Guidance · updated 4 October 2026
The EU AI Act in Ireland: what it actually requires of your business
The EU AI Act assigns duties by role and use. This guide separates obligations already applying from the high-risk rules whose main application dates were extended in July 2026. Start with what your organisation actually does with AI, then check the relevant provision and any exception.
Who the Act applies to: providers and deployers
The Act assigns obligations by role. A provider develops an AI system, substantially modifies one, or places one on the market under its own name. A deployer uses AI under its own authority, which is what almost every Irish SME is. Buying Copilot licences, embedding a chatbot, or subscribing to a recruitment platform makes you a deployer, not a provider.
The distinction matters because provider obligations (conformity assessment, technical documentation, CE marking for high-risk systems) are far heavier than deployer obligations. Most of this guide addresses the deployer position. One caution: building your own product on top of an AI model and selling it under your brand can tip you into provider territory, so take advice before you ship.
The risk pyramid, in one minute
The Act sorts AI uses into four tiers:
- Prohibited (Article 5). Specified harmful practices are prohibited, including certain social scoring, workplace emotion inference and untargeted facial-image scraping. Each prohibition has conditions or exceptions that must be checked. Penalties here are the Act’s highest.
- High-risk (Annex III and Annex I). Specified uses in employment, credit, life or health insurance, education, biometrics and critical infrastructure, and certain regulated products. Apply Article 6 and the relevant Annex, including exceptions. Structured obligations apply, including human oversight, logging and monitoring.
- Transparency (Article 50). Providers must address interaction disclosure and technical marking where applicable. Deployers have distinct duties for deepfakes and certain public-interest text, with exceptions.
- Minimal risk. Everything else, most productivity tooling. Good governance still applies, and Article 4 literacy applies regardless of tier.
A single system can sit in more than one tier at once: a customer chatbot built on a high-risk use would carry both sets of duties. The full legal text is on EUR-Lex (Regulation (EU) 2024/1689).
Assess recruitment AI carefully
AI for analysing or filtering applications or evaluating candidates is covered by the Annex III employment category. Assess its intended purpose against Article 6, including the limited exceptions. Human sign-off alone is not an exemption. Where high-risk obligations apply, establish the relevant oversight, data and monitoring arrangements for the applicable date.
The full timetable
Application dates checked on 4 October 2026 against the current Article 113. The main high-risk dates are enacted. Individual provisions and existing-system transitions still need checking.
| Obligation set | Status / deadline |
|---|---|
| Original Article 5 prohibitions | Applied from 2 February 2025; assess each provision and exception |
| Article 4 literacy measures | Applied from February 2025; amended in July 2026 to support development without a fixed individual level |
| GPAI provider rules | Applied from August 2025, with specific transitions |
| Article 50 transparency | Generally applies from 2 August 2026; provider/deployer duties and exceptions differ |
| Main Annex III high-risk rules | 2 December 2027 under the enacted amendment |
| Corresponding Annex I high-risk rules | 2 August 2028 under the enacted amendment |
| Irish Regulation of AI Act 2026 | Signed 21 July 2026; AI Office establishment confirmed by the Department |
Ireland’s Act and AI Office
Ireland’s Regulation of Artificial Intelligence Act 2026 was signed on 21 July. The Department’s 30 July announcement confirms the AI Office’s establishment and first chief executive. National coordination supports the EU framework. Check the relevant competent authority and provision for your use.
Penalties: context, not scaremongering
The ceilings are €35 million or 7% of global turnover for prohibited practices, and €15 million or 3% for high-risk non-compliance, with proportionate caps for SMEs. The realistic near-term exposure for an Irish SME is not a headline fine. It is failing a customer’s vendor assessment, an insurer’s questionnaire, or a tender requirement because you cannot evidence basic AI governance.
The five steps for an Irish SME
- Inventory. List every AI tool in use, including the unofficial ones.
- Classify. Put each system through the Act’s risk taxonomy and record the outcome with its rationale.
- Assign and train. Support literacy development in the relevant work and retain a practical record of the measures taken.
- Review transparency. Check Article 50 against your role, systems and publications, including its exceptions.
- Keep evidence. Vendor due diligence, training records, decisions, timestamped, in one place a third party can trust.
AI Register Ireland can help organise systems, decisions and evidence. It does not make a legal decision for you or replace the work needed to implement controls. See how it works.
Frequently asked questions
Yes, in stages. Original prohibitions and literacy measures applied from February 2025. The July 2026 amendment changed Article 4 and extended the main high-risk dates. Article 50 generally applies from 2 August 2026. Main Annex III high-risk rules apply from 2 December 2027 and corresponding Annex I rules from 2 August 2028, subject to the relevant scope and transitions.
The national Act was signed into law on 21 July 2026. The Department confirmed the AI Office of Ireland’s establishment and its first chief executive in a 30 July announcement. The Office coordinates across designated competent authorities; the EU regulation provides the substantive AI framework.
Establish the actual use and your role. Article 4 requires measures supporting literacy development among people using AI on your behalf. It does not prescribe a particular course or certificate. Article 50 duties depend on the role, output and use. Using AI for decisions about people needs its own assessment.
Annex III covers specified recruitment and employment uses. Assess intended purpose and the Article 6 tests, including its limited exceptions. Human sign-off alone is not an exemption. Annex III systems profiling natural persons remain high-risk. Obtain the provider’s documented assessment and review your actual use.
Article 99 sets different maximum fines for specified breaches. The headline maximum is not an automatic fine or a prediction for an SME. The applicable provision, scope, dates and proportionality rules need checking. Governance evidence helps demonstrate what the organisation actually did.
No universal obligation requires an organisation to buy a commercial AI register. A maintained inventory helps organise the assessment, decisions and evidence. Use a format proportionate to your needs; software becomes useful when ownership, changes and records become difficult to manage.
Sources
- Regulation (EU) 2024/1689 (the AI Act), EUR-Lex
- European AI Office, digital-strategy.ec.europa.eu
- Department of Enterprise, Tourism and Employment (Irish Act), enterprise.gov.ie
- Current Article 4 guidance
- Article 111 transitions: pre-August 2026 synthetic-content systems have a specific provider-marking deadline of 2 December 2026. This is not a blanket deployer deadline.
Discuss your AI governance needs
The register helps organise your systems, decisions and supporting evidence. Discuss your uses and the questions you need to resolve before deciding whether it fits your organisation.
Talk to us