Does the EU AI Act apply to my business?

If your business is established in Ireland and anybody in it uses an AI system for work, the Act applies to you. That is Article 2(1)(b), and it does not have a size threshold, a turnover floor or a sector limit in it.

What almost nobody says next is how little follows from that for most businesses. Applying to you and imposing something on you are different questions, and for the ordinary Irish SME the answer to the second is two duties: Article 4, which asks you to do something about AI literacy, and Article 50, which asks you to tell people when they are talking to a machine or looking at something a machine made.

Everything else in the Act that a vendor checklist lists at you is conditional on doing something specific. Screening job applications. Scoring credit. Pricing life or health insurance. Inferring how somebody feels at work. If you do none of those, most of the Regulation is a description of other people's obligations.

Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

The word doing the work is infers. A spreadsheet formula does not infer, it computes what it was told to compute. A rules engine that rejects an application because a field is under a threshold does not infer either. A model that produces an output nobody wrote a rule for does.

In practice the answer for an Irish SME is yes more often than the owner thinks, and for a reason that has nothing to do with anybody buying an AI product. The interesting cases arrive inside software already paid for: the summarising feature in the helpdesk, the ranking in the applicant tracking system, the reply suggestions in the shared inbox, the forecast in the accounts package. Nobody procured any of that. It shipped in an update.

This is why the first practical step is a list rather than a policy. You cannot answer any of the questions below about tools you have not noticed you are running.

Article 2 carries a set of exclusions, and three of them come up in real conversations.

Paragraph 10 excludes a natural person using an AI system in the course of a purely personal non-professional activity. Your own use of a chatbot at home is outside the Act. The moment it is used on behalf of the business it is not, and the same is true of a personal account used for work, which is the common shape of this in a small company.

Paragraph 6 excludes AI systems and models specifically developed and put into service for the sole purpose of scientific research and development. Paragraph 8 excludes research, testing and development activity before a system is placed on the market or put into service, and it says explicitly that real-world testing is not covered by that exclusion.

Paragraph 12 excludes systems released under free and open-source licences, and it has two holes in it worth knowing about: the exclusion does not apply where the system is placed on the market as high-risk, and it does not apply to systems falling under Article 5 or Article 50. So an open-source model in a chatbot on your website is still inside the transparency duty.

Paragraph 3 excludes systems used exclusively for military, defence or national security purposes, which is here for completeness rather than because it will be you.

Article 2(1) has three limbs that matter to an Irish business and they do different jobs.

Under 2(1)(a) the Act reaches providers placing an AI system on the Union market or putting it into service, irrespective of whether the provider is established in the Union or in a third country. Under 2(1)(b) it reaches deployers established or located within the Union, which is the limb most Irish businesses are caught by. Under 2(1)(c) it reaches providers and deployers located in a third country where the output produced by the AI system is used in the Union.

The consequence people miss is the third one. An Irish company that outsources a screening step to a supplier outside the EU has not moved the problem outside the Act, because the output is used here. It has moved it into a contract, which is a different and usually worse place for it to be.

Article 5 lists the practices that are banned outright rather than regulated. They have applied since 2 February 2025 and they carry the heaviest penalty tier in the Act, up to 35 million euro or 7% of worldwide annual turnover, whichever is higher. If you are a small or medium enterprise, Article 99(6) takes whichever of the two is lower instead, so the number that binds you is almost certainly the percentage.

Most of the list is remote from ordinary commerce: social scoring by public authorities, untargeted scraping of facial images to build recognition databases, exploiting the vulnerabilities of a person because of their age or disability. One is not.

Article 5 prohibits the use of AI systems to infer emotions of a natural person in the workplace or in education, outside narrow medical and safety exceptions. Any hiring process that runs a video interview through software scoring a candidate for confidence, sentiment, enthusiasm or engagement is inside that prohibition, and it is inside it now rather than in 2027.

This is the single question worth answering before any other, because it is the only one where the answer changes what you do this week. Everything else in this article is planning. The deadline piece sets out what moved and what did not.

Annex III lists the standalone high-risk purposes. The ones an Irish SME can plausibly touch are point 4, which covers recruitment, selection, promotion, termination, task allocation and performance monitoring; point 5(b), creditworthiness evaluation and credit scoring other than to detect financial fraud; and point 5(c), risk assessment and pricing for life and health insurance.

If none of those describes anything you do, the high-risk regime is not yours and you can stop reading about it. If one does, two things follow.

The date is 2 December 2027 for the Annex III categories, not 2 August 2026. That was moved by Regulation (EU) 2026/1744 and the change is unconditional, so it will not snap back. AI embedded in products already covered by EU product safety law moves to 2 August 2028.

And there is a way out of the classification even where the purpose is listed. Article 6(3) removes an Annex III system from the high-risk category where it does not pose a significant risk of harm, including by not materially influencing the outcome of a decision, and where it performs a narrow procedural task, improves a completed human activity, detects decision patterns without replacing human assessment, or does preparatory work. The exception to that exception is short and absolute: profiling of natural persons is always high-risk.

Article 3(3) defines a provider as somebody who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark, whether for payment or free of charge. Article 3(4) defines a deployer as somebody using an AI system under their authority, other than in a personal non-professional activity.

Almost every Irish business buying software is a deployer, and deployer duties are light. Provider duties are not: Article 16 brings risk management, data governance, technical documentation and conformity assessment with it.

The trap is that you can become a provider without deciding to. Article 25 does it three ways, and the third is the one that catches people: modifying the intended purpose of an AI system so that it becomes high-risk. Wiring a general-purpose model into a workflow that screens job applications is a repurposing, and the obligations that follow are the developer's. We wrote that up separately, because it is the most expensive thing on this page to get wrong.

A business with staff using ordinary AI features inside ordinary software, no hiring automation, no credit decisions and no emotion inference, owes two things.

Article 4 asks providers and deployers to take measures to support AI literacy among staff who use AI on their behalf. Since 27 July 2026 it says explicitly that this does not require anybody to guarantee a specific level for any individual. There is no course to buy and no certificate to hold.

Article 50 applies from 2 August 2026 and requires disclosure in four situations: a system intended to interact directly with people has to make clear it is an AI system unless that is obvious; synthetic audio, image, video or text has to be marked in a machine-readable format by whoever provides the generating system; a deployer of emotion recognition or biometric categorisation has to inform the people exposed to it; and a deployer producing a deep fake, or publishing AI-generated text to inform the public on matters of public interest, has to disclose it.

That is the whole ordinary case. Two duties, both cheap, both evidenced by writing down what you did rather than by buying anything.

The most common mistake after working out that the AI Act is light on you is concluding that using AI on personal data is therefore fine. It is not, and the regulation that bites is the older one.

GDPR Article 22 has applied since May 2018 and it limits decisions based solely on automated processing that produce legal or similarly significant effects. It has no deferred start date and Ireland has a regulator with a published enforcement record. The hiring case is the clearest one.

Article 35 is the other. Feeding customer records into a new tool is frequently a new purpose for data collected for something else, which is item 1 on the Data Protection Commission's own list of processing requiring an assessment. Whether yours is on that list is a ten minute question and it is worth answering before the tool goes live rather than after.

In the order that costs least first.