Does the EU AI Act apply to my business?

If your business is established in Ireland and anybody in it uses an AI system for work, the Act applies to you. That is Article 2(1)(b), and it does not have a size threshold, a turnover floor or a sector limit in it.

What follows from that depends on what you do with AI. Applying to you and imposing something on you are different questions. For a business that uses AI only inside software it bought, the answer to the second is Article 4 and part of Article 50. Article 4 asks you to take measures on AI literacy. Article 50 applies to you only in the situations it gives deployers: disclosing that a deep fake was generated or manipulated, and disclosing AI-generated text published to inform the public on matters of public interest. Telling people they are talking to a machine, and marking what a machine made, are duties of the system's provider. That is you only if you built it, had it built, or changed a bought one and put it into service under your own name.

Everything else in the Act that a vendor checklist puts in front of you applies only if you do something specific. Screening job applications. Scoring credit. Pricing life or health insurance. Inferring how somebody feels at work. If you do none of those and nothing else in Annex III, the Regulation's high-risk, general-purpose model and conformity assessment rules are addressed to other people: providers, importers, distributors, notified bodies and authorities.

Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

The word doing the work is infers. A spreadsheet formula does not infer, it computes what it was told to compute. A rules engine that rejects an application because a field is under a threshold does not infer either. A model that produces an output nobody wrote a rule for does.

The answer can be yes without anybody buying an AI product. The interesting cases arrive inside software already paid for: the summarising feature in the helpdesk, the ranking in the applicant tracking system, the reply suggestions in the shared inbox, the forecast in the accounts package. None of that has to be bought separately; it can arrive in an update.

The first practical step is a list of the tools in use. You cannot answer any of the questions below about tools you have not noticed you are running.

Article 2 carries a set of exclusions, and five of them are worth knowing.

Paragraph 10 excludes a natural person using an AI system in the course of a purely personal non-professional activity. Your own use of a chatbot at home is outside the Act. Once it is used on behalf of the business, it is inside the Act. The same goes for a personal account used for work, because using it for the business is professional use.

Paragraph 6 excludes AI systems and models specifically developed and put into service for the sole purpose of scientific research and development. Paragraph 8 excludes research, testing and development activity before a system is placed on the market or put into service, and it says explicitly that real-world testing is not covered by that exclusion.

Paragraph 12 excludes systems released under free and open-source licences, and it has two holes in it worth knowing about: the exclusion does not apply where the system is placed on the market as high-risk, and it does not apply to systems falling under Article 5 or Article 50. An open-source model in a chatbot on your website is still inside the transparency duty.

Paragraph 3 excludes systems used exclusively for military, defence or national security purposes, which is listed here for completeness.

Article 2(1) has three parts that matter to an Irish business, and each does a different job.

Under 2(1)(a) the Act reaches providers that place an AI system on the EU market or put it into service, whether the provider is based in the EU or outside it. Under 2(1)(b) it reaches deployers established or located in the EU, which is the part that covers an Irish business using AI it did not build. Under 2(1)(c) it reaches providers and deployers located outside the EU where the output of the AI system is used in the EU.

The third part matters if you outsource. An Irish company that outsources a screening step to a supplier outside the EU has not moved the problem outside the Act, because the output is used here. It has moved it into a contract, where your position depends on what the contract says and whether the supplier honours it.

Article 5 lists the practices that are banned outright. They have applied since 2 February 2025 and they carry the heaviest penalty tier in the Act, up to 35 million euro or 7% of worldwide annual turnover, whichever is higher. If you are a small or medium enterprise, Article 99(6) caps the fine at whichever of the two is lower instead. That is the percentage unless your worldwide annual turnover is above 500 million euro.

The list names specific practices. Some need a purpose an ordinary business does not have, such as untargeted scraping of facial images to build recognition databases, or real-time remote biometric identification in public spaces for law enforcement. Others reach further. The social scoring ban applies to private businesses as well as public authorities. The ban on exploiting vulnerabilities covers age, disability and a person's specific social or economic situation. It applies where the exploitation materially distorts their behaviour in a way that causes, or is reasonably likely to cause, significant harm. One reaches ordinary hiring directly.

Article 5 prohibits the use of AI systems to infer emotions of a natural person in the workplace or in education, outside narrow medical and safety exceptions. Software that reads a candidate's face or voice in a video interview to score confidence, enthusiasm or engagement is inside that prohibition. That is because the Commission's guidelines apply the workplace ban to candidates during selection and hiring. The ban has applied since 2 February 2025. Scoring the sentiment of a written answer is outside it, because the ban is limited to inferences drawn from biometric data such as the face or voice.

This is the question to answer first, because a prohibited practice has to stop now, whatever the answers to the questions after it. The AI literacy and transparency duties in Articles 4 and 50 already apply too; the high-risk rules are the part to plan for. The deadline piece sets out what moved and what did not.

Annex III lists the standalone high-risk purposes. The ones an Irish SME can plausibly touch are point 4, which covers recruitment, selection, promotion, termination, task allocation and performance monitoring; point 5(b), creditworthiness evaluation and credit scoring other than to detect financial fraud; and point 5(c), risk assessment and pricing for life and health insurance.

If none of those describes anything you do, read the rest of Annex III once before you stop. It also covers biometrics (including emotion recognition used outside work and education), critical infrastructure, and education and vocational training. Annex I covers AI in regulated products. If one of the purposes above does describe you, two things follow.

The date is 2 December 2027 for the Annex III categories, not 2 August 2026. Regulation (EU) 2026/1744 moved it, and the change is unconditional, so it will not snap back. High-risk AI in regulated products moves to 2 August 2028. That means AI that is a safety component of a product covered by the EU laws listed in Annex I, or is such a product itself, where the product must be checked by an independent body (a third-party conformity assessment). AI used only for convenience, user assistance or performance optimisation is not a safety component.

And there is a way out of the classification even where the purpose is listed. Article 6(3) removes an Annex III system from the high-risk category where it does not pose a significant risk of harm, including by not materially influencing the outcome of a decision. It must also do one of four things: perform a narrow procedural task, improve the result of a human activity already completed, detect decision patterns without replacing human assessment, or do preparatory work. The exception to that exception is short and absolute: a system that profiles people is always high-risk.

Article 3(3) defines a provider as somebody who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark, whether for payment or free of charge. Article 3(4) defines a deployer as somebody using an AI system under their authority, other than in a personal non-professional activity.

A business that buys AI software and uses it as supplied is a deployer. For ordinary AI, a deployer's duties are Article 4 and, in the situations it names, Article 50. From 2 December 2027, a deployer of an Annex III high-risk system also has Article 26 duties. These include human oversight, monitoring and keeping logs for at least six months. Provider duties for a high-risk system go further: Article 16 requires the provider to meet the Section 2 requirements, which include risk management, data governance and technical documentation, and to put the system through conformity assessment.

You can become a provider without deciding to. Article 25 does it three ways, and the third is the one a business can trigger without meaning to: modifying the intended purpose of an AI system so that it becomes high-risk. Using a general-purpose AI system to screen job applications can be exactly that repurposing. If it is, the business that does it takes on the provider obligations in Article 16, and the original provider stops being the provider of that system. We wrote that up separately, because it turns a deployer's short list of duties into the provider obligations in Article 16.

A business with staff using ordinary AI features inside ordinary software, no hiring automation, no credit decisions and no emotion inference, owes Article 4 in every case and Article 50 in the situations it names.

Article 4 asks providers and deployers to take measures to support AI literacy among staff who use AI on their behalf. Since 27 July 2026 it says explicitly that this does not require anybody to guarantee a specific level for any individual. There is no course to buy and no certificate to hold.

Article 50 has applied since 2 August 2026 and requires disclosure in four situations. A system intended to interact directly with people has to make clear it is an AI system, unless that is obvious. Whoever provides a system that generates synthetic audio, images, video or text has to mark the output in a machine-readable format. A deployer of emotion recognition or biometric categorisation has to inform the people exposed to it. A deployer producing a deep fake, or publishing AI-generated text to inform the public on matters of public interest, has to disclose it. Providers of generating systems that were on the market before 2 August 2026 have until 2 December 2026 to add the marking.

That is the whole ordinary case: Article 4 always, and Article 50 when you make deep fakes or publish AI-generated text on matters of public interest, or when you provide the chatbot or generator yourself. You show both by writing down what you did.

Working out that the AI Act is light on you does not mean using AI on personal data is fine. It is not, and the regulation that bites is the older one.

GDPR Article 22 has applied since May 2018 and it limits decisions based solely on automated processing that produce legal or similarly significant effects. It has no deferred start date and Ireland has a regulator with a published enforcement record. The hiring case is the clearest one.

GDPR Article 35 is the other. Feeding customer records into a new tool can mean using data for a purpose other than the one it was collected for. Doing that on a large scale is item 1 on the Data Protection Commission's list. The list names processing that needs a data protection impact assessment when a documented screening shows it is likely to be high risk. Whether yours is on that list is worth answering before the tool goes live.

In order, starting with what costs least.