Most Irish small business owners I talk to treat EU AI Act compliance as something for Google and Meta to worry about. They’re half right. The heaviest obligations do fall on the companies that build AI. But if anyone on your team uses ChatGPT, Copilot or Claude for work, the Act calls you a deployer, and deployers have duties too.
This guide sets out where things stand at the end of October 2026: what’s already in force, what changed when the EU amended the Act in July, what Ireland’s own AI law adds, and the short list of things a small business should do this quarter.
Why the EU AI Act matters now
The Act has been law since 1 August 2024, and its obligations have been arriving in stages ever since. Two things happened this summer that make it harder to put off.
First, Ireland passed its own legislation. The Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026. It creates the AI Office of Ireland as the central co-ordinating body and gives existing regulators, including the Data Protection Commission and the Central Bank, the job of supervising AI in their own sectors. There’s now an Irish enforcement structure with powers to take complaints, investigate and sanction.
Second, the EU moved the goalposts. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, came into force on 27 July 2026. It pushed the biggest high-risk deadlines back by over a year and rewrote the AI literacy duty. A lot of what you’ll find online was written before that, so check the date on anything you rely on. Including this.
Treat the extra time as runway. The businesses that use it will have a calm 2027.
What the act actually regulates
The Act regulates AI systems according to what they’re used for. The same model can be harmless in one job and high-risk in another. A chatbot drafting your newsletter and the same chatbot ranking job applicants are treated very differently.
It also splits responsibility by role:
- Providers build an AI system or put it on the market under their own name. OpenAI, Microsoft, Google, Anthropic, and any software company selling a product with AI built in.
- Deployers use an AI system in the course of their work. That’s almost certainly you.
Deployer duties are lighter, but they get heavier quickly if you use AI in a high-risk area. And the roles can shift. If you put your own name on a high-risk AI system, or make a substantial change to one, the Act can treat you as its provider.
The risk classification system
There are 4 tiers. Most small business use sits in the bottom two.
Prohibited practices
These have been banned since 2 February 2025. The list includes social scoring, AI that manipulates people or exploits their vulnerabilities in harmful ways, scraping facial images from the internet to build recognition databases, and using biometrics to infer things like race, political views or sexual orientation. It also bans emotion recognition in the workplace and in education, apart from medical or safety reasons. From 2 December 2026 the Omnibus adds a ban on using AI to generate non-consensual intimate imagery or child sexual abuse material.
The one most likely to catch an ordinary business out is emotion recognition at work. If a call analytics product offers to score your staff’s mood or stress from their voice or their face, ask hard questions before anyone switches it on.
High-risk systems
Annex III of the Act lists the high-risk uses. They include recruitment and decisions about employees, access to education, credit scoring of individuals, pricing life and health insurance, access to essential services, and areas like biometrics, critical infrastructure and law enforcement. Separately, Annex I covers AI that acts as a safety component in products that are already regulated, such as machinery and medical devices.
For most SMEs the realistic exposure is hiring. A tool that filters or ranks CVs is a high-risk system, and the business using it is a deployer of one. That means using it according to the provider’s instructions, giving a competent person the job of human oversight, monitoring it and reporting serious incidents, keeping its logs for at least 6 months, and telling staff before you use it in the workplace.
Under the Omnibus, those Annex III obligations now apply from 2 December 2027.
Limited risk
This is where the transparency rules live: chatbots, deepfakes and generated content. More on those below.
Minimal risk
Spam filters, autocomplete, and most everyday productivity use. There are no specific obligations here beyond AI literacy. The bulk of what your team does with AI, drafting emails and summarising documents, sits in this tier as long as it isn’t feeding into decisions about people.
Transparency obligations
Article 50 applies from 2 August 2026. For deployers it comes down to telling people when AI is involved:
- Deepfakes. If you use AI to create or alter images, audio or video that look like real people, places or events, you have to disclose that it’s artificial. There’s a lighter touch for work that’s obviously creative or satirical.
- Published text. If you publish AI-generated text to inform the public about matters of public interest, you have to disclose it, unless a person has reviewed it and someone takes editorial responsibility.
- Emotion recognition and biometric categorisation. Where these are lawful at all, the people exposed to them have to be told.
Chatbots are covered from the provider’s side: a system that talks to people has to be designed so they know it’s an AI. If you’ve built your own website chatbot on top of an AI model’s API, that provider may well be you. Either way, a single line in the chat window (“You’re chatting with an AI assistant”) costs nothing.
Providers of generative AI also have to mark their output in a machine-readable way. Systems already on the market before 2 August 2026 have until 2 December 2026 to comply. That one’s for the big vendors, but it’s why you’ll start seeing more content credentials on AI images.
Timeline: what is already in force
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | Prohibited practices banned. AI literacy duty (Article 4) applies |
| 2 August 2025 | Rules for general-purpose AI models, governance and the penalties regime |
| 21 July 2026 | Ireland’s Regulation of Artificial Intelligence Act 2026 signed into law |
| 27 July 2026 | Digital Omnibus in force. Article 4 rewritten |
| 2 August 2026 | Transparency obligations (Article 50) and most remaining provisions |
| 2 December 2026 | New ban on AI-generated intimate imagery and CSAM. Marking deadline for existing generative systems |
| 2 December 2027 | High-risk obligations for Annex III systems such as recruitment and credit scoring |
| 2 August 2028 | High-risk obligations for AI in products covered by Annex I |
The AI literacy change deserves a sentence of its own, because it applies to every business that uses AI, whatever its size. The original wording said you had to ensure a sufficient level of AI literacy among staff. The amended Article 4 says you must take measures to support the development of AI literacy, and that you aren’t required to guarantee any particular level for any individual. Softer, but still a duty. You need to be able to show what you did.
What Irish SMEs need to do right now
None of this needs a big programme. It needs a few hours of honest work.
- List the AI you use. Every tool and every account, including the free ones people signed up for themselves. You can’t classify what you can’t see. The simple AI tool register in our shadow AI article is a good place to start.
- Check the list against the bans. For most businesses this takes ten minutes. Look hardest at anything that monitors staff or profiles individuals.
- Flag anything that touches decisions about people. Hiring, performance reviews, credit, insurance. Those are your high-risk candidates. Use the time before December 2027 to get the provider’s instructions for use and to decide who will provide human oversight.
- Put AI literacy measures in place and write them down. Training that fits each role, a one-page AI policy, and a record of who did what and when. Our AI training for teams is built around exactly this.
- Close your transparency gaps. Chatbot disclosure, labels on synthetic images and video, and a rule that a named person signs off anything published under your name.
- Remember GDPR never went away. If personal data goes into an AI tool, data protection law applies in full, and the Data Protection Commission has an AI supervisory role under the Irish Act.
The cost of getting this wrong
The headline fines are large. Using a prohibited practice can cost up to €35 million or 7% of worldwide turnover. Breaching most other obligations, including deployer and transparency duties, can cost up to €15 million or 3%. Giving regulators misleading information can cost up to €7.5 million or 1%. For SMEs the cap is whichever figure is lower, and Article 99 requires authorities to take a small business’s viability into account.
Let’s be clear about the realistic risk, though. A 20-person firm in Galway is unlikely to be the AI Office’s first big case. The more likely problems are smaller and more irritating: a complaint from a rejected job candidate who suspects an algorithm binned their CV, a data protection query because client details went into a free chatbot, or a client questionnaire asking how you govern AI that nobody can answer.
The cost of a basic compliance position is a few hours, a short policy and some training. The cost of not having one shows up at the worst possible moment.
If you’d like a structured view of where your business stands, you can request our free AI Readiness Scorecard for a review of the governance questions above. If you’d rather talk it through, our AI readiness and planning service starts with a free 30-minute consultation.
Current as of 28 October 2026. This article is general information about the EU AI Act and Irish law. It isn’t legal advice, so talk to a solicitor about your specific situation.