Insights

What the rules say

Written for people who have to act on this rather than write about it. Every claim is sourced and dated, because regulation moves and most of what is published about it does not get corrected when it does.

By subject

Everything, newest first

Automation

Automating something that touches personal data: what has to be written down

The build is the easy half. What decides whether it survives a complaint is the five things that should have been written down before it went live.

9 minute read4 sources

Measurement

What you are allowed to measure before anybody clicks accept

Most of the measurement conversation is about recovering data that consent removed. A smaller and more useful conversation is about what never needed consent.

8 minute read3 sources

Regulators

Who regulates what online in Ireland, and who will actually contact you

Most Irish businesses assume the Data Protection Commission covers all of this. It covers one regulation out of six.

9 minute read8 sources

Digital Services Act

Does the Digital Services Act apply to an Irish online shop?

The Act regulates services that carry other people's content or other people's goods. Selling your own stock is not one of them.

10 minute read5 sources

Cyber Resilience Act

Does the Cyber Resilience Act cover a website, or a SaaS?

The test is not whether you sell software. It is whether the customer installs, embeds or runs any part of it themselves.

9 minute read4 sources

NIS2

NIS2 is not Irish law yet. Here is why it still reaches you.

There is no Irish NIS2 regulator, no registration duty and no NIS2 fine, because there is no Irish law creating any of them. That is not the same as nothing to do.

10 minute read7 sources

European Accessibility Act

WCAG AA on an Irish website: what the law asks, and what to fix

The Irish Regulations never mention WCAG. What they require is four properties, and WCAG is how you demonstrate them rather than what you owe.

10 minute read8 sources

European Accessibility Act

Does the European Accessibility Act apply to your website?

Two questions settle it: are you selling to consumers, and do you employ fewer than ten people. Most Irish SMEs can answer both in a minute.

10 minute read7 sources

GDPR

Health research in Ireland: explicit consent, and the way around it

The regulations are written around the activity rather than the institution, so a commercial medtech is inside them on the same terms as a hospital.

8 minute read6 sources

GDPR

You have had a data breach. What the first 72 hours require

The 72 hours runs from when you became aware, not from when you finished investigating. That is the sentence most people get wrong on the day.

9 minute read4 sources

GDPR

Cookie banners in Ireland, and what the DPC actually said

Scrolling is not consent, pre-ticked boxes are not consent, and the six month rule everybody quotes is softer than they think.

9 minute read5 sources

GDPR

Sending personal data to the US from Ireland, in 2026

Yes, and with conditions. The Framework holds, the checks are specific, and the part people skip is whether the particular company is actually on the list for the particular data.

11 minute read7 sources

GDPR

Do you need a DPIA? Ireland has its own list, and it is specific

Most guidance answers this with European criteria. Ireland has a published list of its own, and it is the one that decides the question here.

10 minute read5 sources

EU AI Act

Who regulates AI in Ireland, and which one is yours

There is no Irish AI regulator. There are more than a dozen of them, and which one is yours depends on what your business does rather than on what your software is.

9 minute read7 sources

EU AI Act

AI literacy: a real duty, and nothing you have to buy

The duty is genuine, it applies to almost every Irish employer, and the training market that has grown up around it is selling something the Regulation does not ask for.

7 minute read3 sources

EU AI Act

Do you have to tell people your chatbot is AI? Usually yes.

Four duties, two of them the supplier's and two of them yours. The one people get wrong is which is which.

9 minute read4 sources

EU AI Act

Does the EU AI Act apply to my business?

Three questions decide it, and the first one rules out fewer businesses than people expect. The last one rules out most of them.

11 minute read4 sources

European Accessibility Act

Being small exempts your website. It does not exempt your shelf.

Almost every summary says microenterprises are exempt. Regulation 5(4) exempts a service, and it stops dead at the product side.

16 minute read13 sources

Cyber Resilience Act

If you ship software, a 24 hour reporting clock starts in September 2026

Most coverage points at December 2027. The duty that bites first arrives fifteen months earlier, and it reaches backwards over everything already in customers' hands.

9 minute read4 sources

Measurement

What server-side conversion tracking actually does, and what it does not

It is not a way around consent, and anybody selling it that way is selling you a fine. What it does fix is the larger share of losses that have nothing to do with consent at all.

11 minute read7 sources

GDPR

An SEO plugin updated itself, and the DPC found three separate failures

The interesting part is not the breach. It is that once the DPC looked, the record of processing and the processor agreement failed too.

7 minute read3 sources

Funding

Irish digital grants in 2026: the one that closed, and the one that did not

Firms are still advertising help with a scheme that closed in 2024. Here is the route that is actually open, and the free assessment you have to do first.

6 minute read4 sources

Working with a provider

What a monthly technology retainer should actually cover

A monthly fee buys attention. What decides whether it is worth paying is what runs underneath it, and who profits when your provider recommends something.

7 minute read3 sources

GDPR

Does a small Irish business website need a privacy notice?

We fetched 82 Irish business websites in one week. Thirty-four had no privacy notice at any of the usual addresses, and three had one that nothing on the site linked to.

9 minute read3 sources

Integrations

What it takes to connect Revolut Business to your accounts package

The API is real, well documented and free once you are on the right plan. The work is in the setup and in what you do with the transactions afterwards.

8 minute read3 sources

Funding

What Irish state funding for AI pays for

The State will help you adopt AI. It will not help you comply with the AI Act, and two schemes say so in writing. Worth knowing before you apply.

8 minute read12 sources

GDPR

AI in hiring: the rule that is already in force

Article 22 has applied since May 2018. If software rejects candidates and no person really decides, the rules that bite are the data protection ones.

10 minute read8 sources

EU AI Act

The Article 25 trap: when using AI makes you its provider

Deployer duties are light. Provider duties are not. Article 25 decides which you are, and it does not ask whether you set out to build anything.

10 minute read7 sources

EU AI Act

The EU AI Act high-risk deadline moved to December 2027

Most Irish guidance still carries the old date. Here is what is in force now, what moved, and what it means if you use AI at work.

8 minute read10 sources