Ireland AI Regulation & Governance

Article 70 of the AI Act requires Ireland to establish or designate at least one notifying authority and at least one market surveillance authority.

S.I. No. 366 of 2025 designates the Data Protection Commission as the market surveillance authority for the purposes of Article 74(8) of the AI Act.

The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as a body corporate and the single point of contact under Article 70(2) of the AI Act, commenced 31 July 2026.

The AI Act applies to providers, deployers, importers, distributors and product manufacturers of AI systems with EU nexus, with exemptions for military/defence, national security, scientific R&D, open-source models (subject to exceptions), and purely personal non-professional use.

The AI Act applies generally from 2 August 2026, with Chapters I-II/Art 5 prohibitions from 2 February 2025 and Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Art 78 from 2 August 2025.

The Digital Omnibus on AI deferred Chapter III Sections 1-3 high-risk obligations for Annex III use-case systems from 2 August 2026 to 2 December 2027.

Providers and deployers must take measures to support development of sufficient AI literacy among staff; the Digital Omnibus on AI reworded this from a duty to 'ensure' to a duty to 'take measures to support the development of', effective 27 July 2026, not requiring any guaranteed individual level.

Ireland must designate at least one notifying authority and one market-surveillance authority under Art 70 of the AI Act.

Ireland's Regulation of Artificial Intelligence Act 2026 entered into force 31 July 2026, establishing the AI Office of Ireland, a sandbox, and an enforcement regime.

The AI Act's scope covers providers, deployers, importers, distributors and manufacturers, with exemptions for defence, R&D, open-source, and purely personal use.

The AI Act's application is staggered by chapter, fully applying from 2 August 2026 with earlier tranches from 2 February 2025 and 2 August 2025.

Providers and deployers must take measures to support AI literacy among relevant staff, under a duty softened by the Digital Omnibus on AI.

Derived: Probable The Regulation of Artificial Intelligence Act 2026 (No. 31/2026) commenced on 31 July 2026, establishing the AI Office of Ireland, a single point of contact function, an AI regulatory sandbox and a domestic enforcement/penalty regime.

Derived: Probable The EU AI Act applies on a staggered calendar, with prohibitions in force since 2 February 2025, GPAI/governance/penalties provisions since 2 August 2025, and general application since 2 August 2026.

Derived: Probable The Digital Omnibus on AI deferred high-risk AI system obligations under the AI Act to 2 December 2027 for Annex III use-cases and 2 August 2028 for Annex I product-safety routes.

The Central Bank of Ireland is designated as Ireland's market surveillance authority under Article 74(6) of the AI Act for high-risk AI systems used by financial institutions.

The Data Protection Commission is designated as Ireland's market surveillance authority under Article 74(8) of the AI Act for high-risk AI systems in law enforcement, migration, justice and specified biometric uses under Annex III.

The AI Office of Ireland became operational on 1 August 2026 as Ireland's Article 70(2) single point of contact for the AI Act, superseding the interim ministerial designation.

Under the Digital Omnibus amendment, the AI Act's high-risk provider and importer/distributor obligations now apply from 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems), later than the original Article 113 schedule.

A Bill initiated in the Dáil on 4 February 2026 would extend Ireland's Coco's Law to intimate images generated or modified by computer graphics (AI/deepfakes); it has not yet been enacted.

Ireland established the AI Office of Ireland by statute, with functions to coordinate competent authorities, raise AI literacy, and advise the Minister, acting independently.

Ireland's Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026 and its main provisions came into operation on 31 July 2026.

Non-compliance with Art 5 prohibited practices carries fines of up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with reversed SME caps.

Providers and deployers must not place on the market, put into service or use AI systems for eight listed prohibited practices under Art 5(1)(a)-(h), each subject to narrow exceptions.

Two new prohibited practices were added to Art 5(1): AI-generated non-consensual intimate imagery and AI-generated/facilitated CSAM, applying from 2 December 2026.

Coimisiún na Meán is designated an Irish AI Act market-surveillance authority for prohibited practices and transparency obligations in its regulated sector.

Derived: Probable AI Act penalties are tiered up to EUR 35m/7% turnover for prohibited-practice breaches, EUR 15m/3% for other obligations, and EUR 7.5m/1% for misleading information, with a lower-of rule for SMEs.

Derived: Probable Article 5 of the EU AI Act prohibits a closed list of AI practices, including subliminal manipulation, social scoring and untargeted facial-image scraping, with a narrow law-enforcement exception for real-time remote biometric identification.

Derived: Probable The Digital Omnibus on AI adds two new prohibited practices to Article 5 of the AI Act, both applicable from 2 December 2026.

Ireland's AI Advisory Council said national law already criminalises AI-generated non-consensual intimate images and CSAM, and urged EU-level amendment of Article 5 during Ireland's 2026 Presidency.

The EU AI Act's Digital Omnibus amendment adds prohibitions on AI-generated non-consensual intimate imagery and CSAM, applying in Ireland from 2 December 2026.

The Digital Omnibus on AI deferred Chapter III Sections 1-3 high-risk obligations for Annex III use-case systems from 2 August 2026 to 2 December 2027.

High-risk obligations for AI systems under Art 6(1)/Annex I (safety components of regulated products) now apply from 2 August 2028.

A non-EU provider of a high-risk AI system must appoint by written mandate an EU authorised representative before making the system available on the Union market.

Annex III lists eight high-risk AI use-case categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/asylum/border control, administration of justice), amendable by Commission delegated act.

Providers of high-risk AI systems must operate a QMS, keep technical documentation and logs, undergo conformity assessment, affix CE marking, register the system, and cooperate with authorities.

Providers (and deployers where applicable) must report serious incidents to the relevant market surveillance authority within 15 days generally, 2 days for widespread infringements or critical-infrastructure disruption, or 10 days where a person has died.

Deployers of high-risk AI systems must use the system per instructions, assign competent human oversight, monitor operation, retain automatically generated logs for at least six months, and inform affected workers and their representatives.

Public-body deployers, and private deployers in specified contexts (public services, credit/insurance risk assessment), must carry out and register a fundamental rights impact assessment before first use of a high-risk AI system.

Authorised representatives, importers and distributors of high-risk AI systems owe verification and cooperation duties before making a system available, but the detailed sub-duties were not fully retrievable.

The Digital Omnibus on AI defers Annex III high-risk obligations to 2 December 2027.

The Digital Omnibus on AI defers Annex I product-route high-risk obligations to 2 August 2028.

A non-EU high-risk AI system provider must appoint an EU-established authorised representative before market availability.

An AI system is high-risk if it is a regulated product safety component (Annex I) or falls within one of the eight Annex III use-case categories.

Annex III lists eight high-risk AI use-case categories spanning biometrics, infrastructure, education, employment, essential services, law enforcement, migration and justice.

High-risk AI system providers owe conformity-assessment, documentation, registration, CE-marking and cooperation duties.

High-risk AI system providers must retain documentation for 10 years after market placement.

Deployers of high-risk AI systems owe human-oversight, monitoring, log-retention, worker-notification and cooperation duties.

Public-body and specified private deployers must conduct and register a fundamental rights impact assessment before deploying certain high-risk AI systems.

Derived: Probable Providers of high-risk AI systems must meet Article 16 duties including QMS, documentation, conformity assessment and registration, though Annex III application is deferred to 2 December 2027.

Derived: Probable The Digital Omnibus on AI deferred high-risk AI system obligations under the AI Act to 2 December 2027 for Annex III use-cases and 2 August 2028 for Annex I product-safety routes.

The AI Act sets different conformity-assessment routes for high-risk systems depending on Annex classification, with only biometric (Annex III point 1) systems generally requiring notified-body assessment.

Under the Digital Omnibus amendment, the AI Act's high-risk provider and importer/distributor obligations now apply from 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems), later than the original Article 113 schedule.

Under Article 22(1) of the AI Act, a third-country provider of a high-risk AI system must appoint an EU-established authorised representative by written mandate before placing the system on the EU market.

Derived: Probable A GPAI model is presumed to present systemic risk above 10^25 FLOPs cumulative training compute, and its provider must notify the Commission without delay and within two weeks of meeting or foreseeing that threshold, with an option to rebut the presumption.

Providers of general-purpose AI models must maintain technical documentation, give downstream providers capability/limitation information, maintain a copyright-compliance policy, and publish a training-content summary; open-source models are exempt from the first two duties but never the latter two, and never when systemic risk applies.

A GPAI model is presumed systemic-risk above 10^25 FLOPs cumulative training compute; the provider must notify the Commission within two weeks of meeting or foreseeing that threshold.

GPAI model providers must keep technical documentation, inform downstream providers, maintain a copyright policy, and publish a training-content summary, with a partial open-source exemption.

A GPAI provider whose model's cumulative training compute exceeds 10^25 FLOPs must notify the Commission within two weeks.

A systemic-risk GPAI provider must perform model evaluation, risk mitigation, cybersecurity assurance, and serious-incident reporting.

Derived: Probable Article 50 transparency obligations of the EU AI Act, covering AI-interaction disclosure, synthetic-content marking, emotion-recognition/biometric-categorisation disclosure and deepfake/public-interest-text disclosure, have applied since 2 August 2026.

Derived: Probable Article 50 of the AI Act, in force since 2 August 2026, requires disclosure of AI interaction, machine-detectable marking of synthetic content, and labelling of deepfakes and AI-generated public-interest text.

A Bill initiated in the Dáil on 4 February 2026 would extend Ireland's Coco's Law to intimate images generated or modified by computer graphics (AI/deepfakes); it has not yet been enacted.

Providers of general-purpose AI models must maintain technical documentation, give downstream providers model information, maintain an EU-copyright compliance policy, and publish a training-data summary, with a partial exemption for open-source models that never covers the copyright or training-data-summary duties and does not apply at all to systemic-risk models.

Derived: Probable A GPAI model is presumed to present systemic risk above 10^25 FLOPs cumulative training compute, and its provider must notify the Commission without delay and within two weeks of meeting or foreseeing that threshold, with an option to rebut the presumption.

Providers of general-purpose AI models must maintain technical documentation, give downstream providers capability/limitation information, maintain a copyright-compliance policy, and publish a training-content summary; open-source models are exempt from the first two duties but never the latter two, and never when systemic risk applies.

GPAI model providers must keep technical documentation, inform downstream providers, maintain a copyright policy, and publish a training-content summary, with a partial open-source exemption.

The Guidelines for the Responsible Use of AI in the Public Service, published 7 May 2025 and last updated 31 October 2025, set out seven principles, a Decision Framework and a Responsible AI Canvas, as non-binding soft law imposing no direct statutory penalties.

Ireland's national AI strategy, refreshed in November 2024, is a non-binding whole-of-government policy framework that references coordination with the Data Protection Commission and does not substitute binding AI Act/national AI Act duties.

High-risk AI system providers must retain documentation for 10 years after market placement.

Ireland's Department of Public Expenditure has published non-binding Guidelines for the Responsible Use of AI in the Public Service, setting seven principles and supporting tools for public bodies.

Ireland's national AI strategy, refreshed in November 2024, is non-binding whole-of-government policy sitting alongside the binding EU AI Act and the Regulation of Artificial Intelligence Act 2026.

Ireland's AI Advisory Council said national law already criminalises AI-generated non-consensual intimate images and CSAM, and urged EU-level amendment of Article 5 during Ireland's 2026 Presidency.

Ireland's Coco's Law (2020) criminalises non-consensual distribution of intimate images and is understood to extend to AI-generated or digitally altered images.

Irish fundamental rights public bodies must notify the relevant market surveillance authority as soon as reasonably practicable when making an Article 77(1) access request.

Ireland's public-service AI guidelines require all AI tools used in government to comply with seven Trustworthy AI principles, including built-in human oversight.

Providers (and deployers where applicable) must report serious incidents to the relevant market surveillance authority within 15 days generally, 2 days for widespread infringements or critical-infrastructure disruption, or 10 days where a person has died.

Derived: Probable Article 73 of the EU AI Act requires providers (and deployers where applicable) to report serious incidents involving high-risk AI systems within 15 days generally, 2 days for widespread infringement or critical-infrastructure disruption, and 10 days where death has occurred.

High-risk AI system providers must report serious incidents within tiered deadlines of 2, 10 or 15 days depending on severity.

Derived: Probable Article 73 of the AI Act requires providers and deployers to report serious incidents to market surveillance authorities within tiered deadlines of immediately, 15, 10 or 2 days depending on severity.

Derived: Probable National market surveillance authorities in Ireland apply EU-wide procedures to act against AI systems that present a risk, including corrective action, restriction, withdrawal or recall.

Under Article 73 of the AI Act, providers of high-risk AI systems must report a serious incident to the relevant market surveillance authority no later than 15 days after becoming aware, with shorter deadlines (10 days for death; 2 days for widespread infringement or critical-infrastructure disruption) applying to specific incident types.

Irish market surveillance authorities must report annually to the AI Office and CCPC all Article 73 serious incidents of high-risk AI systems in the State.

Derived: Probable Under Article 16 of the EU AI Act, providers of high-risk AI systems must comply with Chapter III Section 2 requirements, including registration, documentation, quality management and conformity assessment, with application deferred to 2 December 2027.

Derived: Probable Article 73 of the EU AI Act requires providers (and deployers where applicable) to report serious incidents involving high-risk AI systems within 15 days generally, 2 days for widespread infringement or critical-infrastructure disruption, and 10 days where death has occurred.

Derived: Probable Articles 40 and 41 of the EU AI Act create a presumption of conformity for high-risk AI systems meeting cited harmonised standards or Commission common specifications, though no such harmonised standard had been cited in the Official Journal as of the run date.

Derived: Probable Article 43 of the EU AI Act sets differentiated conformity-assessment routes by annex: Annex I products follow relevant product legislation, Annex III points 2-8 use internal control without a notified body, and Annex III point 1 (biometrics) requires third-party assessment unless harmonised standards or common specifications are applied.

Derived: Probable Providers of high-risk AI systems must meet Article 16 duties including QMS, documentation, conformity assessment and registration, though Annex III application is deferred to 2 December 2027.

Articles 40-41 of the AI Act create a presumption of conformity for high-risk systems meeting harmonised standards or common specifications, but as of this cycle no such harmonised standard has been cited in the Official Journal.

The AI Act sets different conformity-assessment routes for high-risk systems depending on Annex classification, with only biometric (Annex III point 1) systems generally requiring notified-body assessment.

S.I. No. 366 of 2025 designates the Data Protection Commission as the market surveillance authority for the purposes of Article 74(8) of the AI Act.

The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as a body corporate and the single point of contact under Article 70(2) of the AI Act, commenced 31 July 2026.

Section 136 of the Regulation of Artificial Intelligence Act 2026 caps administrative fines against public bodies for AI Act infringements at EUR 1,000,000.

S.I. No. 405 of 2026 designates Coimisiun na Mean as one of 15 market surveillance authorities for the AI Act in Ireland, supervising Art 5(1)(a)-(b) and Art 50 obligations for entities it regulates.

Non-compliance with Art 5 prohibited practices carries fines of up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with reversed SME caps.

Ireland must designate at least one notifying authority and one market-surveillance authority under Art 70 of the AI Act.

S.I. No. 366 of 2025 designates the Minister, the Central Bank of Ireland and the Data Protection Commission as Irish AI Act authorities.

Ireland's Regulation of Artificial Intelligence Act 2026 entered into force 31 July 2026, establishing the AI Office of Ireland, a sandbox, and an enforcement regime.

Coimisiún na Meán is designated an Irish AI Act market-surveillance authority for prohibited practices and transparency obligations in its regulated sector.

Derived: Probable AI Act penalties are tiered up to EUR 35m/7% turnover for prohibited-practice breaches, EUR 15m/3% for other obligations, and EUR 7.5m/1% for misleading information, with a lower-of rule for SMEs.

Derived: Probable Ireland caps administrative fines against public bodies for AI Act infringements at EUR 1,000,000.

Derived: Probable National market surveillance authorities in Ireland apply EU-wide procedures to act against AI systems that present a risk, including corrective action, restriction, withdrawal or recall.

Ireland's S.I. No. 366 of 2025 designates the Minister for Enterprise, Tourism and Employment as national competent authority, and the Central Bank of Ireland and Data Protection Commission among the market surveillance authorities under the AI Act.

Derived: Probable The Regulation of Artificial Intelligence Act 2026 (No. 31/2026) commenced on 31 July 2026, establishing the AI Office of Ireland, a single point of contact function, an AI regulatory sandbox and a domestic enforcement/penalty regime.

Coimisiún na Meán has been designated as one of Ireland's 15 market surveillance authorities for AI Act prohibited-practice and transparency obligations in the media sector.

The Central Bank of Ireland is designated as Ireland's market surveillance authority under Article 74(6) of the AI Act for high-risk AI systems used by financial institutions.

The Data Protection Commission is designated as Ireland's market surveillance authority under Article 74(8) of the AI Act for high-risk AI systems in law enforcement, migration, justice and specified biometric uses under Annex III.

The AI Office of Ireland became operational on 1 August 2026 as Ireland's Article 70(2) single point of contact for the AI Act, superseding the interim ministerial designation.

Ireland established the AI Office of Ireland by statute, with functions to coordinate competent authorities, raise AI literacy, and advise the Minister, acting independently.

Ireland designated 15 national competent authorities under Article 70(1) of the EU AI Act, later updated by S.I. 405/2026 to add the AI Office of Ireland.

Irish market surveillance authorities must report annually to the AI Office and CCPC all Article 73 serious incidents of high-risk AI systems in the State.

As of October 2026 the AI Office's sandbox programme remained under development with no sandbox cohort yet announced.

Section 46 of the Regulation of Artificial Intelligence Act 2026 empowers the AI Office of Ireland to establish one or more national AI regulatory sandboxes under Article 57 of the AI Act, in force from 31 July 2026.

An applicant may apply to the relevant market surveillance authority to conduct real-world testing of a high-risk AI system outside a sandbox under ss.59-60 of the Act (Art 60 AI Act), with permission granted only where Art 60(4) conditions are met.

Ireland's Regulation of Artificial Intelligence Act 2026 entered into force 31 July 2026, establishing the AI Office of Ireland, a sandbox, and an enforcement regime.

Derived: Probable The Regulation of Artificial Intelligence Act 2026 (No. 31/2026) commenced on 31 July 2026, establishing the AI Office of Ireland, a single point of contact function, an AI regulatory sandbox and a domestic enforcement/penalty regime.

Section 46 of the Regulation of Artificial Intelligence Act 2026 empowers the AI Office of Ireland to establish AI regulatory sandboxes, with Data Protection Commission involvement required where personal data is processed.

Sections 59-60 of the Regulation of Artificial Intelligence Act 2026 establish a real-world testing regime for high-risk AI systems outside the sandbox, subject to market surveillance authority permission.

Sections 48-50 of Ireland's Regulation of Artificial Intelligence Act 2026 let providers of high-risk AI systems apply to test them in real-world conditions outside a sandbox, under AI Act Article 60.

Ireland's AI Office must establish an AI regulatory sandbox, with its operational deadline deferred from 2 August 2026 to 2 August 2027 by the EU Digital Omnibus on AI.

Ireland's AI Act allows personal data collected for other purposes to be processed in an AI sandbox for AI development/training/testing, with DPC involvement where personal data is processed.

As of October 2026 the AI Office's sandbox programme remained under development with no sandbox cohort yet announced.