The EU AI Act in Ireland: what your business has to do

If your business is based in Ireland, the EU AI Act already binds it. As a regulation, it needs no Irish version and has no size threshold. A firm that only buys its AI needs a written AI use policy long before any conformity assessment.

Ireland has added its own machinery: the Regulation of Artificial Intelligence Act 2026, signed on 21 July 2026 and commenced almost in full on 31 July. This is my reading of the law on 7 November 2026, as general information; anything high-risk deserves a solicitor’s eye.

Provider or deployer under the AI Act: the role that sets your duties

The Department of Enterprise, Tourism and Employment lists four roles: provider, deployer, importer and distributor. A provider develops a system or offers it under its own name; a deployer uses one in its work. One company can hold several, so settle it tool by tool.

Article 25(1) is the trapdoor. Rebrand a high-risk system, modify it substantially, or turn an ordinary tool to a high-risk purpose such as shortlisting candidates, and you become its provider. A licence does not move you, though it decides what the vendor may do with your text, as Copilot’s terms show.

An in-house team building an app on a model API can become the provider of that app. If its calls run through a LiteLLM proxy, its PII options keep client details out of the requests.

Using ChatGPT or Copilot at work: what a deployer owes today

This is where most Irish organisations sit: the CSO reported on 20 August 2026 that over 20% of enterprises with ten or more staff used AI in 2025. An everyday assistant does not make you a provider, and a chatbot alone is not high-risk.

Your website chatbot must say it is an AI under Article 50, unless that is obvious to a reasonably well-informed, observant person. A human first name on the widget works against you, and I would drop it. Councils face the same rule, as the local authority guide shows.

None of that covers what the vendor does with the words your staff type. Each product answers that in its own terms, starting with how Claude handles your data.

Google’s answer differs again, as what Gemini shares sets out. Where client files are involved, that worries me more than anything in the Act.

AI Act timeline after the Digital Omnibus: the dates that matter in Ireland

The Act has applied generally since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, signed on 8 July 2026 and in force from 27 July, moved the high-risk dates to fixed days that no longer wait on standards, and added two bans.

The separate omnibus that would amend the GDPR, COM(2025) 837, is still a proposal awaiting a Parliament committee. A supplier quoting it as law is ahead of the facts.

New Article 4a lets providers and deployers process special category data where strictly necessary to correct bias, with pseudonymisation among the conditions. Whether that data stays personal turns on who can re-identify it. I’d read it as a narrow door for testing a hiring tool, nothing wider.

Banned AI practices in Ireland: Article 5 and who polices each ban

Article 5 has bound everybody since 2 February 2025, with no threshold. Most of it is remote from an office, such as social scoring or untargeted scraping of faces. S.I. No. 405 of 2026 names an Irish authority for each point.

Source: Schedule 3 to S.I. No. 366 of 2025 as substituted by S.I. No. 405 of 2026.

An employer can walk into the emotion ban by ticking a feature box in a contact centre suite. If I ran a customer line, that feature would be off and named in the acceptable use policy. A suspected breach can bring a prohibition notice under section 72 of the Irish Act.

Article 4 AI literacy in Ireland: enforcement and the evidence to keep

The omnibus rewrote Article 4. Providers and deployers “shall take measures to support the development of AI literacy” of staff using AI on their behalf, without guaranteeing any level for any individual. What an officer can ask about is the measure, so record it.

The Commission says national authorities have supervised Article 4 since 2 August 2026. The Irish Act, though, gives it no notice or fine of its own: section 71(11) leaves it off the list for contravention notices, and none of the Article 99 bands that section 105 applies names it.

That changes in December 2027 for anyone running an Annex III tool, because Article 26(2) wants oversight from people with the necessary competence and training. I’d keep the literacy record as the first page of that file.

Staff need to know which details stay out of a prompt, and what to redact before an AI sees a file makes a fair syllabus. For the general half, the AI Office points to AIReady.ie, free short lessons you can assign and log.

In the OECD Trust Survey run by the CSO in 2025, 56% of people in Ireland said they could explain AI to someone else, behind only Luxembourg and Norway. I wouldn’t give a client file and an AI tool to anyone in the other 44% before that session.

High-risk AI in recruitment, credit and insurance from December 2027

A system is high-risk when it is intended for a purpose listed in Annex III; how risky it feels does not come into it. Three of its eight areas reach ordinary employers and lenders.

Source: Annex III of Regulation (EU) 2024/1689; Schedule 2 to S.I. No. 366 of 2025 as substituted by S.I. No. 405 of 2026.

From 2 December 2027 a deployer of one of these owes Article 26: follow the instructions, give oversight to someone competent who can overrule it, keep logs for at least six months, and tell workers and their representatives first. A tool bought this year will still be running then.

Article 27 adds a fundamental rights impact assessment for public bodies, private firms providing public services, and deployers of 5(b) and 5(c) systems. A contractor running a service for a county council is in that group, and I suspect few have noticed.

Questions to ask an AI supplier before you sign

Most of the above gets easier if the supplier commits in writing before the purchase order. Several of these overlap with the AI questions on a cyber questionnaire, so the answers do double duty at renewal.

“Fully AI Act compliant” with nothing behind it would make me walk away. If a hosted proxy sits between your app and the model, it is one more processor in the chain, as our explainer on AI gateways covers.

For an open-source filter, ask who will maintain it in two years, the question our LLM Guard alternatives page looks at.

Who enforces the AI Act in Ireland: the AI Office and the sector regulators

Ireland gave each area to the body already supervising it. Coordinating them is Oifig IS na hÉireann, the AI Office of Ireland, established on 2 August 2026 under section 8 of the 2026 Act as an independent statutory body with its own board.

Across S.I. No. 366 of 2025 as amended by S.I. No. 405 of 2026, fourteen bodies hold a designation.

Under section 43 the Office keeps an Irish AI register of Article 5 incidents and serious incidents with high-risk systems. A firm with several tools may answer to three bodies, which argues for one approach across the organisation, as on our page for organisations.

The Department calls the 2026 Act a technical implementing measure that adds no obligations. It adds procedure: anyone can complain under section 61, staff reports are protected disclosures under section 62, and nine fundamental rights bodies listed in section 53 can ask for testing.

With an adjudicator and two courts between a notice and a payable fine, I would not buy from anyone selling urgency on imminent fines. Whether insurance pays for answering a regulator is covered in cyber cover in Ireland.

AI Act fines in Ireland: the Article 99 bands and the Irish caps

Article 99 sets three ceilings, each a euro figure or a share of worldwide turnover, whichever is higher. For SMEs and, in the two lower bands, small mid-caps, it is whichever is lower. Section 105(5)(a) of the Irish Act caps a public body at €1,000,000.

For most Irish businesses the middle bar is the one that matters. Section 105(4) ties the bottom one to Irish steps, such as confirming in writing that a contravention notice has been complied with, so I’d want a second reader on that letter.

The public body cap uses the definition in section 10 of the Data Sharing and Governance Act 2019, which takes in councils, whose wider position is in what council staff can use.

The AI Act and GDPR in Ireland: client data typed into an AI chat

The DPC’s note of 18 July 2024 still frames the deployer’s side: a user of an AI product relying on personal data could be a controller, and should consider a formal risk assessment. Which assistants pass that test is a separate set of criteria.

Sources: Article 99 of Regulation (EU) 2024/1689; Article 83 of the GDPR.

The note’s sharpest question is whether you could find and delete someone’s data inside the AI system. For ChatGPT, that starts with what OpenAI keeps.

Nothing in the AI Act stops an employee pasting a client’s name and file reference into an assistant. It appears in no AI register, but it is a disclosure to a third party and possibly a personal data breach.

A rule on paper can’t see what someone pastes at ten to five on a Friday, so that part I want software to handle, including Nonimo Gateway on your own server for apps built on the OpenAI API.

The Nonimo app for Mac and Windows swaps names and other identifiers for markers before the text leaves the machine, and our security page explains why none of it reaches us. You stay the controller of what is sent.

If client files already go into assistants in your office, put the app on one desk for a week and look at what it marks. For the identifiers that matter most in an Irish file, from the PPS number to the Eircode, the Irish guides go document by document.

Sources

• Regulation (EU) 2024/1689, the AI Act: Articles 4, 5, 25, 26, 27, 50, 99, 113 and Annex III.
• Regulation (EU) 2026/1744, the Digital Omnibus on AI: new dates, amended Article 4, Article 4a, the December 2026 bans, Article 99(6a).
• Regulation of Artificial Intelligence Act 2026, No. 31 of 2026: sections 42, 43, 53, 59, 61, 62, 68 to 72, 79, 83, 105, 107, 109, 114 and 116 to 117. Commenced by S.I. No. 403 of 2026.
• S.I. No. 405 of 2026: the designation Schedules for Annex I, Annex III and Article 5, amending S.I. No. 366 of 2025.
• Department of Enterprise, Tourism and Employment, announcement of 30 July 2026: signing, the Act as a technical implementing measure, further legislation promised for the autumn.
• Department of Enterprise, Tourism and Employment, The EU AI Act and my organisation: the four roles and Ireland’s distributed model.
• AI Office of Ireland: the Office’s remit and AIReady.ie.
• Data Protection Commission, AI, Large Language Models and Data Protection, 18 July 2024: the controller framing and the access and deletion question.
• Central Statistics Office, Understanding of AI and its use in Ireland, 20 August 2026: adoption figures and the OECD Trust Survey results.

Checked on 7 November 2026.