The EU AI Act applies in stages. The July 2026 amendment is enacted: the main Annex III high-risk rules apply from 2 December 2027 and the corresponding Annex I rules from 2 August 2028. Article 4 now requires measures supporting literacy development. Article 50 generally applies from 2 August 2026, with duties and exceptions that depend on the role and use.
What the EU AI Act is, in one paragraph
The AI Act (Regulation (EU) 2024/1689, full text on EUR-Lex) is the EU’s risk-based rulebook for artificial intelligence. It bans a short list of practices outright, places structured obligations on high-risk systems such as recruitment and credit-scoring tools, imposes lighter transparency duties on chatbots and AI-generated content, and leaves most everyday business AI in a minimal-risk category where good governance, rather than heavy regulation, is the expectation.
What is already in force
The original Article 5 prohibitions began applying in February 2025. Each has its own scope and exceptions, so assess the actual practice. Article 4 also began applying then and has since been amended: support literacy development in context without claiming a prescribed individual level or certificate. GPAI provider requirements are separate from ordinary use of tools such as Copilot.
Application dates to check
- 2 August 2026, Article 50 chatbot disclosure: customers must be told they are dealing with AI.
- Article 50 content duties: provider marking and specific deployer disclosures have different scopes and exceptions; generally applicable from 2 August 2026.
- 2 December 2027 , Annex III high-risk obligations, per the enacted Omnibus amendment which entered into force on 27 July 2026. Check the particular provision and any existing-system transition.
- 2 August 2028, high-risk rules for AI safety components in regulated products (Annex I).
The Irish dimension
Ireland’s Regulation of Artificial Intelligence Act 2026 was signed on 21 July 2026. The Department confirmed the AI Office’s establishment in its 30 July announcement. The Irish implementation arrangements and the EU obligations should be checked together for the relevant system and role.
A practical starting sequence
- Inventory your AI. List every system in use, including the AI features inside ordinary software. You cannot govern what you have not recorded.
- Establish your role. Most Irish SMEs are deployers, not providers, and the difference decides most of your obligations.
- Classify each system. Check it against Article 5, Annex III, Annex I and Article 50. Recruitment tools are the common trap: assessing CV-screening AI with the Article 6 tests and exceptions in view.
- Meet the duties that follow , literacy training now, chatbot disclosure under the current Article 50 requirements, and deployer duties under Article 26 for any high-risk system.
- Keep the evidence. A register, dated decisions, training records and vendor answers. When a regulator, customer or insurer asks, documentation is the answer.
What it costs to get wrong
Penalties scale with the breach: up to €35m or 7% of global turnover for prohibited practices, and up to €15m or 3% for high-risk non-compliance, with proportionate caps for SMEs. The realistic risk for most Irish firms is not the headline fine but being unable to show a customer, funder or regulator that AI use is governed at all.
Where to start this week
Every one of the five steps above starts from the same place: a current register of the AI your business actually uses, classified against the Act, with the obligations and deadlines attached. That is exactly what AI Register Ireland builds for you. See how the EU AI Act applies in Ireland or how the register works.
Legal references checked 4 October 2026: AI Omnibus in force; Article 4 guidance; Current application dates; Article 50 transparency; High-risk classification; Irish Act and AI Office. Check the provision and any transition that applies to your particular system.
One specific transition matters: Article 111(4) gives providers of synthetic-content systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2). This is not a general postponement of deployer disclosures. Article 111 also contains separate existing-system high-risk transitions.