI strategies the same legal weight as risk-management frameworks by way of a strategy document, since supervisory reporting obligations should be established under Union and sectoral law within the mandate of the competent regulator. Where eligibility conditions attach to state-supported programmes, national compute or public datasets, they should be transparent, risk based, proportionate and non-discriminatory, requiring only the information necessary and accepting targeted attestations rather than a full institutional AI strategy.

A corporate AI strategy contains forward-looking commercial plans, technical architecture, security controls and supplier relationships. Conditioning market access on its disclosure, through a strategy document rather than legislation and with undefined triggering terms, creates legal uncertainty for every company operating in or considering Cyprus.

Comment 14
Affected sections: 3.5, Annex C

Section 3.5 and Annex C propose an AI Judge Capability for very basic, factually uncontested cases valued under five thousand euro, subject to legal constraints and human oversight. They also propose AIREG, a blockchain-based registry providing immutable certification of AI assets.

On the judicial provision, we propose replacing the term AI Judge Capability with AI-assisted judicial administration and decision support, and stating expressly that AI may support administration, research and analysis but does not determine case outcomes, issue judgments or exercise judicial authority. The competent judge should retain independent judgment, decisional authority, responsibility for the reasoning and accountability for the outcome. Any deployment should protect the right to a fair trial, procedural fairness, contestability and effective human oversight. Judicial and case-outcome uses fall within the high-risk categories of the AI Act.

On AIREG, we propose that its scope, legal effect and disclosure requirements be defined. Registration should be voluntary and evidentiary, supporting proof that a record existed at a point in time and has not been altered. It should not create or determine ownership, alter copyright or intellectual property rules, or be presented as establishing Union-wide presumptions, and it should not require disclosure of model weights, training data, source code or trade secrets.

Terminology carries commitments. A national strategy that announces an AI Judge, whatever the safeguards in the surrounding text, invites every reader to conclude that Cyprus intends machines to decide cases, and that impression will outlive the caveats.

Comment 15
Affected sections: 1.1, 2.4, 2.5.6, 2.5.8, 3.7.3, Annex G

Sovereignty is central to the Strategy and is used in at least three different senses across the document. Sometimes it means physical control of compute, sometimes legal and regulatory autonomy, sometimes the ability to decide independently while relying on partners for delivery. Sovereignty that is not defined cannot be planned, budgeted, procured or measured.

We propose a single operational definition across five layers, each with its own test, owner and indicator. Infrastructure sovereignty concerns where computation runs, under whose jurisdiction, and whether critical services continue if a supplier relationship ends. Data sovereignty concerns who decides access to national datasets, on what legal basis, with what auditability. Model sovereignty concerns the ability to choose, inspect, adapt, evaluate and replace the models on which public services depend. Application and assurance sovereignty concerns the ability to verify independently that a system performs as claimed. Talent sovereignty concerns whether the knowledge to specify, commission, operate and supervise these systems sits inside Cypriot institutions.

The definition should go into the glossary in Annex G, be used consistently, and be supported by a small number of indicators. The Strategy should state where Cyprus intends to be on each layer by 2032.

Three points keep the framework practical. Each layer is measured through verifiable outcomes and controls, and each can be satisfied while working with international partners. Inspection means access to information and evidence proportionate to the use case, sufficient to evaluate performance, limitations, safety, security and compliance. Talent sovereignty means the capability to specify, commission, evaluate and govern, which is where the existing education and skills provisions already do most of the work.

Comment 16
Affected sections: 3.7.1 to 3.7.5, 3.10.2, Annex F

Section 3.7.3 states that infrastructure choices should be guided by interoperability, portability, vendor diversity, supply chain resilience, security and long-term sustainability. This is the right list, expressed as guidance rather than requirement, and none of it is measured.

We propose that the guidance be converted into testable criteria applied at procurement and reviewed annually. First, legal and regulatory exposure, meaning the extent to which applicable legal regimes may compel access to data or affect service continuity, assessed for the relevant workload alongside the technical and contractual safeguards available. Second, key control, meaning who holds encryption keys and administrative access. Third, exit, meaning a documented and tested plan to move a workload to another provider within a stated period. Fourth, dependency, meaning a published register of critical dependencies across compute, models and platforms. Fifth, continuity, meaning what happens if a supplier relationship ends at short notice.

Two indicators should be added. One measuring material dependency on any single provider across compute, model and platform layers, regardless of nationality or place of establishment, assessed through workload criticality, substitutability, interoperability, tested exit and continuity. One measuring the share of critical public workloads subject to legal regimes permitting compelled access from outside the Union without effective safeguards. The first measures resilience, the second measures the exposure that motivates the sovereignty objective, and neither substitutes for the other.

We recommend that Cyprus adopt the European Commission’s Cloud Sovereignty Framework rather than design national criteria. It assesses providers against eight sovereignty objectives, assigns assurance levels, and was applied by the Commission in April 2026 to a sovereign cloud award. Adopting it gives Cyprus a tested methodology at no development cost and aligns national procurement with Union practice.

The risk in a hybrid model is not the partnership itself but the absence of an exit path. Sovereignty as reversibility is testable in a way that sovereignty as ownership is not.

Comment 17
Affected sections: 3.2, 2.5.6, Annex C, Annex D

The Strategy treats data modernisation and the National Data Policy as prerequisites for AI adoption, which is correct. It proposes a federated architecture, a national data layer and a national API fabric, and a National Health Data Repository. Annex C states that healthcare data and interoperability will follow HL7 FHIR, SNOMED CT and ICD, and will reflect European Health Data Space principles.

We propose three additions. First, state the sequencing explicitly and accept that digital maturity differs across public bodies, so that AI adoption is staged according to the readiness of each organisation rather than applied uniformly. Second, establish a formal data access framework, including data access committees with published decision criteria and published decisions, so that access to high-value national datasets is governed by a visible process rather than by negotiation. Third, convert the reference to European Health Data Space principles into an operational commitment, identifying the national bodies responsible for primary and secondary use of health data, stating how Cyprus will connect to the cross-border infrastructures, and setting a date. The semantic and technical standards named in Annex C should be carried into the main body of the Strategy, since they apply well beyond healthcare.

Data sovereignty is not achieved by holding data nationally. It is achieved by controlling, documenting and being able to justify decisions about access. A federated architecture without published access rules relocates discretion rather than governing it.

Comment 18
Affected sections: 2.5.8, 3.7, 3.8, 3.8.6, Annex D

The Strategy addresses compute, data, skills and governance. On models it says relatively little. The Government Innovation Hub is to guide developments for sovereign specialised learning models, and a legal language model trained on Cyprus law is proposed. There is no national position on which models the state will use, on what basis it will choose them, how it will evaluate them, or how it will change them. In the delivery lifecycle, model approach appears once, in Annex B Stage 2, with no criteria attached.

We propose a short model layer subsection covering five points. First, a model selection policy enabling choice among commercial, open weight and nationally adapted models on the functional requirements and risk profile of each use case, with criteria covering performance and accuracy including Greek-language performance, security, privacy, safety, transparency, legal compliance and licensing, interoperability, operational support, total cost of ownership, and substitutability. Second, a scoped weighting for open weight models in defined use categories where inspection, independent evaluation or long-term availability is material to the public interest, applied through the criteria of a specific procurement rather than as a general preference or a mandatory condition. Third, national evaluation capability, meaning the ability to test a model against Cypriot requirements. Fourth, adaptation rather than creation, meaning that Cyprus fine-tunes existing models and participates in European initiatives rather than financing a national foundation model. Fifth, portability, so that the underlying model can be replaced without rebuilding the service.

Model choice is where dependency is created and hardest to reverse. In agentic systems the lock-in accumulates in orchestration, tool integration and evaluation rather than in the model itself, so the Strategy should commit to open, vendor-neutral interoperability standards adopted from recognised international bodies.

Portugal released a national model for European Portuguese in July 2026 for an initial public investment of approximately five and a half million euro, built by extending an existing open European model rather than training from scratch. That is the cost envelope and the method a country of Cyprus’s size should plan against.

Comment 19
Affected sections: 2.5.1, 3.8, 4.3, Section 5 item 4, Annex C

The Strategy proposes a National AI Compliance Framework, a certification registry, an annual audit function and centres of excellence, and positions Cyprus as a compliance and testing hub. It does not describe the capability required to perform assurance, or identify who will be qualified to do it.

We propose an assurance capability plan with three elements. First, technical evaluation capacity, meaning people and facilities able to test AI systems for accuracy, robustness, bias, security and compliance, hosted in the research ecosystem and available to the public sector and industry. Second, an explicit assessment of whether Cyprus should host one or more notified bodies under the AI Act, and if so what accreditation and staffing that requires and by when. Third, deliberate development of AI assurance, audit, evaluation and compliance services as an export industry building on the existing professional services base.

Where the capability performs conformity assessment under the AI Act, it should operate within the applicable accreditation and notified body framework. It should not create additional national certification, registration or audit requirements, and it should not extend to the supervision of general purpose AI models as such, which is the role of the European AI Office. Voluntary evaluation and compliance support should complement the Union framework and should not become a prerequisite for procurement, deployment or market access.

This is the commercial opportunity best matched to what Cyprus already has. Assurance is also the layer at which sovereignty becomes economically productive. A country that can independently verify AI systems does not need to own them in order to trust them.

Comment 20
Affected sections: 1.5, 3.10.3, Section 5, Annex F

The Strategy is not silent on money. Section 3.10.3 states that funding may combine public investment, European co-funding through EuroHPC and Digital Europe, and structured cost-sharing. Section 3.3.1 states that budget allocations will be aligned with strategic performance goals agreed between the Ministry of Finance and the Deputy Ministry. The Sovereign Investment Matching Fund carries a stated cap of one million euro per round per company.

What is absent is scale and attribution. There is no total investment envelope, no figure attached to any of the four proposed funds, no capital or operating cost for the national compute infrastructure, and no budget or named delivery owner against any individual action. The funding sources are named in the conditional.

We propose a costed delivery plan for the period to 2032, published as a companion document and updated annually. For each major action it should state the responsible organisation, the delivery lead, the timetable and interim milestones, the expected deliverables, the estimated budget and funding source, the staffing requirement and the principal dependencies. Cost should be assessed across the full lifecycle rather than at procurement, including operation, maintenance, security, audit, data management, model monitoring, licensing, support, upgrade and decommissioning. The total public investment envelope and its expected sources should be stated.

Estonia, a country of comparable population with a stronger digital baseline, backed its AI and Data Action Plan for 2024 to 2026 with a stated package of approximately eighty-five million euro. A strategy that names no figure invites the assumption that no figure has been agreed.

Comment 21
Affected sections: 3.3.1 and Figure 2 and all subsections, 4.2, Section 5 items 1 and 3

The Strategy proposes a National AI Authority including a Government AI Accelerator, an Interministerial AI Council, a National AI Taskforce, a National AI Infrastructure Committee, a National Ethics and Values Committee, a National AI Misinformation and Security Council, a National AI Skills Observatory, a Government Innovation Hub, an Industrial Centre of Excellence, a National AI Cybersecurity Centre of Excellence, AI Officers in every ministry and AI Champions in every ministry. Additional bodies appear elsewhere.

Figure 2 is a useful diagram and it is not an accountability instrument. It shows which bodies exist and how they are grouped. It does not show, for any given decision, which body decides, which approves, which is consulted and which remains answerable for the outcome.

We propose two changes. First, publish a governance and accountability matrix identifying, for every function, which body sets policy, which approves, which delivers, which supervises and which is accountable, together with escalation and dispute resolution procedures. Second, consolidate. The monitoring and advisory functions currently distributed across four separate bodies could be delivered by fewer standing committees reporting through the National AI Taskforce, and the three centres of excellence could share a single governance and administrative structure while maintaining distinct technical missions. Where an existing institution can perform a function, the Strategy should say so rather than create a new body.

The objection is arithmetic. The proposed architecture requires a substantial number of senior, scarce and specialised people to staff committees, and the Strategy itself identifies limited execution capacity as one of the two structural weaknesses it must overcome. The risk is not that these bodies will conflict. It is that several will exist only on paper.

Comment 22
Affected sections: 3.10.1, 3.7, 3.4.1, Annex D, Annex F

Section 3.10.1 commits to green computing principles, renewable energy integration where feasible, efficient cooling and shared services. This is one short subsection with no measurement, no reporting obligation, no procurement weighting and no target.

We propose four changes. First, state that data centres supporting national AI infrastructure will report energy and water key performance indicators in line with Article 12 of the recast Energy Efficiency Directive and Commission Delegated Regulation (EU) 2024/1364, which apply to facilities with installed information technology power demand of at least 500 kilowatts and cover energy consumption, capacity utilisation, waste heat, renewable energy and both total and drinking water consumption. Second, publish national aggregate figures annually, reusing information already reported under Union and national mechanisms rather than creating a duplicative national channel, with aggregation that protects trade secrets and security-sensitive information. Third, include energy and water performance as weighted criteria in the procurement of AI infrastructure and services. Fourth, add environmental indicators covering energy intensity, water consumption, share of renewable supply and waste heat recovery.

This is a matter of national self-interest rather than general environmental preference. Cyprus operates an isolated electricity system with no interconnection to a continental grid, which makes additional large and inflexible loads more consequential than in most Member States. Cyprus also faces severe water stress, and the Strategy itself identifies water management as a research priority. Data centre cooling is water intensive.

The European Commission is developing a Union rating scheme for data centres with labels expected from 2027. Facilities that already measure and report will be able to demonstrate performance from the outset.

Comment 23
Affected sections: 1.5, 2.5.2, 3.4, 3.5, 3.11, Section 5 item 4, Annex C, Annex F

The Strategy has targets but very few milestones. A target is an endpoint. A milestone is a dated checkpoint with an owner and published evidence.

Quantified endpoints appear throughout Section 1.5 and Annex C, including a recommended productivity improvement of 15 per cent, a recommended GDP expansion of 12 per cent, more than three thousand AI professionals, a 40 per cent reduction in citizen waiting times, and sector figures for shipping and financial services. Almost all are dated 2030 or 2032 with nothing in between. Dated commitments appear in only one place, in Section 5.

The measurement framework is not yet operational. Annex F is described as a sample and as indicative. It lists categories of indicator rather than indicators, with no baseline value, no numerical target, no data source, no measurement method, no reporting frequency and no organisation named as responsible. The implementation timeline in Section 1.5 uses relative bands of 0 to 8 months, 6 to 12 months and 12 to 24 months, with no anchor date, followed by a band labelled 2026 to 2032 that overlaps them.

We propose six changes, of which the first three are the priority. Publish a milestone schedule with absolute dates rebased to the date of adoption, each milestone naming the responsible body and the evidence to be published. Complete Annex F, attaching to every principal indicator a baseline, a numerical target, a target date, a data source, a measurement method, a reporting frequency and a named responsible organisation, with baseline measurement completed within twelve months of adoption. Provide for one mandatory mid-point review in 2029, conducted by an independent external evaluator, published in full and accompanied by a corrective action plan where performance is behind trajectory. Reconcile the adoption targets to a single headline definition. Publish the assumptions behind the productivity and GDP projections or restate them as scenarios. Report annually to the House of Representatives with public debate.

On the arithmetic, the figures do not reconcile. The Strategy records enterprise AI adoption at 9.27 per cent in 2025 following annual progression of 17.3 per cent, and sets a target of 75 per cent industry adoption by 2030. Held at the rate the document itself observes, 9.27 per cent compounds to approximately 21 per cent by 2030. Reaching 75 per cent within five years requires sustained annual growth of roughly 52 per cent, about three times the observed rate. Extending the horizon to 2032 still requires roughly 35 per cent annual growth.

Comment 24
Affected sections: 2.3.4, 2.5.1, 3.12, Annex A

The Strategy positions Cyprus as a bridge between the European Union and neighbouring regions, refers to readiness to participate in the Global Partnership on AI, and aligns with the OECD principles. It does not refer to the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, and it does not describe what the bridge role means in practice.

We propose two additions. First, address the Framework Convention explicitly, stating Cyprus’s position and how the Convention relates to obligations arising under Union law. This matters because the Convention is the principal instrument through which non-Union states in the region engage with rights-based AI governance, and it is therefore directly relevant to a bridge role. Second, convert the bridge positioning into concrete commitments, for example a regional forum on AI governance hosted in Cyprus, cooperation programmes with Eastern Mediterranean and Middle Eastern partners on assurance and standards, and participation in international capacity building.

This is the area where Cyprus has the clearest comparative advantage and the least developed plan. Regulatory credibility is transferable in a way that compute capacity is not. If Cyprus becomes the place where regional actors learn how European AI governance works in practice, the bridge role generates both influence and revenue.

Comment 25
Affected sections: 3.6 (International alignment), 2.5.8, 3.12, Annex C

Section 3.12 adopts a broad and outward-looking approach to international engagement. The treatment of education and human capital is narrower. Under International alignment, the Strategy provides that the UK National AI Skills Framework will inform occupational pathways and competency structures, complemented by collaboration with Finland, France and Estonia on teacher training, AI literacy and ethics in education. The Strategy separately states that it references international best practices from Finland, France, Estonia, the UK and the UAE across education, governance, infrastructure and public-private collaboration. The criteria for selecting these jurisdictions are not stated, and it is unclear whether the list is illustrative or exhaustive. Section 1.7 describes a wider literature review covering the national strategies of Cyprus, Greece, Malta, France, Estonia, the UAE, Finland and the UK, so the evidence base is broader than the education provisions suggest.

We propose two changes. State the criteria on which international reference points for AI literacy have been selected, and state expressly whether the list is illustrative. Reframe the provision as open and non-exhaustive, so that Cyprus can draw on relevant expertise and good practice from a wider range of European and international jurisdictions as the field develops, including emerging and established technology ecosystems beyond Europe such as India, where these offer complementary expertise or opportunities for mutual capacity building. Alignment with Union law, values and standards should remain the governing constraint.

AI literacy is unusually broad and fast-moving, spanning technical competency, ethical awareness, responsible use, critical thinking, digital inclusion, workforce preparedness and general societal understanding. No group of four or five jurisdictions is likely to hold the best available practice across all of these, and the distribution will change over the life of the Strategy.

Comment 26
Affected sections: 3.3.1 and Figure 2, 3.3.1.4, 3.4.1, 3.9.6, 3.11.2, Annex A, Annex C, Annex F

The following are drafting matters rather than questions of policy. We raise them because they are inexpensive to correct and because a document of this standing will be read closely by suppliers, by other Member States and by the institutions of the Union.

– The body established under Section 3.3.1.4 is titled the National AI Infrastructure Committee in its own heading, and the National AI Infrastructure Council in the Section 3.3.1 list, in Figure 2 and again in Annex A.
– Figure 2 presents the Government AI Accelerator and the Innovation Hub as a single body. The text treats the Government AI Accelerator as a component of the National AI Authority and the Government Innovation Hub as a separate innovation body.
– In Figure 2 the description attached to the AI-Industrial Centre of Excellence is the tracking of talent, skills gaps and workforce readiness, which is the function of the AI Skills Observatory and is stated for that body in the tier above.
– The names given to the centres of excellence in Figure 2 do not match those used in the Section 3.3.1 list.
– The Cyprus AI Security and Certification Authority is referred to in Section 3.9.6 and nowhere else, and is not defined.
– Industry adoption targets appear at different values and against different dates in Section 5 and in Annex C, and government adoption targets appear at different values in Section 3.4 and in Annex C.
– The implementation timeline in Section 1.5 combines relative time bands with a calendar band beginning in 2026, which overlaps them.
– We propose that a single name be adopted for each body and used consistently in the headings, in the Section 3.3.1 list, in Figure 2 and in the annexes, that Figure 2 be redrawn so that it matches the text it illustrates and each body carries its own description, and that the numerical targets be reconciled.