Ireland - AI Use Guidelines (2024)

Overview

The Interim Guidelines for Use of AI (published 9 January 2024) served as an interim framework created to guide Irish public service organisations in the responsible, secure, and ethical adoption of Artificial Intelligence. In May 2025, the Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation issued full permanent guidance titled Guidelines for the Responsible Use of Artificial Intelligence in the Public Service, which superseded this interim instrument.

Definitions

The Guidelines define key terms for the Public Service context: 'AI' broadly as systems that display intelligent behaviour by analysing environment and taking actions; 'Generative AI' as models able to create text, images, audio or code (e.g., large language models, multimodal systems); 'enterprise/controlled deployment' as a provider configuration that limits data exposure and supports contractual safeguards; 'risk assessment' as a documented evaluation of harms and mitigations including DPIA where personal data is involved; and 'safe space/sandbox' as a controlled environment for experimentation. The document adopts the EU/EC High‑Level Expert Group conceptual framing for trustworthy AI and ties these definitions to operational checklists for procurement, data governance and human oversight. (gov.ie)

Governance and Institutional Framework

The Guidelines set expectations for governance at both organisational and central levels. Public bodies must allocate clear senior ownership for AI initiatives, integrate AI risk review into existing corporate and ICT governance structures, and engage central supports such as the Office of the Government Chief Information Officer (OGCIO) and the Department of Public Expenditure, NDP Delivery and Reform. Where cyber risks arise, the National Cyber Security Centre is identified as the technical reference point for security practice. The Guidelines encourage the establishment of multi‑disciplinary review panels for higher‑risk use cases (including legal, data protection, equality and security input) and the maintenance of registers documenting AI systems, use cases, risk ratings and mitigation plans. The document also recommends that public bodies adopt an internal approval process for any AI project, combining an approved business case, risk assessment, procurement security checks and an implementation plan that preserves human oversight and traceability. These governance expectations are deliberately flexible to fit departmental structures while ensuring central visibility and coordination. (gov.ie)

Key Focus Areas

The Guidelines prioritise several operational focus areas. First, risk assessment: before any deployment, bodies must assess risks to fundamental rights, privacy, safety and security; where personal data is processed, a Data Protection Impact Assessment is recommended. Second, human oversight: AI must not replace human decision‑makers where outcomes materially affect citizens’ rights; a human in the loop or on the loop is required for significant decisions. Third, data governance and privacy: data minimisation, purpose limitation, secure transfer and retention policies must be applied; the Guidelines stress avoiding inputting sensitive or classified information into public LLMs. Fourth, transparency and explainability: public bodies should record system purpose, limitations and provide intelligible explanations where decisions affect individuals. Fifth, cybersecurity and supplier risk: procurement processes must evaluate provider security, data handling, model training and vulnerability management, and favour enterprise or self‑hosted solutions where possible. Sixth, fairness and non‑discrimination: datasets and models must be evaluated for bias and protected‑class disparate impact, with remediation steps documented. Seventh, environment and societal impact: public bodies should consider wider societal and environmental consequences of AI systems and avoid deployments that increase harms. Finally, accountability and documentation: maintain auditable records of design choices, data sources, model versions and human oversight arrangements to support accountability and redress. The Guidelines encourage controlled experimentation in 'safe spaces' to advance learning while managing risk. (gov.ie)

Implementation Framework

Implementation is presented as a stepwise, proportionate approach: identify use case and business need; classify risk and determine whether the use is low, medium or high risk; conduct DPIA and AI risk assessment where required; develop procurement and contracting terms that address data, IP and security; deploy in a controlled manner with monitoring and human oversight; and maintain documentation for audit and review. The Guidelines advise that public bodies should not use public/free consumer GenAI models for business purposes and should restrict account creation using corporate emails unless an enterprise offering with contractual assurances is in place. Procurement checks should require providers to disclose training data provenance, capability statements, and security certifications. Training and change management for staff are treated as essential, including clear 'Do and Don't' guidance aligned with the NCSC's cyber guidance (e.g., 'Do not input sensitive or secret data into public GenAI models'). (gov.ie)

Monitoring and Evaluation

Public bodies are required to monitor deployed AI systems continuously for performance drift, bias, security incidents and unintended outcomes. The Guidelines recommend periodic reviews aligned with risk levels, incident logging, and escalation procedures to senior governance. Monitoring includes technical checks (accuracy, robustness, adversarial resilience), human oversight effectiveness, and privacy controls. The Department encourages the creation of central registers to track AI use cases and outcomes to permit aggregate learning across the Public Service and to feed into national reporting and regulatory alignment exercises. Lessons learned from pilots and sandboxes should be shared across departments to accelerate learning while preserving confidentiality and security. (gov.ie)

Penalties, Liability, and Appeals

As interim guidance, the document itself does not create new criminal sanctions; enforcement rests with departmental governance, contractual remedies and existing regulatory regimes. Non‑compliance can trigger internal disciplinary measures, procurement contract sanctions, and exposure under data protection law. The Guidelines explicitly reference GDPR obligations and the Data Protection Commission as the regulator for personal data matters; consequently, significant data protection breaches could lead to statutory fines or corrective orders under existing law. The EU AI Act (as it becomes applicable) will introduce additional compliance obligations and potential sanctions for certain high‑risk systems; the Interim Guidelines are intended to help public bodies prepare for those requirements. The document also emphasises the need for clear complaint and redress pathways for affected individuals. (gov.ie)

Relationship to Other Instruments

The Guidelines are explicitly cross‑referenced with several instruments: Ireland's National AI Strategy (“AI – Here for Good”), the National Cyber Security Centre's guidance on Generative AI (June 2023), central procurement rules and the Cyber Security Baseline Standards, and EU instruments such as the European Commission’s Ethics Guidelines for Trustworthy AI and the EU AI Act. They are positioned as interim operational guidance to complement these instruments, helping public bodies bridge between high‑level principles and forthcoming practice‑orientated government guidance and legal obligations. The document also aligns with GDPR obligations and national procurement law, and it points to forthcoming sectoral guidance where required (e.g., health, social protection). (gov.ie)

International Alignment

The Guidelines draw on EU high‑level ethics principles and are designed to align with the EU AI Act's risk‑based approach. They reference international technical and security best practice (via the NCSC) and encourage procurement and contractual requirements consistent with international standards for cybersecurity and privacy. The document supports interoperability of public sector approaches across EU Member States by adopting the seven requirements for trustworthy AI from EC‑level guidance and by preparing public bodies to meet the EU AI Act’s obligations for high‑risk systems, including potential registration or conformity assessment steps required of some providers. The Guidelines also reflect an intent to coordinate with international cybersecurity and standards communities on AI‑specific security measures. (gov.ie)

Implementation Timeline

Government approval and publication of the interim guidance occurred on 2024-01-09. Departments adopted interim policies throughout 2024. On 2025-05-08, the Government published the permanent Guidelines for the Responsible Use of Artificial Intelligence in the Public Service, replacing the interim framework.

Sources and References