Most Irish small businesses have fewer obligations under the AI Act than they fear, but more than none. Here's what applies to you right now, what's coming, and what you can safely ignore.
Last reviewed: October 2026
ISO 42001 CERTIFIED · ISO 27001 CERTIFIED · GDPR COMPLIANT · EU AI ACT READY
If you use AI tools built by someone else, which describes most Irish SMEs, you have three duties that already apply:
Applicable since 2 February 2025.
Also since 2 February 2025.
Applicable since 2 August 2026.
That's it, for most businesses. The heavy obligations around documentation, conformity assessment and risk management apply to high-risk systems, and they don't start until December 2027.
If your AI touches recruitment, credit decisions, education or access to essential services, read Section 4 carefully. Otherwise the three duties above are likely your full exposure.
Not sure which category you're in? A 30-minute call will tell you.
Book a free call
The AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages rather than all at once.
In July 2026 it was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved several deadlines and softened one duty. That amendment is why many guides you'll find online are now wrong.
The Act works by risk. What you must do depends entirely on what the AI is used for, not on how sophisticated it is. A simple tool used for recruitment carries more obligations than a complex one used for stock forecasting.
It also distinguishes between providers, who build or substantially modify AI systems, and deployers, who use them. Most Irish SMEs are deployers, and deployer duties are considerably lighter.
Social scoring, certain biometric categorisation, manipulative systems that exploit vulnerabilities. These have been prohibited since February 2025, with two further prohibitions arriving on 2 December 2026.
AI used in recruitment, credit scoring, education, essential services, law enforcement and border control, plus AI embedded in regulated products. These carry the full documentation, oversight and conformity requirements.
Chatbots, AI-generated content, deepfakes. You must tell people they're dealing with AI or that content is AI-generated.
Everything else, which is the vast majority of AI in ordinary business use: spam filters, recommendation engines, productivity tools. No new obligations.
Most of what an Irish SME uses falls into the last two categories.
| Date | What Applies | Status |
|---|---|---|
| 1 Aug 2024 | Act enters into force | Done |
| 2 Feb 2025 | Prohibited practices, definitions, AI literacy | Live |
| 2 Aug 2025 | General-purpose AI model obligations | Live |
| 27 Jul 2026 | Digital Omnibus amendment enters into force | Done |
| 2 Aug 2026 | General application, Article 50 transparency, enforcement begins | Live |
| 2 Dec 2026 | Two new prohibitions, end of transition for certain pre-existing systems | Coming |
| 2 Dec 2027 | High-risk obligations, standalone systems (Annex III) | Coming |
| 2 Aug 2028 | High-risk obligations, AI in regulated products (Annex I) | Coming |
High-risk obligations for standalone systems were originally set for 2 August 2026. The Digital Omnibus pushed them to 2 December 2027, with product-embedded systems moving to 2 August 2028.
That's a reprieve, not a cancellation. The requirements themselves didn't change, only the date they bite.
The transparency obligations, the general-purpose AI rules and the prohibitions all stayed on their original schedule. If you've read that nothing applies until 2027, that's wrong.
The dates have changed more than once. We'll tell you which apply to you specifically.
Since February 2025, businesses using AI must take measures to support the AI literacy of staff and anyone operating AI systems on their behalf. The Omnibus clarified that this doesn't require guaranteeing any specific level of literacy for an individual, so the duty is lighter than it first appeared. A practical training session and a record of it is a reasonable response.
Since August 2026, people interacting with an AI system must be told. Formally this duty sits with the provider of the system, but if you put a chatbot on your own website, labelling it clearly is the safe choice.
Where you publish AI-generated images, audio or video that could pass for real, it needs to be marked.
Unlikely to affect an ordinary business, but worth screening any new AI use before you approve it.
Nothing in the Act requires a formal register for most deployers, but knowing what AI your business uses makes everything else easier.
AI literacy is a duty you can discharge with one session.
See our AI training for teamsThis is the duty most Irish SMEs overlook, partly because it sounds vague.
What the Act asks for is that the people using AI in your business understand enough about it to use it sensibly. Not a qualification, not a certification, and since the July 2026 amendment, not a guaranteed standard per person.
In practice that means your team should understand what the tools do, where they're unreliable, what information should never go into them, and when a human needs to check the output.
A half-day session with a written record of what was covered is a reasonable and proportionate response for most small businesses.
Yes. The AI Act is an EU regulation, so it applies directly in Ireland without needing to be transposed into Irish law.
It applies to you if you place AI systems on the EU market, or if you use AI systems in the EU. It can also reach businesses outside the EU whose AI output is used here.
For UK businesses: the UK isn't bound by the Act, but UK businesses selling into the EU, or whose AI output is used in the EU, can still fall within scope.
Enforcement in Ireland sits with the national authorities designated under the Act, alongside the European Commission's AI Office for general-purpose AI models.
Assuming it doesn't apply. If you use any AI, at least the literacy and transparency duties apply.
Assuming everything applies. Most business AI is minimal risk with no new obligations. The heavy requirements are for specific high-risk uses.
Reading an outdated guide. Many published timelines still show August 2026 for high-risk obligations. That changed in July 2026.
Confusing providers with deployers. Most SMEs are deployers, with much lighter duties.
Forgetting the AI inside existing software. AI features added to tools you already use count too.
Treating it as a one-off. New prohibitions arrive in December 2026 and high-risk duties in December 2027. It needs revisiting.
A 30-minute conversation about what AI your business uses and what that means for your obligations. No jargon, no scaremongering.
Yes, but lightly for most. If you use AI tools built by others, your duties are AI literacy, transparency about AI use, and avoiding prohibited practices. The heavy obligations apply to high-risk uses such as recruitment and credit scoring.
Prohibited practices and AI literacy since February 2025, general-purpose AI obligations since August 2025, transparency and general application since August 2026. Two new prohibitions arrive on 2 December 2026, high-risk obligations for standalone systems on 2 December 2027, and for product-embedded systems on 2 August 2028.
Partly. The Digital Omnibus, which entered into force on 27 July 2026, moved the high-risk deadlines to December 2027 and August 2028. Everything else stayed on schedule, and enforcement began in August 2026.
The Act sets substantial maximum fines, scaled by the severity of the breach and the size of the business. The Act includes provisions intended to be proportionate for SMEs. For your specific exposure, speak to a solicitor.
Registration requirements apply to high-risk systems. Most SMEs using ordinary AI tools have no registration duty.
No. It's a regulation, so it applies directly and uniformly across member states. Enforcement is handled by designated national authorities.
It depends on what it's used for. Recruitment, credit scoring, education, essential services, law enforcement and regulated products are the main categories. Our AI risk assessment classifies each system you use AI Governance
The European Commission's AI Act Service Desk publishes the official implementation timeline at ai-act-service-desk.ec.europa.eu.
