AI Act · Ireland
EU AI Act enforcement in Ireland
Ireland designated its authorities four days before the deadline. Fifteen bodies, an AI Office arriving August 2026, and High Court confirmation before any fine.
Most of this series is about member states that missed a deadline. Ireland is the page about one that did not.
Article 70 required every member state to designate its national competent authorities by 2 August 2025. Ireland signed S.I. No. 366 of 2025 on 29 July 2025 — four days early, and one of only nine member states to complete the step at all.
It managed it by declining to build anything. Rather than wait for primary legislation and a new regulator, the instrument designated bodies that were already supervising their sectors. Ten at first; five more added on 16 September 2025, bringing the total to fifteen.
The fifteen
| Designated 29 July 2025 — S.I. 366/2025 | Added 16 September 2025 |
|---|---|
| Central Bank of Ireland | Coimisiún na Meán |
| Data Protection Commission | Commission for Regulation of Utilities |
| Health and Safety Authority | Health Service Executive |
| Health Products Regulatory Authority | National Transport Authority |
| Marine Survey Office | Workplace Relations Commission |
| Competition and Consumer Protection Commission | |
| Commission for Communications Regulation (ComReg) | |
| Commission for Railway Regulation | |
| Minister for Enterprise, Tourism and Employment | |
| Minister for Transport |
The Minister for Enterprise, Tourism and Employment is the single point of contact, a role that passes to the AI Office once it exists.
What early actually buys you
Designation is a procedural step, and it is tempting to read Ireland's speed as a compliance advantage. It is better understood as a different sequencing risk.
A state that designates first and legislates second has named the supervisors before settling what they may do. Ireland's enforcement architecture — the AI Office, the penalty tiers, the adjudication route — arrived in a General Scheme published in February 2026, seven months after the bodies themselves. States that legislated first will arrive with both at once, later.
The practical consequence for a deployer is that in Ireland you can identify your supervisor now, and the powers it will use are still in a bill.
The AI Office of Ireland
The General Scheme establishes Oifig Intleachta Shaorga na hÉireann as an independent statutory body under the Department of Enterprise, Tourism and Employment, intended to be operational by 1 August 2026, run by a chief executive and a seven-member board appointed by the Minister.
Three functions matter to a deployer:
- Single point of contact with the Commission and other member states.
- Coordination of the fifteen, so that the same system is not read two ways by two regulators.
- Residual enforcement — it enforces where no sectoral regulator has jurisdiction.
The residual clause is the part worth noticing. A distributed model's characteristic failure is the gap: a use case that falls between sectors and belongs to nobody. Ireland closed it by naming a body that catches whatever the fifteen do not. The Netherlands, which distributes across eight authorities with two coordinators, has no equivalent backstop. If you operate in both, that difference decides who you write to about an unusual system.
The Office is also to run a national AI regulatory sandbox and to promote AI adoption and literacy — a development remit alongside the supervisory one, which is not how Germany or France framed their bodies.
Powers, penalties, and a judge
Market surveillance authorities may demand the documents evidencing compliance, carry out unannounced inspections, open investigations on their own initiative, and require formal evaluation of a system they believe is miscategorised.
They may also require access to source code — but only as a last resort, once testing and auditing based on the documentation the provider supplied have been exhausted or shown to be insufficient. That sequencing is worth reading closely: the quality of your documentation is what determines whether the question of source code ever arises.
| Breach | Ceiling |
|---|---|
| Prohibited practices (Article 5) | €35m or 7% of global annual turnover, whichever is higher |
| Other operator or notified-body breaches | €15m or 3% |
| Supplying false or misleading information | €7.5m or 1% |
| Public-sector bodies | €1m |
And then the feature no other country in this series has. Under the General Scheme, formal cases are heard by independent adjudicators, and a penalty requires confirmation by the High Court before it takes effect. A regulator's decision is not self-executing. That slows enforcement and it raises the evidential bar the regulator has to clear — which cuts both ways, because it also means the record you produce is read by a court rather than only by an inspector.
Workplace AI: a third answer
The Workplace Relations Commission publishes its own account of its role, and it is narrower than the designation list implies. The WRC describes itself as a market surveillance authority for certain prohibited AI practices in the workplace, naming systems that infer the emotions of workers or job applicants, outside the limited circumstances the Act permits.
That is the prohibited-practice layer, not the whole of high-risk recruitment. A deployer screening candidates in Ireland should not assume the WRC is the only body it will meet, and the Data Protection Commission remains designated for fundamental-rights protection in personal data.
Three states, three institutional answers to the same question. Workplace AI is supervised by the data protection authority in France, the data protection authority in the Netherlands, and an employment-relations body in Ireland. Same Regulation, same Annex III category, three different kinds of regulator with three different habits of mind. A multinational running one hiring system across all three is answering to a privacy lawyer, a privacy lawyer and an employment adjudicator.
Where Ireland stands
| Item | Position |
|---|---|
| Article 70 designation | Complete — S.I. No. 366 of 2025, 29 July 2025 |
| Designated bodies | Fifteen, sectorally distributed |
| Single point of contact | Minister for Enterprise, Tourism and Employment; passing to the AI Office |
| Primary legislation | General Scheme of the Regulation of Artificial Intelligence Bill, February 2026 |
| AI Office operational | Intended 1 August 2026 |
| Adjudication | Independent adjudicators; High Court confirmation before a penalty takes effect |
| High-risk obligations apply | 2 December 2027 (stand-alone) · 2 August 2028 (embedded) |
| Prohibitions in force since | 2 February 2025 |
What an Irish deployer should do now
- Name your regulator from the list of fifteen, not from a tracker. Financial services reaches the Central Bank, medical devices the HPRA, media the Coimisiún, utilities the CRU. If nothing on the list fits your use case, that is the AI Office's residual jurisdiction — which is an answer, not a gap.
- Treat documentation as the thing that keeps source code out of scope. The power exists but is sequenced last, after documentation-based auditing has failed. Thorough technical documentation is a commercial protection, not only a compliance artefact.
- Write for a court, not an inspector. Because a penalty needs High Court confirmation, your evidence will be read judicially. Records assembled to satisfy a checklist read differently from records assembled to survive cross-examination.
- Start the six-month log retention now. Article 26 requires deployers to keep system logs for at least six months. Logs not kept cannot be recreated, so the system needs to be running correctly by roughly mid-2027 to have a compliant record on day one.
- If Dublin is your EU entity, do not generalise from it. Ireland's allocation is not the European norm. A group policy written from the Irish position will misroute in Paris, Berlin and Amsterdam.
Questions
Who enforces the EU AI Act in Ireland?
Fifteen designated bodies, each inside its existing sector. Ten were named by S.I. No. 366 of 2025 on 29 July 2025 and five more were added on 16 September 2025. The Minister for Enterprise, Tourism and Employment is the single point of contact until the AI Office of Ireland takes over that role.
Is Ireland ahead of other member states?
On the procedural step, yes. Ireland designated its authorities on 29 July 2025, four days before the Article 70 deadline of 2 August 2025 — one of only nine member states to complete it at all, and it did so by statutory instrument naming regulators that already existed rather than waiting for primary legislation. Germany, France and the Netherlands were all still in draft more than a year after the deadline.
What is the AI Office of Ireland?
A new independent statutory body under the Department of Enterprise, Tourism and Employment, provided for in the General Scheme of the Regulation of Artificial Intelligence Bill published in February 2026 and intended to be operational by 1 August 2026. It runs under a chief executive and a seven-member board. Its three core functions are to act as single point of contact with the Commission, to coordinate the sectoral regulators, and to enforce where no sectoral regulator has jurisdiction.
We use AI in hiring in Ireland. Who supervises us?
The Workplace Relations Commission is a designated market surveillance authority for certain prohibited AI practices in the workplace, and it names emotion inference in workers and job applicants specifically. Its published scope is the prohibited-practice layer rather than the whole of high-risk recruitment, so a deployer should not assume the WRC is the only body it will meet. This is a different allocation from France, where the CNIL holds employment, and the Netherlands, where the AP does.
What can an Irish regulator actually do?
Demand the documents that evidence compliance, conduct unannounced inspections, open its own investigations, and — as a last resort, once testing and auditing on supplied documentation have been exhausted — require access to source code. Fines follow the Act's tiers, up to €35m or 7% of global turnover for prohibited practices, with a €1m ceiling for public-sector bodies. Under the General Scheme, cases are heard by independent adjudicators and a penalty requires High Court confirmation before it takes effect.
Related
Agent Trust Cloud
We publish this because the deployer side of the AI Act is widely misread, and Ireland is misread in a particular direction — as the settled jurisdiction, when what is settled is the list of names rather than the powers. Agent Trust Cloud is building a control plane for AI agents — identity, policy, evidence. The platform is in development and is not sold as a subscription today; what is available now is a fixed-scope assessment of the agents and machine identities you already have.