Cyprus National AI Strategy 2032 · Legal Services

The Strategy is ambitious and its direction is right. What remains is the layer between a national programme and a changed working week inside a partnership.

By Philippos Aristotelous · 8 min read

Cyprus now has a National AI Strategy running to 2032, and it is a more serious document than the genre usually produces. It names “AI theatre” as a national risk. It insists on measurable value rather than technological novelty. It builds control gates into its own portfolio so initiatives have to earn their place. And it says plainly that technology should augment rather than replace professional judgement. Those four ideas are close to the whole difference between a programme that changes how organisations work and one that produces reports.

The Strategy drew responses from across the Cyprus AI and digital ecosystem, most concerned with national governance architecture. This piece is about something narrower: the Legal Services pillar, and what it will take for it to land inside actual law firms.

That pillar deserves the attention. It proposes support for SME adoption through a two-step pathway — NAICF Comply for baseline governance, then AdoptNAICF for implementation — and promotes the responsible use of robotic process automation, generative AI and agentic AI in legal workflows. It proposes a language model capability trained to handle Cyprus case law, under governance and transparency controls; AI-generated transcription for court hearings and judgments; and a LegalTech Sandbox where startups can validate tools under the competent authority’s supervision. And it proposes what it calls an AI judge capability for very basic, low-value, factually uncontested cases under €5,000, with strict constraints and human oversight, to reduce delays.

That last one will attract the headlines, so it is worth using the Strategy’s own framing rather than the version that will circulate. This is not a machine deciding contested disputes. It is AI-supported handling of the smallest and simplest claims, where the facts are not in dispute, tightly constrained, with human oversight retained.

Demetris Skourides and his team deserve credit for a document of this ambition, and for the openness with which they have invited practical input from the professions. I support the direction; my suggestions concern implementation. Where I describe what the Strategy says, I say so — everything I recommend is mine, and forms no part of it. My perspective comes from about twenty years in the profession, including as senior partner and head of tax at one of the larger Cyprus firms, and from advising firms since on strategy, management and organisational change.

SUGGESTION ONETest readiness before funding technology

Annex B sets out how a government AI initiative enters the national portfolio, and Control Gate 1 is where it is tested. The third of its three tests is the mature one, and most public programmes do not have it. My suggestion is that a proportionate version should apply to the private-sector pathway too. AdoptNAICF does not expressly carry it.

Consider what its absence looks like inside a firm. A twenty-lawyer practice buys Claude, Gemini or Microsoft Copilot, or a dedicated legal AI product, and a year later very little has changed — not because the technology failed. Nobody was given implementation as a job, with protected time and real authority. The workflows were never mapped, so nobody can say which step the tool was meant to remove. The rules on client information were never written, so the cautious use nothing and the confident use everything. Different people settled on different tools, invisibly to the partners. Supervision was never defined, training went no further than a demonstration, and nothing was measured. Where the tool did get used, it made an inefficient process faster rather than a better process possible.

Established partnerships are especially exposed, because most have no chief operating officer, no technology function, and nobody with both the time and the authority to lead a change of this kind.

A firm that cannot name the workflow, the owner, the baseline and the intended outcome is not ready to buy a solution, and public money spent at that moment buys speed for a process nobody has examined. The practical version is a sequence rather than a gate. Where a firm is not ready, offer limited readiness assistance first — enough to map one process, name an owner, set a baseline. Then fund a defined pilot. Then release further support once there is evidence worth expanding. Pilot before scale, evidence before expansion.

SUGGESTION TWOGive firms a governance baseline they can use on Monday morning

The Strategy recommends a National AI Compliance Framework aligned with the EU AI Act, drawing on ISO 42001 and AIGP, defining standardised compliance protocols for developers and deployers operating in or through Cyprus. On top of it sit two steps: NAICF Comply, a one-time incentive to establish baseline governance, and AdoptNAICF, led by the Ministry of Energy, Commerce and Industry, supporting SME implementation across concrete use cases — document processing, e-discovery, legal research, billing, compliance and risk management, and conversational AI. Govern first, then implement. That is the right order, and not the one most organisations follow on their own.

The implementation question is what proportionate governance means inside a firm of ten, twenty or thirty lawyers. Very few will build an AI governance function, and it would be a poor use of their money if they tried. But the question cannot be deferred, and the reason is in the Strategy’s own figures.

In professional services a gap that size is not untapped demand. It is use that is already happening — on personal accounts, outside any firm rule, invisible to the people who carry professional responsibility for the work. So governance is not what comes before adoption. In most firms it is what brings adoption that has already happened under some kind of control.

Such a firm does not need a department. It needs short, clear answers to about ten questions.

My suggestion is a short model circular published for the sector: an accountable owner, approved firm-controlled platforms, permitted and prohibited data and uses, human verification, client communication where appropriate, record-keeping and incident escalation. Not a compliance manual — a document a managing partner could adapt in an afternoon and circulate the same week.

One point sits underneath all of it. Under Cyprus professional conduct, responsibility does not move because a machine helped produce the work. Whatever the tool did, the advocate answers for the advice.

SUGGESTION THREEAddress the economics, not just the productivity

This is the part of the conversation about legal AI that goes missing most often, so I want to give it more room.

The pillar’s objective is to improve the client and citizen experience and increase sector productivity. That is the right ambition. But productivity measures output per hour, and on its own it converts into neither profitability nor client value. Take the simplest case. A task that used to take eight hours now takes four.

Who captures the four hours?

Under hourly billing, at first, nobody captures them. Recorded time falls, the invoice falls with it, and the firm still carries the subscriptions, usage charges, integration, training and the extra supervision machine-assisted work requires — so the lawyer who adopts most successfully is the one whose numbers fall first. Under a fixed fee the firm keeps the four hours, but only if the scope holds, and scope is under pressure from an unfamiliar direction: clients increasingly send long AI-generated drafts and mark-ups that somebody has to read, check and reconcile, so the review work grows while the fee does not. Under value pricing the four hours can genuinely be shared, but only in a firm that can say what the client is buying in terms other than time, and price it before the work starts.

Then the question that decides all of it: what happens to the freed capacity? Redeployed into work the firm was turning away, or into parts of a matter that were being done thinly, the gain is real. Left alone, it fills with the same work done more slowly, and nothing has happened.

None of this is an argument for charging the same fee for less work. That is a poor bargain for the client and, before long, an unsustainable one for the firm. AI creates value on both sides of the relationship — a faster answer, a more thorough review, a better-scoped matter, a lower cost of production — and the management task is to capture and share that value fairly.

Which is why the leadership-facing part of any legal upskilling pathway should carry the commercial mechanics alongside the technical ones: matter costing, scoping, capacity conversion, profit-per-matter analysis, how to treat client-generated AI material, and alternative pricing. That builds management capability without involving the State in professional fees — a distinction I think matters and would want preserved.

SUGGESTION FOURMeasure changed work, and protect professional formation

There is a version of success in which everything is achieved and nothing changes. Licences purchased. People trained. Policies written. Each is real, each can be reported, and none tells you whether a single matter is being run differently or whether a single client has noticed anything. The Strategy is alert to this at national level — naming AI theatre as a risk is exactly that instinct — and the same instinct should shape what supported firms are asked to show. A reasonable window is 90 to 180 days after deployment: long enough for the novelty to wear off and the honest answer to emerge.

A firm that cannot answer the sustained-use question has not adopted anything. It has bought something.

The second half of this suggestion has a longer horizon and matters at least as much. Think about how a lawyer acquires judgement in the first four or five years: doing the research and discovering the obvious answer was wrong, producing a first draft and getting it back covered in corrections, reviewing documents until the anomalous one stands out, comparing authorities that appear to agree and working out why they do not, sitting in on a negotiation, meeting a client who is frightened, standing in court. Now set that against the use cases the pillar names — document processing, e-discovery, legal research, drafting support. The overlap is close to complete.

I am not arguing that AI should be kept away from junior-level work. It will do that work, often well, and firms refusing on principle will simply be more expensive. The argument is different. If the apprenticeship layer is removed, a firm cannot assume the judgement it used to produce will appear anyway. Prompting skill is useful, but it is not judgement and it is not a route to it.

So formation has to be redesigned deliberately: asking a junior to spot the issues independently before consulting any system, then comparing the two; requiring them to explain to a supervisor why an AI answer is right or wrong, and on what authority; supervised explanation rather than only supervised correction; and protecting the client contact, negotiation exposure and court time that no system produces. My suggestion is that supported firms be asked to describe their junior-development method. Not a policy. A method.

SUGGESTION FIVEBuild legal-sector safeguards into the ambitious parts

The boldest proposals in the pillar are the ones I most want to see succeed, and they need the most sector-specific implementation work.

Take the Cyprus case-law language model capability first — potentially the single most valuable thing here. The design question is the corpus. Legislation and reported judgments are public and comparatively straightforward. But a model genuinely useful in a legal office needs more than reported judgments. It needs pleadings, opinions, precedents, the working material of practice, and all of that is privileged or confidential. The words privilege, confidentiality and Bar Association do not appear anywhere in the Strategy. At strategy stage that is unremarkable. It is a very large thing to leave unresolved until after the first firm has been asked to contribute material.

Then the questions that follow from it: where each source came from and whether that provenance travels with the answer; whether superseded law has been removed; what happens when the system produces a plausible citation that does not exist; and whether the Greek and English coverage are of equal quality, which in a bilingual jurisdiction is a question about fairness and not only performance.

Court transcription and the under-€5,000 capability raise a related set: procedural fairness, an accessible route to review and appeal, and human judicial responsibility that is real rather than nominal. Even the smallest claim matters a great deal to the person bringing it. And “AI judge” is a label that will do more work in public than the Strategy intends.

My recommendation — and this is my recommendation, not something the Strategy provides for — is a small implementation and safeguards group for the legal initiatives: the Cyprus Bar Association, the judiciary, practising lawyers, someone who actually manages a firm, data-protection expertise and technical expertise. Small enough to work. Its first tasks would be to begin from verified public sources, to validate bilingual coverage and citation accuracy before launch rather than after, and to confine any court pilot to genuinely suitable low-value matters, with human judicial responsibility and an accessible route to review.

THE LARGER OPPORTUNITYCyprus as a producer, not only a consumer

One of the more interesting ambitions in the Strategy is that Cyprus should not merely consume AI but develop capabilities and services around it. Applied to legal services that is a real commercial opportunity: there will be substantial demand for advice on AI governance, AI-related contracts, regulatory compliance, assurance, accountability, data and AI risk, and cross-border implementation. Cyprus firms are well placed — an EU jurisdiction, an English-language common-law tradition, an established international client base.

But the sequence matters. A firm cannot credibly advise a client on governing AI if it has not governed AI in its own practice. The credibility comes from having done it: from having made the decisions, written the rules, trained the people, handled the first incident and lived with what followed.

That is a far stronger proposition than selling AI advice from the outside, and one a Cyprus firm can actually build. Internal adoption is the immediate priority; the export comes out of it.

IN CLOSINGAmbition, held loosely

Cyprus is right to be ambitious here. The honest difficulty is that nobody knows what this technology will look like in 2032, and an implementation built on fixed assumptions about that will be wrong in ways that are expensive to unwind. The Strategy’s own instincts point the right way: value before novelty, readiness before deployment, evidence before expansion. Applied to this pillar, that means pilots rather than programmes, support released in stages, measurement built in from the start, feedback from the firms doing the work, and a real willingness to revise the plan when the evidence asks for it.

None of this is a criticism of the direction. The direction is right, and the pillar is more ambitious than most of the profession has yet realised.