The Digital Transformation & Fintech Committee of the American Chamber of Commerce in Cyprus (AmCham Cyprus) welcomes the publication of the Cyprus National AI Strategy 2032 and commends the Chief Scientist, the National AI Taskforce, the Deputy Ministry of Research, Innovation and Digital Policy, and all contributing stakeholders for developing a comprehensive and ambitious framework for the future of Artificial Intelligence in Cyprus.
The Strategy reflects a clear vision to position Cyprus as a trusted AI hub in the Eastern Mediterranean, a reliable European jurisdiction for AI-enabled services, and a bridge between Europe and neighboring markets. Its focus on innovation, productivity, public sector transformation, skills development, data governance, cybersecurity, ethics, and international cooperation provides a strong foundation for the country’s digital future.
The Committee is fully supportive of the Strategy’s overarching objectives and recognizes the significant effort invested in creating a forward-looking roadmap that aligns with European values, regulatory frameworks, and the opportunities presented by emerging AI technologies. We particularly welcome the emphasis on trustworthy, human-centered AI, the commitment to strengthening Cyprus’s competitiveness, and the aspiration to create an ecosystem that fosters innovation, investment, entrepreneurship and talent development.
At the same time, the successful implementation of the Strategy will depend not only on vision but also on execution. The Committee therefore offers the following recommendations in a constructive spirit, with the objective of strengthening the Strategy’s practicality, investment attractiveness, governance effectiveness, cybersecurity resilience, and ability to deliver measurable economic and societal outcomes.
These recommendations reflect common themes and areas of consensus that emerged during the Committee’s discussion and from stakeholder feedback received from businesses, technology providers, professional services organizations and industry experts. We submit these observations with the shared objective of helping Cyprus establish itself as a leading trusted AI Nation, capable of combining strong governance and regulatory certainty with openness, innovation, international collaboration, and sustainable economic growth:
- Create a National AI Delivery Office
The successful implementation of the Strategy will require dedicated execution capacity, not only governance and advisory structures. The Committee recommends establishing a compact, empowered and appropriately resourced National AI Delivery Office responsible for coordinating the national implementation portfolio. The Delivery Office should bring together program management, enterprise architecture, data governance, cybersecurity, procurement, legal and regulatory expertise, change management and benefits realization.
It should support ministries and public bodies, coordinate dependencies, maintain visibility across publicly funded AI initiatives, and prevent fragmented or duplicative investments. Its role should be clearly distinguished from that of the authorities responsible for regulatory supervision, market surveillance, data protection, and sector-specific enforcement.
Ministries and public bodies should retain accountability for their respective services and outcomes, while the Delivery Office provides central coordination, common implementation standards, and practical delivery support.
- Add a Funded Delivery Roadmap
The Committee recommends complementing the Strategy with a funded, three-year rolling delivery roadmap that translates its ambitions into an executable national program. For every major initiative, the roadmap should define:
- The accountable owner and participating organizations.
- The approved budget and funding source.
- The delivery timeline and key milestones.
- The procurement and implementation route.
- Dependencies on data, infrastructure, skills or legislation.
- Expected economic, operational or societal benefits.
- Measurable performance indicators.
- Risk, review and exit criteria.
- Arrangements for periodic public reporting. The roadmap should reconcile the different adoption targets and implementation dates contained in the Strategy, establish realistic sequencing, and distinguish between immediate priorities, medium-term initiatives and longer-term ambitions. No significant initiative should enter the national AI portfolio without a defined owner, budget, delivery date, and measurable outcome.
- Strengthen the Data Implementation Layer
The Committee considers data readiness to be the most important prerequisite for scaling AI responsibly. The Strategy should therefore strengthen its practical data implementation layer and ensure that data governance progresses before, or in parallel with major technology procurement. The Committee recommends:
- Assigning an accountable data owner and data steward for every priority public sector dataset.
- Establishing minimum standards for data quality, classification, metadata, lineage, retention and lawful use.
- Creating a national catalogue of high-value datasets that identifies ownership, availability, access conditions and permitted uses.
- Prioritising secure APIs, common data standards and interoperability over point to-point integrations.
- Requiring a formal data-readiness assessment before approving or funding a significant AI project. • Developing governed sectoral data spaces and secure testing environments that permit controlled use without unnecessary copying or centralisation.
- Defining clear rules for confidentiality, intellectual property, anonymisation, pseudonymisation, audit rights and derived data or model outputs.
- Clarifying lawful cross-border data access and transfer arrangements under applicable European legislation. This implementation layer should be closely aligned with the National Data Policy and the National Data Governance Framework to avoid parallel or inconsistent structures.
- Prioritise a Limited First Wave
The Strategy contains a broad portfolio of sectors, institutions, platforms, funds, centers, sandboxes, and transformational projects. While these ambitions are strategically valuable, attempting to launch too many initiatives simultaneously risks spreading limited funding, leadership attention and specialist expertise too thinly.
The Committee recommends selecting a limited first wave of national AI missions based on economic and public value, data readiness, implementation, feasibility, scalability, cybersecurity risk and the potential to create reusable capabilities.
The initial portfolio could concentrate on:
- AI-enabled government and citizen services, particularly high-volume services with repetitive processing, significant document requirements or long response times.
- AI for regulated financial, fintech and professional services, including AML/KYC, compliance, regulatory reporting, audit support and administrative efficiency.
- AI for healthcare administration and care navigation, implemented with strong data protection, clinical accountability and human oversight.
Other strategic sectors should continue through research, preparation, and controlled experimentation, but the first major funding and implementation cycle should be concentrated on a manageable number of missions. Each first-wave mission should begin with a validated problem, confirmed data readiness, an accountable owner, a funded business case, and measurable success criteria.
- Make Cybersecurity and Resilience a Foundational Requirement
Cybersecurity should be embedded horizontally across the entire AI lifecycle, from data preparation and system design through procurement, deployment, monitoring, material modification, and decommissioning. Every publicly funded, critical or high-impact AI system should pass a proportionate AI Security and Resilience Assessment before entering production.
The assessment should address:
- Data protection and information classification.
- Identity, privileged access and machine identities.
- APIs, AI agents and system integrations.
- Models, training data and AI supply chains.
- Third-party and supplier risk.
- Data poisoning, adversarial manipulation and prompt-based attacks. • Secure logging, monitoring and auditability.
- Model performance, drift and misuse detection.
- Human intervention, override and rollback.
- Incident reporting and coordinated response.
- Business continuity, portability and secure exit arrangements. High-impact and critical systems should be subject to independent assurance where appropriate. AI-related incidents should also be integrated into existing national cybersecurity, data-protection, and sector-specific incident-management structures.
- Support SME Adoption
SMEs are central to the Cypriot economy but often lack the specialist expertise, financial capacity and infrastructure required to adopt AI responsibly. The Strategy should therefore include a practical, accessible and proportionate SME AI Adoption Program.
The program should provide:
- AI readiness and data-readiness assessments.
- Implementation and advisory vouchers.
- Standard AI policies and governance templates.
- Risk-classification and impact-assessment tools.
- Vendor-assessment questionnaires and procurement guidance.
- Cybersecurity and compliance support.
- Affordable access to compute, testbeds and sector sandboxes.
- Access to recognised advisers and implementation partners.
- Guidance on intellectual property, data use and contractual protections.
- Market-access and export support for validated AI solutions. Requirements should be proportionate to organizational size, use-case risk and potential impact. Low-risk productivity tools should not be subject to the same burden as high-risk or rights-impacting systems. Public support should be released progressively and linked to measurable results, such as productivity improvement, reduced administrative costs, improved service quality, new revenue, export potential or successful progression from pilot to responsible production use.
- Develop Role-Based Skills and Professional Capability
AI skills policy should extend beyond technical specialists. The Committee recommends role-based education and professional-development pathways for:
- Executives and board members.
- Public servants and policymakers.
- Accountants, auditors and finance professionals.
- Legal and compliance professionals.
- Procurement and commercial teams.
- Data owners and data stewards.
- Cybersecurity and risk professionals.
- Educators and trainers.
- Regulators and assurance professionals.
- SME leaders and frontline personnel. Training should combine AI literacy with governance, cybersecurity, data protection, responsible use, procurement, change leadership and practical sector applications. Programs should be aligned with labor-market needs, recognized for continuing professional development frameworks, and applied workplace projects.
Cyprus should also build local AI governance, cybersecurity, implementation, testing and assurance capabilities that can support domestic adoption and develop into exportable professional services.
- Measure Outcomes, Not Activities
The Strategy’s measurement framework should prioritize economic, operational, citizen and societal outcomes. Each national KPI should have a clearly defined baseline, calculation methodology, accountable owner, data source, reporting frequency, and target trajectory. Priority measures should include:
- Productivity improvements.
- Reductions in service-processing times.
- Reductions in administrative cost and backlog.
- Improvements in citizen and customer experience. • SME adoption and progression to production.
- Investment attraction and business expansion.
- Creation of high-skilled employment.
- Workforce reskilling and transition outcomes.
- Growth in AI-enabled products and exportable services.
- System reliability, cybersecurity and compliance.
- Public trust and responsible-use indicators.
The number of pilots, committees, systems purchased, individuals trained or events organized may provide useful supporting information but should not be treated as the principal evidence of success. Underperforming initiatives should be redesigned or discontinued, while successful and reusable capabilities should be scaled across ministries and sectors.
- Preserve Openness, Investment and Trusted International Partnerships
Cyprus’s ambition to develop strategic AI capability should be pursued through openness, interoperability and trusted international cooperation. The Committee recommends defining AI sovereignty and strategic autonomy in terms of effective governance, security, resilience, legal control, portability and strategic choice, rather than domestic ownership, supplier nationality or blanket data localization.
Cyprus should retain meaningful control over critical data, services and operational decisions while leveraging trusted European, United States and other international partners to obtain the technology, compute capacity, expertise, investment and access to global markets required to achieve scale. International partnerships should be assessed using objective criteria, including security, transparency, legal enforceability, supply-chain assurance, operational continuity, and alignment with European law and values.
The Committee recommends:
- Ensuring that public procurement, infrastructure access, funding programmes and testing environments apply transparent, proportionate and technology neutral criteria.
- Avoiding origin-based preferences or localisation requirements unless objectively justified by applicable law, national security, data sensitivity or demonstrated operational risk.
- Supporting lawful cross-border data access and transfers under applicable European data-protection legislation.
- Protecting pre-existing intellectual property, confidential business information, trade secrets and cybersecurity-sensitive technical evidence.
- Defining clear rights for public-sector data, supplier data, project-created intellectual property, derived outputs and model improvements.
- Requiring interoperability, data portability, supplier-transition arrangements and tested exit plans to reduce concentration and vendor lock-in. •
Recognising equivalent international standards, technical evidence and assurance practices were permitted by European law.
- Creating clear and coordinated pathways for trusted international investors, technology providers, research institutions and implementation partners to establish, test, develop and scale AI-enabled services from Cyprus.
- Strengthening structured cooperation between Cyprus, the European Union, the United States and other trusted jurisdictions in areas such as research, skills, cybersecurity, standards, testing, investment and responsible AI deployment. Strategic autonomy should provide Cyprus with control, resilience and choice without limiting access to global innovation.
A clear and investment-compatible approach will strengthen Cyprus’s position as a trusted European jurisdiction, attract international capital and expertise, support domestic companies and researchers, and enable AI solutions developed or validated in Cyprus to scale into European and neighboring markets.
This directly addresses the attached AmCham position paper’s concerns around sovereignty, localization, procurement, cross-border data flows and intellectual property protection. The Committee values the opportunity to contribute to this important national dialogue and stands ready to support the next phase through continued cooperation among government, industry, academia, professional bodies and civil society.