The EU AI Act, explained for Irish businesses
If your team uses ChatGPT, Copilot, or AI features in software you already pay for, this law applies to you. We wrote this guide so you know what it asks of you, and what it does not. That way, nobody can sell you something you do not need.
What this means for your business
The EU AI Act is a European law about how AI is built and used, and it already applies in Ireland. It sorts AI by how much harm it could do, so most everyday use has just one rule attached.
Even a business whose staff only use ChatGPT to write adverts is covered. That is the European Commission's own example.
Applies to every business using AI
Train your team on the AI they use
This is the one part of the Act that applies to everyone, whatever your size or sector, and it has applied since February 2025. It asks you to help your staff understand the tools they use and the risks, like the AI making things up, or client data going where it should not. It is called AI literacy.
- It applies whether you have two staff or two hundred
- Training should fit each person's role and the tools they use, with a record kept of who was trained and when
- The Act does not mention an AI policy, but we would recommend one. It shows you have done this, and it is often the first thing a client or insurer asks to see
Some businesses
Tell people when it is AI
If customers talk to a chatbot of yours, or you publish deepfakes, there are rules about telling people. They started in August 2026.
- A chatbot should make clear it is a bot. That is usually your supplier's job, not yours
- Deepfakes you publish should carry a label. A deepfake is AI-made video, audio or images of real people, places or events that could pass as real
- Normal marketing copy written with AI help does not need a label
Very few small businesses
Extra rules for high risk uses
A set list of uses has extra rules from December 2027. If you use one, you will need a person overseeing it, records kept, and the people affected told.
- Software that screens, ranks or scores job applicants or staff
- Credit scoring of individuals, or life and health insurance pricing
- Few small businesses use these, but it is worth checking
What needs to be done
These five steps cover what most small businesses need.
Build an AI register
A list of every way AI is used in your business, not just the obvious ones. Include:
- Chat tools like ChatGPT, Copilot, Gemini or Claude
- AI built into email, like Copilot in Outlook or Gemini in Gmail
- AI in documents and design tools, like Word, Google Docs or Canva
- AI assistants inside your other software, like your CRM, accounts, HR or booking system
- Meeting notetakers and transcription tools
- Browser add-ons and phone apps with AI features
- Any chatbot on your website
For each one, note who uses it, what for, and whether it is a work or personal account. Watch for notetakers recording calls without asking, hiring software that ranks candidates, and mood or engagement scoring hidden inside another tool.
Write an AI policy
Set out what should never go into these tools, such as client data, staff data and anything confidential. Say which tools staff can use, and for what. Have it signed off and shared with everyone.
Organise AI training for your team
Train everyone who uses AI on the tools they use: what they are good at, how they go wrong, and what should never go into them. Keep a record of the date, who attended and what was covered.
Check anything customers see
Does your chatbot say it is a bot? Does a person read AI-written content before it goes out? Are you publishing deepfakes anywhere?
Name an owner and review it regularly
Pick one person to own your register, policy and training, and review them every six months. The tools change quickly, and so do the rules.
The GDPR link most people miss
For most small businesses, the bigger AI risk today is not the AI Act. It is GDPR, and it already applies.
- When staff paste client or staff details into an AI tool, that is personal data, and your business is responsible for it.
- Free and personal accounts usually come without a business data agreement, and some use what you type to improve their models.
- Software that makes decisions about people on its own, like rejecting job applicants, already falls under GDPR rules. That protection does not wait for December 2027.
The five steps above deal with both. Knowing your tools, a policy on what goes into them, and trained staff cover the AI Act and much of the GDPR risk at the same time.
Where to start
With the AI register. Every other step depends on it. In our experience, the tools managers think are in use and the tools staff use are never the same list.
Where does your business stand?
A few plain questions, about five minutes. Nothing to look up, and “not sure” is a fine answer. Questions that cannot apply to you are skipped.
What does your business do?
The four levels, and when they start
The law puts AI uses into four groups, by how much harm they could do. The wider the band, the more businesses are in it.
Banned
Since February 2025
A short list of uses. For example, scoring people on their behaviour and treating them unfairly because of it. Or software that reads emotions from faces or voices at work or in school.
High risk
From December 2027
A set list of uses that can change someone's life. Hiring and managing staff, credit scores for individuals, life and health insurance prices, and decisions in education.
Tell people
Since August 2026
Letting people know when they are talking to a chatbot, or looking at a deepfake.
Low risk
No extra rules
Almost everything else, like using ChatGPT to draft an email or Copilot to tidy a spreadsheet. Only the training rule applies.
Most Irish small businesses are in the bottom two.
Regulators have been able to check since August 2026. AI built into products that already have safety rules, like toys, lifts and medical devices, follows in August 2028.
The realistic risk
It is not an inspector at the door. More likely, it is a customer complaint, a questionnaire from a bigger client, or an insurer at renewal. Something goes wrong, and the first question is what guidance your team had.
In Ireland, 15 existing regulators check the Act, each in its own area, such as the Data Protection Commission and the Workplace Relations Commission. A national AI Office, set up on 31 July 2026, coordinates them.
For the rules on telling people, a regulator can send a notice saying what to fix and by when, which you can appeal. A fine needs a decision by an independent adjudicator, confirmed by the High Court. For a small or medium business, the maximum is the lower of the two figures in the law, not the higher.
The training rule has no fine attached under the Irish Act. It still applies, and it is often the first thing a client or insurer asks about. GDPR also still applies to any personal data you put into AI tools.
Where we can help
You can do these steps yourself. We help when you want them done properly and done once, by someone who knows what to look for.
Discovery
We find out which AI tools your team uses day to day. What managers think and what staff use are rarely the same.
Policy
A written AI policy that fits your business and covers the GDPR side, with a named owner and a review date. Not a template.
Training
So your team understands the tools and the risks, at the level their job needs, with a record that it happened. That is the AI literacy rule, done properly.
Systems
Where the tools themselves need fixing. If a fifteen minute change is all you need, we will say so.
Rather talk it through?
Thirty minutes, no obligation, and you will leave knowing where you stand.
Start a conversationPractical guidance, not legal advice. Checked against the law as it stood in October 2026.