EU AI Act in Ireland: What Irish Businesses Must Do
On this page
The EU AI Act, Regulation (EU) 2024/1689 adopted on 13 June 2024, is the world’s first comprehensive AI law, and it applies to Irish businesses whether they build AI or just use it. The good news for most SMEs: the obligations scale with risk, and ordinary business use sits in the light tiers. This guide translates the Act into what you must actually do.
The risk tiers
The Act sorts AI systems by risk:
- Prohibited practices. Social scoring, manipulative or exploitative techniques, and certain biometric uses are banned outright, the earliest obligations to apply.
- High-risk systems. AI used in hiring, credit, education, critical infrastructure, and similar sensitive contexts carries the heavy duties: risk management, documentation, human oversight, and conformity assessment.
- Limited risk. Transparency duties, the famous one being chatbots that must disclose they are AI.
- Minimal risk. Most business automation, with no specific obligations beyond existing law.
Most Irish SME uses, drafting assistance, customer service bots, marketing automation, sit in limited or minimal risk. The obligation that touches everyone is transparency: customers should know when they are talking to or reading AI.
The timeline
The Act entered into force on 1 August 2024 and applies in stages: prohibitions first, then general-purpose AI duties, with the general application of the regulation and the high-risk obligations following on their scheduled dates through 2027. The practical meaning: prohibitions and transparency rules are already live questions; high-risk compliance is being built now by those who will need it. The consolidated version of the regulation on EUR-Lex is dated 27 July 2026, so check there for the current text.
Ireland’s supervisor is already active
The Data Protection Commission published its AI Insights Report on 25 September 2026, covering its supervision of AI products and services between 2021 and 2025, with a significant increase in AI-related engagements driven by generative AI. The DPC’s message is consistent with its GDPR work: AI is not a loophole, and the data underneath still obeys GDPR.
The SME checklist
- Inventory your AI. List every AI tool the business uses, from chatbots to copilots.
- Apply transparency. Disclose AI to customers where the Act requires it, and do it honestly anyway, it is good business.
- Keep GDPR underneath. Lawful basis, data processing agreements, and no training on customer data without one, per our GDPR guide.
- Check for high-risk. If you use AI in hiring, credit decisions, or safety contexts, get a compliance assessment before the high-risk obligations bind.
- Document as you go. A short register of AI uses costs an afternoon and ages well.
How we help
We build AI systems with the compliance layer designed in: transparency features, data controls, and documentation. Our AI search and marketing work and AI agents ship with the guardrails the DPC and the AI Act expect. Book a call to map your current AI usage against the tiers.
Frequently asked questions
What is the EU AI Act?
Regulation (EU) 2024/1689, adopted on 13 June 2024, the first comprehensive AI law in the world. It sorts AI systems into risk tiers and imposes obligations that scale with the risk.
Does the AI Act apply to my Irish business?
If you provide or use AI systems in the EU, yes, at some level. Most SME uses sit in the limited or minimal risk tiers with light obligations, mainly transparency. Providers of high-risk systems carry the heaviest duties.
What are the AI Act risk tiers?
Prohibited practices like social scoring and manipulative techniques, high-risk systems like those used in hiring or critical infrastructure, limited risk with transparency duties such as chatbots disclosing they are AI, and minimal risk for everything else.
When do the AI Act obligations apply?
The Act entered into force on 1 August 2024 and applies in stages: prohibitions first, then general-purpose AI duties, with the general application and high-risk obligations following on their scheduled dates through 2027.
Who supervises AI and data protection in Ireland?
The Data Protection Commission is active on AI. Its AI Insights Report, published 25 September 2026, details its supervision of AI products and services from 2021 to 2025, with a significant increase in AI engagements driven by generative AI.
What should I do now as an Irish SME?
Know what AI you actually use, be transparent when customers interact with AI, keep GDPR duties on the underlying data, and check whether any use case is high-risk. The full checklist is below.