Ireland AI Regulation Overview

Overview

Ireland's approach to artificial intelligence regulation has transitioned from high-level strategic policy to a binding statutory implementation model centered on the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689). The foundational framework was established through the national strategy, AI – Here for Good (2021, refreshed in 2024), which articulated a human-centric approach prioritizing public trust, enterprise adoption, and ethical governance. This strategic orientation provided the baseline for public service policy and regulatory preparations across state bodies.

The domestic legal framework was formalized through the enactment of the Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026), which was signed into law on 21 July 2026 and came into operation on 31 July 2026 under Statutory Instrument No. 403 of 2026. The Act serves as Ireland's primary statutory measure to operationalize the EU AI Act, establishing the institutional infrastructure, designating competent market surveillance authorities, and granting investigative and sanctioning powers to domestic enforcement bodies.

To support compliance and operational readiness prior to and alongside the 2026 Act, Irish administrative bodies issued detailed guidance instruments. These include the Department of Public Expenditure's Guidelines for the Responsible Use of AI in the Public Service (May 2025, which superseded the 2024 interim guidelines), the Data Protection Commission's (DPC) guidance on Large Language Models, and cyber security advisories from the National Cyber Security Centre (NCSC).

Regulatory Approach

Ireland employs a distributed regulatory model underpinned by central coordination. Rather than establishing a single standalone regulator for all AI operations, the State leverages the subject-matter expertise of existing sectoral market surveillance authorities and Union harmonisation bodies. This distributed model was approved by the Government in March 2025 and formally designated under Statutory Instrument No. 366/2025 (European Union (Artificial Intelligence) (Designation) Regulations 2025).

Central coordination across this network is maintained by Oifig IS na hÉireann (the AI Office of Ireland), an independent statutory body established under the 2026 Act. The AI Office acts as the national single point of contact for the European Commission and other EU Member States, while harmonizing enforcement actions, operating regulatory sandboxes, maintaining national AI registers, and publishing technical guidance for sectoral regulators.

The regulatory structure relies on a clear distinction between binding statutory mandates and non-binding ethical or operational guidance. Hard law obligations—including system risk classifications, conformity assessments, market prohibitions, and administrative fines—derive directly from the EU AI Act and the Regulation of Artificial Intelligence Act 2026. Soft law tools, such as the Public Service AI Guidelines, Decision Frameworks, and Responsible AI Canvases, govern internal administrative deployment and ethical risk management without imposing direct statutory penalties on private actors.

Key AI Legislation

• Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026): Ireland's primary statutory instrument implementing the EU AI Act. Enacted in July 2026, it establishes Oifig IS na hÉireann, outlines market surveillance powers, creates real-world testing and sandbox frameworks, and establishes national enforcement and fine structures.
• Statutory Instrument No. 366/2025 — European Union (Artificial Intelligence) (Designation) Regulations 2025: Signed on 25 July 2025, this instrument formally designated national competent authorities, notifying authorities, and named the Minister for Enterprise, Tourism and Employment as the national single point of contact pursuant to Article 70 of the EU AI Act.
• Guidelines for the Responsible Use of AI in the Public Service (2025): Non-binding framework published by the Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation establishing seven core principles, a Decision Framework, a Responsible AI Canvas, and mandatory safeguards for generative AI in government bodies.
• Data Protection Commission Guidance on AI and Large Language Models (2024): Guidance published on 18 July 2024 outlining GDPR compliance, data minimisation, lawful basis requirements, Data Protection Impact Assessments (DPIAs), and data subject rights throughout the AI model training and deployment lifecycle.
• AI – Here for Good: National Artificial Intelligence Strategy for Ireland (2021, refreshed 2024): The overarching policy roadmap setting out national objectives for enterprise adoption, research infrastructure, skills development, public trust, and digital transformation.

Governance & Enforcement Bodies

Oifig IS na hÉireann (the AI Office of Ireland) operates as the primary national coordinating authority under the oversight of a Chief Executive Officer and a seven-member board appointed by the Minister for Enterprise, Tourism and Employment. The AI Office is responsible for maintaining national registers of AI incidents and high-risk systems, facilitating inter-agency cooperation, operating regulatory sandboxes, and delivering technical support to sectoral market surveillance authorities.

Enforcement duties are divided among established sectoral regulators designated under S.I. No. 366/2025 and the Regulation of Artificial Intelligence Act 2026. Key competent authorities include the Data Protection Commission (DPC), Central Bank of Ireland, Competition and Consumer Protection Commission (CCPC), Commission for Communications Regulation (ComReg), Coimisiún na Meán, Health Products Regulatory Authority (HPRA), Health and Safety Authority (HSA), Commission for Railway Regulation (CRR), and Marine Survey Office (MSO).

These designated market surveillance authorities supervise AI deployment within their statutory domains. For instance, the Central Bank of Ireland oversees AI systems used in credit scoring and financial services under Article 74(6) of the EU AI Act, while the DPC oversees AI operations involving fundamental rights and personal data processing under Article 74(8).

Penalties & Enforcement

Enforcement mechanisms in Ireland derive from the administrative and investigative toolkit established by the Regulation of Artificial Intelligence Act 2026 in alignment with Article 99 of the EU AI Act. Designated market surveillance authorities are authorized to inspect physical and technical premises, request technical documentation, conduct audits, issue mandatory compliance notices, and order the prohibition, restriction, or recall of non-compliant AI systems from the market.

Administrative financial penalties for serious infringements—including the deployment of prohibited AI practices—can reach up to seven percent of an undertaking's total global annual turnover or EUR 35,000,000, whichever is higher, with scaled fine structures applied for lower-tier regulatory breaches. The Act also establishes formal complaints procedures and mechanisms for cross-border enforcement cooperation with European regulatory partners.

Data Protection Framework

Data protection considerations in AI design and deployment are governed by the General Data Protection Regulation (GDPR) and Ireland's Data Protection Act 2018, enforced by the Data Protection Commission (DPC). In July 2024, the DPC issued dedicated guidance clarifying that publicly accessible personal data remains fully protected under GDPR when individuals are identifiable, requiring AI developers and deployers to establish a lawful basis for training and operating large language models (LLMs).

The DPC framework requires mandatory Data Protection Impact Assessments (DPIAs) for high-risk processing, stringent data minimisation, prompt filtering, logging, and technical protections against model extraction or prompt-injection attacks. AI providers and deployers must establish effective mechanisms to facilitate data subject rights, including access, rectification, and erasure, even when data is embedded within trained model architectures. The corpus holds no record of national data localization requirements.

Sector-Specific Rules

In the public sector, AI adoption is governed by the Guidelines for the Responsible Use of AI in the Public Service (May 2025). Public bodies must conduct structured suitability assessments using the Decision Framework, complete a Responsible AI Canvas, maintain internal registers, and restrict the unmanaged deployment of free public generative AI services. Human oversight ("human in the loop") is mandatory for administrative decisions affecting citizen rights, while cyber security baselines are governed by National Cyber Security Centre (NCSC) guidance.

In high-risk commercial and industrial sectors, AI compliance is integrated into existing regulatory frameworks led by designated competent authorities. Market surveillance in financial services is managed by the Central Bank of Ireland, health products and medical AI by the HPRA, workplace safety AI by the HSA, communications technologies by ComReg, and transport infrastructure by the CRR and MSO.

International Alignment

Ireland's AI regulatory framework is directly tied to European Union law through the domestic execution of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). The Minister for Enterprise, Tourism and Employment serves as the single point of contact for international and EU-wide regulatory coordination, representing Ireland in communications with the European Commission and other Member States.

The national architecture supports international governance standards, including the OECD Principles for Responsible Stewardship of Trustworthy AI. Additionally, the Data Protection Commission participates in European Data Protection Board (EDPB) initiatives regarding cross-border AI data flows, supervising numerous multinational technology companies with EU headquarters in Ireland.

Future Developments

The implementation roadmap for the Regulation of Artificial Intelligence Act 2026 follows a structured, multi-year schedule aligned with EU timelines. Compulsory information-gathering powers for Oifig IS na hÉireann commence in December 2026. Standalone high-risk AI system obligations become enforceable in December 2027, followed by high-risk AI requirements for embedded products in August 2028.

To support industry adoption and technical compliance ahead of high-risk enforcement deadlines, Ireland is committed to establishing fully operational national AI regulatory sandboxes by August 2026. These sandboxes, managed alongside national AI hubs such as CeADAR, will offer controlled real-world testing environments for innovative AI applications, particularly for small and medium-sized enterprises (SMEs).

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Oifig IS na hÉireann (AI Office of Ireland)	Central coordinating authority and national single point of contact under the EU AI Act. Maintains national registers, operates sandboxes, and coordinates sectoral market surveillance authorities.	Compulsory information gathering, operation of regulatory sandboxes, provision of technical guidance, incident register maintenance.
Department of Enterprise, Trade and Employment (DETE) / Minister for Enterprise, Tourism and Employment	Lead coordinating government department for national AI policy and single point of contact under S.I. No. 366/2025.	Designation of competent authorities, appointment of AI Office board/CEO, Commission notifications.	https://enterprise.gov.ie/en/what-we-do/innovation-research-development/artificial-intelligence/eu-ai-act/
Data Protection Commission (DPC)	Supervisory authority for data protection under GDPR/Data Protection Act 2018 and market surveillance authority under Article 74(8) of the EU AI Act.	Premises inspections, documentation requests, audits, compliance notices, administrative fines under GDPR and AI Act.
Central Bank of Ireland	Designated market surveillance authority for AI deployment in financial services and credit assessment (Article 74(6) EU AI Act).	Sectoral supervision, audit of financial AI systems, compliance notices, administrative sanctions.
Competition and Consumer Protection Commission (CCPC)	Market surveillance authority for AI impacts on consumer protection and market competition.	System audits, documentation requests, market compliance notices, system prohibition/recall orders.
Health Products Regulatory Authority (HPRA)	Designated market surveillance authority for AI applications in medical devices and health products.	Audits of medical AI systems, pre/post-market oversight, prohibition or recall of non-compliant health AI products.