EU AI Act in Ireland: responsibilities

Abstract

Responsibility starts with the decision a system is allowed to influence. This paper examines the EU AI Act in Ireland for established service firms, from intended use to the evidence retained in operation. It addresses managing directors, managing partners and operations leaders.

The source base is the enacted Regulation, its July 2026 amendment and official institutional records. The amended timetable distinguishes provisions already applicable from later high-risk dates. Ireland has enacted national implementing legislation and established Oifig IS na hÉireann (the national AI office). ¹ ² ⁷ ⁸ ⁹

Seichō’s operating view is that each material use needs a named owner and a retrievable decision record. That record connects the legal assessment to the software people actually use. The paper reports no original survey or measured commercial results. Its leadership questions draw the companion service-firm checklist into the argument.

The decision before the software

The starting point is the work the business is authorising. A draft letter has a review point. A recruitment assessment affects a different decision. Seichō’s position is that each use deserves its own operating record, with the authority of the system defined in writing.

A useful record explains the intended outcome and identifies who accepts the result. It shows the information available to the reviewer and how work continues when the system stops. Those are Seichō’s design standards. The statutory assessment belongs beside that operating design, with its reasoning and date.

Sources, method and the status of simplification

This is a documentary practice paper. It compares Regulation (EU) 2024/1689 with Regulation (EU) 2026/1744 and the consolidated text dated 27 July 2026. The consolidation identifies itself as a documentation tool without legal effect. The authentic acts are the Official Journal texts. ¹ ² ³

The Digital Omnibus on AI is enacted legislation. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July. The Commission’s current implementation page states that it “entered into force on 27 July 2026”. Its original November 2025 proposal is no longer the operative timetable. ² ⁴

The amendment has a German-language corrigendum published on 29 September 2026. The Publications Office lists German as the available language for that document. ¹⁴

The separate Digital Omnibus proposal, COM(2025) 837, remains in the legislative process. Parliament’s procedure 2025/0360(COD) records its stage as “Awaiting committee decision” at this paper’s source check. This paper treats those proposed changes as proposals. ⁵

The Commission’s classification-guidelines page still labels its downloads as draft. Those examples are not treated here as adopted classification rules. The legal tests below come from Article 6 and the annexes. ⁶ ¹

Seichō's operating standard is identified as the firm’s view throughout. The evidence base contains only official EU and Irish institutional sources. This edition uses the EU Publications Office’s official document downloads where direct EUR-Lex retrieval returned verification responses. The source ledger retains those retrieval results.

Scope and role belong to the particular use

The system and the territorial connection

Article 3(1) defines an AI system through autonomy and inference from inputs to outputs, among other characteristics. It states that a system may exhibit adaptiveness after deployment. Adaptiveness is a possible characteristic within the definition. ¹

Article 2 covers providers placing relevant systems or models on the Union market and providers putting systems into service there. It also covers deployers established or located in the Union. Certain third-country providers and deployers fall within scope where a system’s output is used in the Union. Article 2 also contains specific exclusions. ¹

Seichō’s record starts with the actual function, the responsible legal entity and the place where the output enters the work. A supplier’s product label supplies context for that record. The assessment rests on the function and the statutory definitions.

Provision and deployment are different roles

Article 3(3) includes an organisation that has a system developed and puts it into service under its own name within the provider definition. Article 3(11) defines putting into service as supply for first use directly to the deployer, or for the provider's own use in the Union, for the system's intended purpose. Article 3(4) defines deployment as use under a person’s authority, with an exception for personal, non-professional activity. ¹

Article 25 addresses provider responsibility along the high-risk value chain. Its triggers include specified rebranding, changes meeting the statutory modification test and changes of intended purpose. It also provides for cooperation and written agreements concerning necessary information and assistance. ¹

Seichō’s position is that procurement records the activities each party performs, alongside the contract’s allocation of responsibility. The approval record returns for assessment when a proposed change alters the purpose or authority of the software.

Classification follows the intended purpose

Prohibited practices come first

Article 5 prohibits specified practices under defined conditions. These include harmful manipulation, exploitation of vulnerability and specified social scoring. Article 5(1)(f) addresses emotion inference in workplaces and education, with a medical or safety exception. Article 3(39) defines emotion recognition through biometric data. ¹

The 2026 amendment adds prohibitions concerning specified non-consensual intimate material and child sexual abuse material. The added provisions have a separate application date of 2 December 2026. Their exact scope is set by Article 5(1)(ba) and (bb), with paragraphs 1a and 1b. ¹ ²

Seichō’s release standard holds an unresolved prohibited-use assessment open. A notice and a review point are operating controls; the underlying purpose still needs its own assessment.

There are two high-risk routes

Article 6(1) sets the product route. It combines the relevant Annex I product legislation with a third-party conformity-assessment condition. Amended paragraphs 1a to 1c qualify the safety-component and assessment tests. Non-safety functions and failures that endanger health and safety receive distinct treatment. ¹

Article 6(2) sets the Annex III route. Point 4 of Annex III includes specified recruitment and worker-management systems. The entries cover filtering job applications and evaluating candidates, alongside certain promotion, termination, task-allocation and performance-monitoring decisions. The task-allocation entry refers to individual behaviour or personal traits or characteristics. ¹

Article 6(3) provides a conditional derogation for certain Annex III systems. It combines a significant-harm test, including material influence on decisions, with listed conditions concerning the task performed. An Annex III system performing profiling of natural persons remains high-risk. Article 6(4) requires the provider’s documented assessment and refers to Article 49(2) registration. ¹

Seichō’s classification record describes what the output changes in the decision. A general description such as administration or scheduling leaves that operating question unanswered. Human involvement is recorded through the reviewer’s actual authority and information.

Application dates attach to particular provisions

The original Act entered into force on 1 August 2024. Entry into force and application of individual provisions are distinct. The following schedule follows amended Article 113, with the separate Article 111 transitions identified explicitly. ³ ⁴ ¹

Application dates in the amended Act
Date	Position in the current text
2 February 2025	Chapters I and II apply, subject to the later date for the newly added Article 5 provisions. Article 4 remains part of Chapter I. ¹
2 August 2025	Chapter III, Section 4; Chapters V, VII and XII; and Article 78 apply, with the Article 101 exception. This includes the general-purpose model chapter. ¹
27 July 2026	The AI Omnibus enters into force. Amended Article 113(d) gives Articles 102 to 110 this application date. ² ¹
2 August 2026	The general application date. Article 50 transparency duties fall within this schedule, subject to their conditions and the specific transition below. ¹
2 December 2026	The added Article 5 provisions apply. Article 111(4) also sets this deadline for Article 50(2) marking by providers of qualifying systems marketed before 2 August 2026. ¹
2 August 2027	Article 111(3) sets the deadline for providers of general-purpose models placed on the market before 2 August 2025. ¹
2 December 2027	Chapter III, Sections 1 to 3, except Article 6(5), apply for the Article 6(2) and Annex III high-risk route. ¹
2 August 2028	Those specified sections apply for the Article 6(1) and Annex I high-risk route. ¹

The deferral in Article 113(c) names Sections 1 to 3 of Chapter III only. The classification rules in Article 6 are within Section 1. Conformity assessment under Article 43 and the Article 86 explanation right sit in other sections and carry no express deferral of their own, although both operate by reference to a system classified as high-risk. How those provisions interact for a given system before December 2027 is a question for advice, and the operating record notes the position relied upon. ¹

Article 111(2) separately addresses qualifying high-risk systems marketed or put into service before the relevant Chapter III application date. It refers to significant design changes after that date. It also sets 2 August 2030 for necessary compliance steps concerning high-risk systems intended for public-authority use. Article 111(1) contains a distinct transition for specified large-scale IT systems. ¹

Seichō’s operating record pairs each assessed obligation with its own date and the transition relied upon. The release date of a product and the business’s first use are retained as evidence. That approach keeps a supplier’s general timetable connected to the use under assessment.

Literacy and transparency in operation

Literacy measures follow the work

Amended Article 4 requires providers and deployers to take measures supporting the development of literacy among relevant staff and others acting on their behalf. The considerations include their knowledge and experience, the context of use and the people affected. The Article expressly excludes a guarantee of a specific literacy level for each individual. ¹ ²

Seichō’s standard uses the actual system as the basis for staff guidance. The record explains permitted inputs and output checking, with a route for escalation. A dated record of the material and its recipients makes that operating decision reviewable.

Transparency has several responsible actors

Article 50(1) places the direct-interaction information duty on providers, with an obviousness test and defined exceptions. Article 50(2) addresses machine-readable marking and detectability of synthetic outputs by providers. It includes qualifications concerning technical feasibility and specified editing or other functions. ¹

Article 50(3) addresses deployer information for emotion recognition and biometric categorisation. Article 50(4) covers deepfake disclosure and specified public-interest text. Its text-publication exception combines human review or editorial control with editorial responsibility. Article 50(5) addresses clear, distinguishable and accessible information, provided by the first interaction or exposure. ¹

Article 111(4) concerns Article 50(2) marking for systems placed on the market before 2 August 2026. It does not extend the December deadline to every Article 50 duty. ¹

Seichō’s acceptance record tests the implemented interface and exported output against the responsibility allocated to each party. A customer conversation and a published image have different approval records. The operating evidence identifies the notice or marking being tested and the reason for any exception relied upon.

The high-risk operating record

Deployment needs authority and usable evidence

Article 26 falls within Chapter III, Section 3. The relevant later application dates above cover that section. It addresses use according to instructions and oversight by people with the necessary competence, training and authority. Relevant input data under the deployer’s control, monitoring and specified suspension or escalation duties also appear there. ¹

Article 26(6) provides for appropriate retention of automatically generated logs under the deployer’s control, for at least six months unless other applicable law provides otherwise. That is a qualified high-risk deployer provision. Article 26 also addresses worker information, information for relevant data-protection assessments and notices to people subject to specified decisions. ¹

Article 86 provides a conditional explanation right for certain decisions based on Annex III high-risk outputs. Its scope concerns legal effects or similarly significant effects adversely affecting health, safety or fundamental rights, with specified exclusions and qualifications. The right sits outside the deferred Chapter III sections. ¹

Seichō’s design standard gives the reviewer enough information to challenge an output and the authority to suspend its use. Log access and export are part of procurement acceptance. Retention has a stated purpose, with access and deletion decisions recorded for the particular evidence.

Provision carries its own body of work

Articles 9 to 15 address risk management and data governance, technical documentation, recording, transparency, human oversight and performance requirements. Article 16 identifies provider obligations. Articles 17 to 19 address quality management and retained documentation or logs. These provisions are within the deferred Chapter III sections. ¹

Articles 43 and 47 to 49 address conformity assessment, declarations, marking and registration. Article 43(2) specifies internal control for Annex III points 2 to 8. Article 49 distinguishes providers from the public-authority deployers specified in paragraph 3. ¹

Article 27 requires a fundamental rights impact assessment for specified deployers and uses. Its categories include bodies governed by public law and private entities providing public services, with the Article’s exclusions. It also covers specified creditworthiness and life or health insurance uses. Paragraph 4 addresses coordination with an existing data protection impact assessment. Article 27 is in Chapter III, Section 3. ¹

Seichō’s provider record connects the assessed requirements to acceptance evidence and an accountable release decision. The firm’s proposed operating record supports that work. It is a management method with a defined scope, rather than a statutory template.

Procurement preserves separate responsibilities

Chapter V addresses general-purpose AI models. Article 53 sets model-provider obligations concerning documentation, downstream information, copyright policy and a public training-content summary, with specified exceptions. Article 3 separately defines a general-purpose model and a general-purpose system. These are distinct objects within the Regulation. ¹

Articles 3, 11, 62 and 63 contain size definitions, support measures or simplifications with defined conditions. Article 3 refers to the relevant SME and small mid-cap recommendations. The statutory category follows those definitions. It is separate from this paper’s choice of audience. ¹

Article 2 preserves relevant personal-data, consumer and worker protections. Article 4a, added by Regulation (EU) 2026/1744, permits providers of high-risk AI systems exceptionally to process special categories of personal data for bias detection and correction to the extent strictly necessary, subject to its conditions and safeguards alongside applicable data-protection law. Article 73 sets provider (and, where applicable, deployer) serious-incident reporting requirements, with different deadlines for specified circumstances. Article 99 sets three bands of administrative fine: up to EUR 35 million or 7 per cent of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3 per cent for listed operator obligations including Article 26 deployer duties and Article 50 transparency, and up to EUR 7.5 million or 1 per cent for incorrect or misleading information to authorities. For SMEs the lower of the amount or percentage applies. ¹

Seichō’s procurement standard records the evidence needed from the supplier for the actual system and role. The record includes access to instructions, notification of material changes and an incident contact. The legal work for privacy, employment and sector requirements has an identified owner alongside the system assessment.

The EU AI Act in Ireland: the national position

As checked on 16 October 2026, the Regulation of Artificial Intelligence Act 2026 is enacted as Act 31 of 2026. The President signed it on 21 July 2026. The Oireachtas history records completed parliamentary stages. The implementing legislation has progressed beyond the general-scheme and Bill stages. ⁷

The department’s commencement notice for S.I. 403/2026 appoints 31 July 2026 for the Act to come into operation. It excepts paragraphs (a) and (e) of the section 78 definition of applicable market surveillance authority. Those paragraphs name Coimisiún na Meán and the Data Protection Commission. S.I. 404/2026 appoints 31 July as the Office’s establishment day. ⁸ ¹² ⁹

S.I. 366/2025 designated national competent authorities, including market surveillance and notifying authorities. S.I. 405/2026 adds further market surveillance designations. The two types of authority have distinct functions under Articles 28 and 70 of the EU Regulation. ¹⁰ ¹¹ ¹

Section 78 names Coimisiún na Meán, the railway, communications and utilities regulators, the Data Protection Commission, and the Health and Safety Authority. It also names the Health Products Regulatory Authority, Health Service Executive, Marine Survey Office, National Transport Authority and Workplace Relations Commission. Parts 8 and 9 separately address the Central Bank and the Competition and Consumer Protection Commission. The commencement exceptions above remain part of this account. ¹² ⁸

Designation itself is made by S.I. 366/2025 as amended by S.I. 405/2026. Those Regulations designate Oifig IS na hÉireann as a market surveillance authority for the purposes of Article 70(1), the Workplace Relations Commission for Annex III point 4 and for Article 5(1)(f) outside education, the Data Protection Commission for Annex III points 6 to 8 and several prohibited practices, Coimisiún na Meán for Article 50 in respect of specified online and media services, and the Central Bank for regulated financial service providers. Section 78 of the national Act separately defines which of those bodies may use the Part 6 adjudication and administrative-fine procedure. ¹⁰ ¹¹ ¹²

The Minister of State's evidence to the Joint Committee on Artificial Intelligence on 23 September describes the Office as a market surveillance authority for its single-point-of-contact role. That evidence expressly distinguishes its coordinating role from regulation of a particular type or use of system. Sections 9 and 42 of the national Act set out coordination and single-point-of-contact functions. ¹³ ¹²

Further domestic measures remain a separate legislative workstream in the official evidence checked for this edition. On 23 September, the Minister of State described phase-two plans, including specific enforcement arrangements for the DPC and Coimisiún na Meán. The evidence records submitted draft heads and proposed Omnibus-related amendments. Those plans are reported here at that stated stage, rather than as enacted powers. ¹³

Seichō’s position is that the system record identifies the relevant authority and the basis for that allocation. A national coordinating office and a sectoral regulator serve different purposes. Procurement and incident arrangements need that distinction recorded against the actual activity.

Questions for leadership

The following questions express Seichō's operating standard. They bring the companion checklist into a leadership discussion. They do not determine classification or establish compliance.

Which operating decision does the system influence, and what outcome has the business authorised?
Which legal entity owns the use, and where does its output enter the work?
What assessment records the firm’s role, classification and relevant application dates?
What evidence supports any exclusion, transition or exception relied upon?
Who accepts the output, and what information and authority does that person have?
Which inputs are permitted, and how is the use of sensitive information controlled?
What supplier evidence is available for this system and version, including instructions and relevant conformity records?
How are staff supported in recognising the system’s limits and escalating an uncertain result?
Which interaction notices, output markings or publication disclosures have been assessed, and where is their acceptance evidence?
Who can suspend use, and how does the business continue the work during that suspension?
Which logs and decision records are retrievable, and what purpose and retention period govern them?
Which Irish authority and incident route apply to the assessed activity?
Who owns the separate privacy, employment and sector assessments?
What change in purpose, population, supplier or function brings the approval back for review?

A decision that remains reviewable

Seichō’s standard is an approval record that remains useful after release. It identifies the permitted purpose and the person responsible for the operating result. Evidence sits with the decision, so a later review starts from what was assessed.

The next approval belongs to the current system and its current use. A changed purpose returns to assessment. Leadership’s responsibility is to keep that connection visible in the work the business authorises.

Sources

Sources checked 16 October 2026. The numbered references link to the official documents used in this edition.

Regulation (EU) 2024/1689, consolidated text, 27 July 2026. European Parliament and Council; EU Publications Office. 27 July 2026. Articles and annexes cited in the text; documentation tool.
Regulation (EU) 2026/1744: Digital Omnibus on AI. European Parliament and Council. 8 July 2026; Official Journal 24 July 2026. Article 1(2), (39) and (40); Article 4.
Regulation (EU) 2024/1689: Artificial Intelligence Act. European Parliament and Council. 13 June 2024; Official Journal 12 July 2024. Original enacted text; Article 113.
AI Act: regulatory framework and implementation timeline. European Commission. updated 3 August 2026. Implementation timeline and AI Omnibus.
Digital Omnibus, procedure 2025/0360(COD), COM(2025) 837. European Parliament, Legislative Observatory. proposal 19 November 2025; status checked 16 October 2026. Stage reached in procedure.
Draft Commission guidelines on classification of high-risk AI systems. European Commission. 19 May 2026; updated 23 July 2026. Draft status and consultation downloads.
Regulation of Artificial Intelligence Act 2026, Act 31 of 2026: legislative history. Houses of the Oireachtas. 21 July 2026. Enactment and completed parliamentary stages.
S.I. No. 403 of 2026: Commencement Order. Department of Enterprise, Tourism and Employment. 31 July 2026. Commencement date and section 78 exceptions.
S.I. No. 404 of 2026: Establishment Day Order. Department of Enterprise, Tourism and Employment. 31 July 2026. Establishment day.
S.I. No. 366 of 2025: Designation Regulations. Department of Enterprise, Tourism and Employment. 25 July 2025. Designation of national competent authorities. S.I. 366/2025 statutory text.
S.I. No. 405 of 2026: Designation Amendment Regulations. Department of Enterprise, Tourism and Employment. 31 July 2026. Further market surveillance designations. S.I. 405/2026 statutory text.
Regulation of Artificial Intelligence Act 2026, enacted text. Oireachtas. 21 July 2026. Sections 9, 42 and 78; Parts 8 and 9.
Joint Committee on Artificial Intelligence: evidence of the Minister of State on implementation. Houses of the Oireachtas. 23 September 2026. Pages 2 to 4: the Office, phase two and draft heads.
Corrigendum to Regulation (EU) 2026/1744, OJ L 2026/90810: publication record. European Parliament and Council; EU Publications Office. 29 September 2026. German-language corrigendum, CELEX 32026R1744R(01).

This paper is general information on the EU AI Act and its implementation in Ireland as at 16 October 2026. It is not legal advice and must not be relied on as such. Seichō is a strategy and technology consultancy and does not provide legal services. The paper does not establish whether the Act applies to any particular business or system; obligations depend on the specific facts. Qualified legal advice should be taken before any decision is based on it.