Does the EU AI Act apply to your business?
Answer a few questions about how your business uses AI and get a clear list of which EU AI Act and GDPR duties apply to you, with the dates that matter and what to do about each one. Built for Irish businesses that use AI tools someone else made.
Takes about 3 minutes. Your answers stay in your browser.
What the AI Act Means for Irish Businesses
The EU AI Act is the European Union’s rulebook for artificial intelligence. It applies in Ireland as it does in every member state, and it covers businesses that use AI, not only the companies that build it. The Act calls a business that uses an AI tool a deployer, and the company that built it a provider. Most Irish businesses are deployers: they use ChatGPT, a website chatbot, an AI scheduling tool or a CV screener that someone else made.
The rules are tiered by risk. A small number of uses are banned outright, such as reading staff emotions at work. A longer list is called high-risk, including AI in hiring, credit and education, and comes with duties like human oversight and record keeping. Most day-to-day uses sit in the lowest tier, where the main duty is to support your team’s AI literacy. On top of all this, GDPR already applies the moment personal data goes into an AI tool, and that is where most Irish businesses have work to do today.
The checker above walks through these tiers for your situation. It is a rules-based tool, so the same answers always give the same result, and every card links to the article it comes from. It is general guidance, not legal advice.
Key Dates
Last reviewed 23 October 2026. Confirm against the official texts linked at the end of this page.
| Date | What applies | Who |
|---|---|---|
| 2 Feb 2025 | Banned practices, including emotion recognition at work or in education and inferring sensitive traits from biometrics. The AI literacy duty. | Providers and deployers |
| 27 Jul 2026 | Digital Omnibus on AI in force. The AI literacy duty now asks for measures to support staff, with no guaranteed level for any individual. | Providers and deployers |
| 2 Aug 2026 | Transparency rules. Chatbot disclosure and content marking fall on providers. Labels on realistic AI media and public-interest text, and notices for emotion recognition or biometric sorting, fall on deployers. | Both |
| 2 Dec 2026 | Machine-readable marking deadline for generative AI already on the market before August 2026. New bans on AI that generates non-consensual intimate images or child sexual abuse material. | Providers |
| 2 Dec 2027 | High-risk rules for listed uses: hiring and staff management, education, credit, insurance, essential services, biometrics. | Both |
| 2 Aug 2028 | High-risk rules for AI built into regulated products such as medical devices. | Mainly providers |
Chatbots and the AI Act
If your website or phone line uses an AI assistant, people must be told they are dealing with AI at the start of the conversation. The Act places this duty on the provider, so if you bought a chatbot off the shelf, your vendor should have built the disclosure in. If the bot was built for you and runs under your name, the duty may fall to you. Either way, a clear first line such as “You’re chatting with our AI assistant” costs nothing and settles the question.
Using ChatGPT with Customer Data
Staff pasting customer names, emails, CVs or health details into an AI assistant is a GDPR matter before it is an AI Act matter. You need a lawful basis for the processing, a data processing agreement with the AI provider, and a privacy notice that mentions the tool. Free and personal accounts usually come without a data processing agreement and may use your inputs to train the model. The fix is to move work use onto business plans, switch off training on your data, and write a short policy that says which tools are allowed and what can go into them.
AI in Hiring and Staff Management
CV screening, candidate ranking, interview analysis and tools that rate staff or assign work are all listed as high-risk under the AI Act. The high-risk duties for deployers start on 2 December 2027: human oversight, monitoring, keeping logs, and informing workers before the system is used. GDPR applies already. People have the right not to be subject to a decision made solely by a machine where it significantly affects them, and the right to ask for a human to review it. If AI is making or shaping decisions about people in your business, put a person in the loop now and tell candidates and staff that AI is involved.
Who Enforces It in Ireland
The Regulation of Artificial Intelligence Act 2026 was signed into Irish law on 21 July 2026 and sets up national supervision and enforcement of the EU AI Act. The AI Office of Ireland was established on 30 July 2026 as the central coordinating authority and single point of contact, with existing sector regulators acting as competent authorities in their own areas. GDPR questions go to the Data Protection Commission as before. Fines under the AI Act can reach €15m or 3% of worldwide turnover for transparency breaches, and €35m or 7% for banned practices, with smaller companies facing the lower of the two figures.
Common Questions
Does the EU AI Act apply to my business?
Yes, if you use AI at all. The Act applies to businesses that use AI tools, not only the companies that build them, and it does not depend on company size. What changes with your situation is which duties apply, from the light AI literacy duty up to the high-risk rules.
Do I need to tell customers my chatbot is AI?
Yes. People must be told they are talking to AI at the start of the conversation. The duty sits with the provider of the chatbot, which may be you if it runs under your name, so check with your vendor and add a clear first line either way.
Can staff use ChatGPT with customer data?
Only with the right setup. Personal data in an AI tool is covered by GDPR, so you need a business plan with a data processing agreement, training on your data switched off, and a privacy notice that mentions the tool. Free and personal accounts are not suitable for customer data.
Is AI CV screening allowed?
Yes, with conditions. AI in hiring is listed as high-risk, with deployer duties from 2 December 2027. GDPR applies now: a person must review decisions that significantly affect candidates, and candidates must be told that AI is involved.
When do the high-risk rules start?
On 2 December 2027 for the listed uses such as hiring, credit, education and biometrics. AI built into regulated products such as medical devices follows on 2 August 2028. Businesses using these tools should start preparing now rather than waiting for the date.
Who enforces the AI Act in Ireland?
The AI Office of Ireland, established on 30 July 2026, coordinates enforcement, with existing sector regulators acting as competent authorities. The Data Protection Commission continues to handle GDPR, which covers most questions about personal data in AI tools.
Is a fingerprint clock-in covered?
Not as high-risk under the AI Act, because it only confirms someone is who they say they are. It is covered by GDPR, where fingerprints and face scans count as special category data. Check the system is necessary, offer staff an alternative, and do a data protection impact assessment.
Do staff need AI training?
Businesses using AI must take measures to support their staff’s AI literacy. Since the July 2026 amendment there is no set level or certificate required, so a short written policy and a practical session for the people who use AI most is a sound way to meet it.
Official Texts
Want help acting on your result?
Our AI audit maps how your business uses AI and tells you what to fix first. Our training sessions cover the AI literacy duty. Or send us your result and we will tell you what we think.