What is AI regulation in Albania?
AI regulation: countries and regions
Albania has no dedicated, binding artificial intelligence law. As of June 2026, AI is governed indirectly through existing rules, chiefly Law No. 124/2024 on Personal Data Protection, which is fully aligned with the EU GDPR and supervised by the Commissioner for the Right to Information and Protection of Personal Data. A draft National AI Strategy 2025 to 2030 reached public consultation in 2025 but is not yet adopted. Albania is an EU candidate expected to align with the EU AI Act before accession.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Albania does not yet have a single statute that regulates AI as a technology. Instead, AI is caught by a patchwork of horizontal and sector laws: data protection, cybersecurity (Law No. 25/2024 on Cybersecurity), electronic governance (Law No. 43/2023 on Electronic Governance), public procurement and consumer rules. The most important of these is Law No. 124/2024 on Personal Data Protection, which mirrors the EU General Data Protection Regulation and applies whenever an AI system processes personal data.
On the policy side, Albania has an intersectoral Digital Agenda 2022 to 2026 and a draft National AI Strategy 2025 to 2030, which was introduced in August 2025 and opened for public consultation until 11 September 2025. As of this article, there is no public information confirming its formal adoption. The one binding instrument that addresses AI head-on is a Council of Ministers decision approving technical standards for AI use in the public sector.
Albania has also been an unusually aggressive early adopter of AI in government. It has used AI to help translate and align the EU acquis with national law, and it launched "Diella", a virtual assistant on the e-Albania public services platform that was controversially named a "Minister of State for Artificial Intelligence" in September 2025. These are deployments, not regulation: the legal framework has lagged behind the use cases.
Why it matters
Organisations deploying AI in Albania cannot point to a single AI rulebook. They must map their obligations across data protection, cybersecurity and sector-specific law, then keep watching as new policy lands. Because Law No. 124/2024 copies the GDPR closely, deployers that touch personal data face GDPR-grade duties (data protection impact assessments, transparency, safeguards on solely automated decisions) and GDPR-scale fines of up to 2 billion Albanian lek or 4 percent of global annual turnover, whichever is higher. The direction of travel is unambiguous: Albania is an EU candidate that opened all six negotiating clusters by November 2025 and aims to close talks by 2027, and the EU AI Act is the de facto reference model for any future national AI law. Forward-looking organisations should therefore build to EU standards now rather than wait for a domestic AI statute that does not yet exist.
How it works
No dedicated AI statute
There is no AI-specific law, bill or binding regulation in force in Albania. AI deployments fall under existing horizontal and sectoral legislation. The closest binding instrument touching AI directly is Council of Ministers Decision No. 479, dated 24 July 2024, which approved a methodology document and technical standards for the use of artificial intelligence in the Republic of Albania. Its core requirement is modest: there must be an interaction between humans and the AI system to correct results that might be incorrect or lead to negative impacts. Law No. 43/2023 on Electronic Governance references AI only in general terms, as a tool for innovating the digital economy.
Data protection as the main AI guardrail
Law No. 124/2024 on Personal Data Protection is the single most relevant instrument for AI. It was approved by the Assembly on 19 December 2024, promulgated by presidential decree on 15 January 2025, published in the Official Gazette No. 9 on 17 January 2025, and entered into force on 31 January 2025, repealing the old Law No. 9887 of 10 March 2008. Per the CMS Expert Guide on AI laws and regulations in Albania, the law fully replaces Law 9887/2008 and is harmonized with the GDPR and Directive 2016/680 (the Law Enforcement Directive). For AI, the key provisions are Article 20 ("The right not to be subject to automated decisions"), which gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (with exceptions for contract, authorising law, or explicit consent, and a guaranteed right to human intervention); mandatory data protection impact assessments for high-risk processing; and a regime under which the Commissioner can require prior authorisation for high-risk processing such as large-scale use of special-category data or automated decision-making and profiling.
The data protection authority
The supervisory authority is the Commissioner for the Right to Information and Protection of Personal Data (Komisioneri per te Drejten e Informimit dhe Mbrojtjen e te Dhenave Personale), commonly abbreviated IDP. It is an independent public authority, elected by Parliament for a seven-year term on a proposal from the Council of Ministers, and accountable to Parliament rather than the executive. Under Law No. 124/2024 its mandate now includes investigative and corrective powers: it inspects, investigates, issues guidance, orders suspension of processing and imposes administrative fines. Throughout 2025 the Commissioner issued operational guidance directly relevant to AI-adjacent processing, including Instruction No. 2 of 30 April 2025 on health and genetic data, Guidance No. 05/2025 of July 2025 on processing by law-enforcement and justice authorities (which addresses facial recognition and behavioural profiling), and Instruction No. 07 of 20 November 2025 on journalism and media. Enforcement has sharpened: after a quiet transitional year, the Commissioner moved to active enforcement in early 2026.
The digital agency and the Diella experiment
The National Agency for Information Society (AKSHI, also rendered NAIS) is the core digital-government body. It runs the e-Albania platform and led the development of the draft National AI Strategy. Diella was built by AKSHI's AI Laboratory in cooperation with Microsoft, fine-tuning an OpenAI GPT model delivered through Microsoft Azure. Launched in January 2025 as a virtual assistant, Diella was formally appointed "Minister of State for Artificial Intelligence" on 11 September 2025 and presented to Parliament on 18 September 2025, the first time an AI system has been named to a cabinet-level role. The only public legal document underpinning that role is a presidential decree granting the Prime Minister competence over the functioning of the virtual minister. Legal scholars and the opposition dispute whether a non-human can hold ministerial office; the debate over legality and accountability remains unresolved.
EU accession and Council of Europe context
Albania's AI trajectory is driven overwhelmingly by EU accession. The country opened cluster 1 (Fundamentals) in October 2024 and opened the final cluster 5 in November 2025, with the stated aim of closing negotiations by 2027 and joining by 2030. Alignment with the EU acquis, including the GDPR and the EU AI Act (Regulation (EU) 2024/1689), is the principal force shaping Albanian AI governance. Albania has not yet signed the Council of Europe Framework Convention on Artificial Intelligence (CETS No. 225), even though it is a Council of Europe member and a party to related instruments such as Convention 108 on data protection.
Examples
1. Automated credit scoring or profiling by a private firm. A bank or fintech using AI to score applicants processes personal data and triggers Article 20 of Law No. 124/2024 on solely automated decisions, plus the duty to run a data protection impact assessment and, where residual risk is high, to seek prior authorisation from the Commissioner. The deployer must give affected individuals a route to human intervention.
2. AI in public administration. A public body deploying an AI tool must follow the technical standards approved in Council of Ministers Decision No. 479/2024, which require human interaction to correct AI results, and must comply with data protection and cybersecurity (Law No. 25/2024) obligations. The Diella public-procurement role sits in this category and illustrates the gap between deployment and a settled legal basis.
3. AI for EU legal approximation. AKSHI launched a 2023 tender (reported at 2.6 million euros) for the "Use of Artificial Intelligence in the Process of Transposition of the Acquis for European Integration", and Prime Minister Edi Rama struck a deal with OpenAI, brokered through Albanian-born Mira Murati, to analyse the EU acquis. Albania reports processing more than 250,000 pages of legislation with AI assistance, with translation accuracy reported above 97 percent. This is a governance use case rather than a regulated product, and it shows AI being used to accelerate accession itself.
Common misunderstandings
1. "Albania has an AI law." It does not. As of June 2026 there is no dedicated, binding AI statute; AI is governed indirectly through data protection, cybersecurity and sector law.
2. "Appointing Diella as an AI minister means Albania regulates AI." Diella is a government deployment, not legislation. Its own legal basis (a presidential decree) is contested, and it does not create rules for AI generally.
3. "The EU AI Act already applies in Albania." It does not. Albania is an EU candidate, not a member state, so the AI Act is not binding domestically. It is the expected model for future alignment, not current law.
4. "Data protection is a separate issue from AI regulation." In Albania, data protection law is the main AI guardrail. Law No. 124/2024 supplies the closest thing to enforceable AI rules, including limits on solely automated decisions and profiling.
5. "There is no AI-specific rule at all." There is one narrow binding instrument: Council of Ministers Decision No. 479/2024, which sets technical standards for AI use in the public sector, though it is far from a comprehensive framework.
Risks and boundaries
This is an emerging, policy-led framework, not a mature regulatory regime. Several elements are pending or uncertain. The National AI Strategy 2025 to 2030 was only a draft at public consultation and there is no confirmed adoption date. Decision No. 479/2024 sets standards but is light on enforceable detail. Diella's status as a "minister" lacks a clear statutory basis and is challenged on constitutional grounds, including a reported civil claim by the actress whose likeness and voice were used. High-visibility surveillance deployments, such as the Smart City camera project with a foreign vendor, have drawn criticism for weak transparency and the absence of published risk assessments. Albania has not signed the Council of Europe Framework Convention on AI. Institutional capacity at the Commissioner's office is a recognised constraint, and secondary legislation under Law No. 124/2024 was still being rolled out through 2025 and 2026. None of the existing instruments regulate AI as a technology in the comprehensive, risk-tiered way the EU AI Act does; readers should treat Albanian "AI regulation" as a composite of adjacent laws plus aspirational strategy, with the binding teeth sitting almost entirely in data protection law.
What to do next
Treat Law No. 124/2024 as the operative baseline for any AI that processes personal data: map your processing, run data protection impact assessments for high-risk and automated decision-making use cases, and build in human review consistent with Article 20. Engage early with the Commissioner where prior authorisation may be required, and watch its 2025 and 2026 guidance, which signals enforcement priorities. For public-sector and procurement projects, align with the technical standards in Council of Ministers Decision No. 479/2024 and document human oversight. Strategically, build to EU AI Act standards now: classify systems by risk, prepare technical documentation and consider fundamental-rights impact assessments, because alignment will be expected as Albania moves toward accession. Track two triggers that should change your posture: formal adoption of the National AI Strategy 2025 to 2030, and any move by Albania to sign the Council of Europe Framework Convention on AI or to transpose AI Act provisions. Either would shift AI governance from soft policy toward hard obligations.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does Albania have a dedicated AI law?
No. As of June 2026 there is no standalone, binding artificial intelligence law in Albania. AI is governed indirectly through existing data protection, cybersecurity, electronic governance and sector legislation.
Which law most affects AI in Albania?
Law No. 124/2024 on Personal Data Protection, which is fully aligned with the EU GDPR and applies whenever an AI system processes personal data, including provisions on automated decisions and profiling and mandatory impact assessments.
Who is the AI-relevant regulator?
The Commissioner for the Right to Information and Protection of Personal Data (IDP), an independent authority that investigates, inspects, issues guidance and imposes fines. It is the most relevant regulator for AI because of the data protection regime.
Is there a national AI strategy?
There is a draft National AI Strategy 2025 to 2030, introduced in August 2025 and open for public consultation until 11 September 2025. There is no confirmed information that it has been formally adopted.
What is Diella?
Diella is an AI virtual assistant on the e-Albania platform, built by AKSHI with Microsoft. In September 2025 it was named "Minister of State for Artificial Intelligence" for public procurement, a move whose legal basis is disputed.
Does the EU AI Act apply in Albania?
Not yet. Albania is an EU candidate, not a member, so the AI Act is not binding domestically. It is the expected reference model for future alignment before accession.
Is there any binding AI-specific rule?
One narrow instrument, Council of Ministers Decision No. 479/2024, sets a methodology and technical standards for AI use in the public sector, requiring human correction of AI results.
How does Albania compare with Serbia?
Serbia is further along on policy: it adopted an AI development strategy for 2020 to 2025, a successor strategy for 2025 to 2030, and non-binding Ethical Guidelines in 2023. Like Albania, Serbia has no binding standalone AI law yet, but its strategy and institutional architecture are more developed.