Who regulates AI in Ireland, and which one is yours

The AI Act requires each member state to set up or name at least one notifying authority and at least one market surveillance authority, the kind of body that supervises AI under the Act. One market surveillance authority must also be the state's single point of contact (Article 70). The Act does not require a new regulator. Ireland created one new body, Oifig IS na hÉireann, the AI Office of Ireland. It is a market surveillance authority and the single point of contact. The rest of the job went to existing public bodies, most of them regulators of the sectors AI is used in.

In practice, which body supervises you under the AI Act depends on what the system is used for or built into, not on the technology. A recruitment tool used by an Irish employer falls to the Workplace Relations Commission (WRC), which is designated for the employment uses in Annex III, point 4. On the wording of the instrument, the same tool used inside a bank is still the WRC's. That is because each of the Central Bank's designations covers only a regulated financial service provider placing AI on the market, putting it into service or using it in direct connection with providing financial services. The personal data going through either tool is also the Data Protection Commission's business under the GDPR, which is a separate law.

That has one clear advantage and two costs. The advantage is that the supervisor already understands the sector. The costs are that one system can interest more than one regulator, and that some uses have no named body at all. Apart from that, some AI is supervised by the European Commission and by no Irish body, as set out below. The single point of contact is the AI Office. The WRC asks people with AI Act queries for it to use the AI Office's contact form.

The bodies are named in a statutory instrument, the European Union (Artificial Intelligence) (Designation) Regulations 2025, S.I. No. 366 of 2025. The Minister for Enterprise, Tourism and Employment made it under section 3 of the European Communities Act 1972. It was given under the Minister's official seal on 25 July 2025, and notice of its making was published in Iris Oifigiúil on 29 July 2025. It has since been amended by the European Union (Artificial Intelligence) (Designation) (Amendment) Regulations 2026, S.I. No. 405 of 2026, given under seal on 31 July 2026, and by section 42 of the Regulation of Artificial Intelligence Act 2026. The Irish Statute Book's table of changes to the 2025 instruments, updated to 6 October 2026, lists no other amendment.

As first made, it did four things. It designated the Minister as a national competent authority and as the single point of contact under Article 70(2). It designated six market surveillance authorities across the fourteen rows of its Schedule, giving each point of Section A of Annex I to a regulator. The six were the Health and Safety Authority, the Competition and Consumer Protection Commission, the Marine Survey Office, the Commission for Communications Regulation, the Commission for Railway Regulation and the Health Products Regulatory Authority. It designated the Central Bank of Ireland for the purposes of Article 74(6) and the Data Protection Commission for the purposes of Article 74(8). And it named four notifying authorities under Article 28: the Minister, the Minister for Transport, the Health Products Regulatory Authority and the Commission for Communications Regulation.

Since 31 July 2026 it reads differently. S.I. No. 405 of 2026 does not say when it starts. Under section 16(3) of the Interpretation Act 2005, such an instrument comes into operation at the end of the day before the day it is made. That puts this one in operation from the start of 31 July 2026. Section 42 of the 2026 Act, also in force from 31 July 2026, designated the AI Office as the single point of contact. It revoked the regulation that had given that role to the Minister. S.I. No. 405 of 2026 replaced regulation 3, which had designated the Minister as a national competent authority, with a version that designates only the market surveillance authorities in Schedule 1. The Minister for Enterprise, Tourism and Employment remains a notifying authority. The instrument narrowed the Central Bank's Article 74(6) designation. It now covers only a regulated financial service provider (as the Central Bank Act 1942 defines one) placing a high-risk system on the market, putting it into service or using it in direct connection with providing financial services. It designated the AI Office as a market surveillance authority, and Coimisiún na Meán for Article 50 where the provider or deployer is one of five kinds of online or broadcast service. And it added two Schedules: one giving points of Annex III, the high-risk uses, to named bodies, and one doing the same for points of the Article 5 bans.

The Annex I points are the product safety route into the Act: toys, recreational craft, lifts, equipment for explosive atmospheres, radio equipment, pressure equipment, cableways, protective equipment, gas appliances, medical devices and in vitro diagnostics. Machinery was point 1 until Regulation (EU) 2026/1744 deleted it from Section A and listed the Machinery Regulation in Section B, from 27 July 2026. For a high-risk AI system related to a product in Section B, only some of the Act applies (Article 2(2)): Article 6(1), Article 60a and Articles 102 to 112. Articles 57 to 59 apply only so far as the high-risk requirements have been written into that product's own legislation. S.I. No. 405 of 2026, sealed on 31 July 2026, still carries a row giving point 1 of Section A, as regards machinery used in the workplace, to the Health and Safety Authority. That row and five others are why the HSA appears six times in Schedule 1. The AI Office's own authorities page still credits the HSA with six of the instruments in Section A of Annex I. That count only works if machinery is included.

S.I. No. 366 of 2025 as amended designates fourteen market surveillance authorities, the AI Office among them. Its four notifying authorities are the Minister for Enterprise, Tourism and Employment, the Minister for Transport, the Health Products Regulatory Authority and the Commission for Communications Regulation. The AI Office lists the other thirteen market surveillance authorities as Ireland's designated national competent authorities. Other counts differ, depending on what is counted. The WRC's page says it is one of 15 national competent authorities, without listing them. Fourteen is the number of distinct bodies the instrument designates as market surveillance authorities.

The table shows what each body is designated for, and the limit the instrument puts on it. The Article 5 bans in points (a) to (h) have applied since 2 February 2025, and the Article 50 transparency duties since 2 August 2026. The Annex III high-risk rules apply from 2 December 2027, and the Annex I rules from 2 August 2028. Where the European Commission's AI Office alone is in charge, as the next section explains, the provider answers to it, not to the body in the table.

Some AI is supervised by the European Commission and by no Irish body. The AI Office named throughout the AI Act is part of the Commission itself, and a different body from the AI Office of Ireland (Article 3(47)). The Commission alone has the power to supervise and enforce the duties of providers of general-purpose AI models, the large models that many AI tools are built on. It gives that work to its AI Office (Article 88).

Since 2 August 2026, when most of the Act began to apply (Article 113), the Commission's AI Office has also been solely in charge of two kinds of AI system (Article 75(1), as replaced by Regulation (EU) 2026/1744). The first is an AI system built on a general-purpose AI model where the model and the system come from the same provider, or from providers in the same group (undertaking). That first kind does not include AI related to the products listed in Annex I, critical infrastructure under point 2 of Annex III, systems provided by law enforcement authorities, border management authorities and financial institutions so far as Article 74(6) covers them, and AI used in the administration of justice. The second is an AI system that is, or is built into, a very large online platform or very large online search engine designated under the Digital Services Act.

The Commission's power covers the provider. It covers a business that uses the system (a deployer) only where that business is also the provider, or part of the same group. A business that uses one of these systems without having built it answers to the Irish authority for its own duties as a deployer, where the instrument names one. A complaint about one of these systems made to the AI Office of Ireland, or to an Irish market surveillance authority, can be passed on to the European AI Office (section 61 of the 2026 Act).

Checked against Annex III and Article 5, S.I. No. 405 of 2026 names no specific body for several uses that can affect a private business or a contractor to a public authority. They are listed below. The AI Office is designated as a market surveillance authority for the purposes of Article 70(1), with no sector. The instrument does not say whether that makes it the authority for these uses, and no official statement we found says so. The Department's release of 30 July 2026 said further legislation would be brought forward in the autumn.

A complaint about any of these uses can still be made to the AI Office of Ireland under section 61 of the 2026 Act. The Office assesses it and can pass it to a market surveillance authority, or to the European Commission's AI Office where the complaint concerns Article 75. The WRC's page links to the AI Office's complaint form.

Article 50 has applied since 2 August 2026. Its chatbot duty (Article 50(1)) falls on the provider: the system has to be designed so that people are told they are dealing with an AI, unless that is obvious to a reasonably well-informed person. A business that only uses somebody else's chatbot has Article 50 duties only where it uses AI to make deep fakes, publishes AI-generated text to inform the public on matters of public interest, or uses emotion recognition or biometric categorisation (Article 50(3) and (4)). The text duty does not apply where the text has been through human review or editorial control and somebody holds editorial responsibility for it. Some systems generate synthetic audio, images, video or text. If they were placed on the market before 2 August 2026, their providers have until 2 December 2026 to mark the output in a machine-readable format (Article 111(4)). The instrument names no Irish body for those duties unless the business is itself one of those online or broadcast services. What Article 50 asks of a chatbot sets out who carries which duty, and provider or deployer sets out which side of that line you are on.

The Act names the body Oifig IS na hÉireann, and the Department and the Office use the English name AI Office of Ireland. The Regulation of Artificial Intelligence Act 2026 is dated 21 July 2026, the day the Department says President Connolly signed it into law. The Oireachtas records the Bill as the Regulation of Artificial Intelligence Bill 2026, Bill No. 69 of 2026, enacted as Act No. 31 of 2026. S.I. No. 404 of 2026 appointed 31 July 2026 as the Office's establishment day.

Section 9 of the Act gives the Office its functions: to coordinate the competent authorities so the AI Act is implemented and supervised consistently, to help them share information and support their joint investigation and enforcement work, to promote AI innovation and literacy, to raise public awareness of the rights and obligations under the AI Act, to give the competent authorities access to technical, legal and regulatory expertise, and to advise the Minister. Subject to the Act, it is independent in performing them. The Minister may direct it to comply with Government policy on AI, but not in its coordination, cooperation and expertise functions, and not on anything in Part 6 (section 11). Under section 43 it keeps an AI register, which includes incidents of prohibited practices in the State and serious incidents reported under Article 73.

Its first chief executive is Paul Byrne, whose appointment the Department announced on 30 July 2026. The same release said the Office was expected to be operational by 2 August 2026.

S.I. No. 403 of 2026 brought the Regulation of Artificial Intelligence Act 2026 into operation on 31 July 2026, with one exception. Part 5, on supervision and enforcement, lets a market surveillance authority appoint authorised officers (section 68). They can serve a contravention notice for a breach of the duties in Articles 16, 23, 24, 26, 27(3) and 50, and a prohibition notice for a breach of Article 5 or where a product presents a risk (sections 71 and 72). Part 6, on adjudication and administrative fines, lists eleven regulators whose authorised officers can refer a suspected breach to an independent adjudicator. An adjudicator's decision takes effect only when the High Court confirms it. The paragraphs naming Coimisiún na Meán and the Data Protection Commission were left out of the commencement order. On 15 October 2026 the Irish Statute Book still showed them as not yet in force, with a commencement order still required. In practice, both can serve the Part 5 notices today, but cannot yet refer an AI Act case for an administrative fine.

The AI Office is not on the Part 6 list. On the wording of the Act it is still a relevant market surveillance authority. Part 5 applies to every such authority except the Central Bank (section 129). That gives the Office the power to appoint authorised officers who can serve those notices. What it may act on is less clear. The Act ties a relevant AI product to what an authority is designated for, and the Office's designation names no sector.

Nor are the Central Bank and the CCPC on the Part 6 list. Under section 129, Parts 5, 6 and 7 do not apply to the Central Bank, which imposes AI Act fines through its own procedures under the Central Bank Act 1942 (section 133). Section 136 gives the CCPC its own administrative fines procedure, by inserting a new Part 2A into the Competition and Consumer Protection Act 2014.

When we checked on 15 October 2026, we found no published Irish enforcement action under the AI Act. That covers only what is published. It does not prove that nothing has happened.

There is an Irish enforcement record under a related law, the GDPR. The Data Protection Commission publishes its decisions, and one of them is against a credit union. In the Slane Credit Union decision, a breach notification started the inquiry, and the 5,000 euro fine was for the security failure. The record of processing and the contract with the supplier handling its data (the processor agreement) were found wanting as well, and the reprimand covered them.

The regulators of online services under laws other than the AI Act are set out in which Irish body regulates what online.

For an Irish employer, the WRC is the body that matters. It is designated for the one Article 5 ban aimed at the workplace, which already applies. It is also designated for the employment uses in Annex III, point 4, whose high-risk rules apply from 2 December 2027.

Article 5(1)(f) bans AI systems that infer the emotions of a person in the workplace or in education institutions. The ban covers placing such a system on the market, putting it into service for this specific purpose, and using it. The exception is a system intended to be put in place or onto the market for medical or safety reasons. The ban has applied since 2 February 2025, and a breach falls in the top penalty tier. The WRC's designation covers the workplace half. The instrument names nobody for education institutions.

One definition matters here. Article 3(39) defines an emotion recognition system as one for identifying or inferring emotions or intentions of people on the basis of their biometric data. The Commission's guidelines on prohibited practices, which are not binding, read Article 5(1)(f) with that definition. A system inferring emotions from written text is not using biometric data and is outside the prohibition. One inferring them from typing patterns, facial expressions, body postures or movements is inside it, and so is a tool that reads a candidate's face or voice in a recorded interview to infer emotions or intentions. Recital 18 says merely detecting a smile or a raised voice is not emotion recognition, unless it is used to identify or infer emotions. The guidelines read the workplace as including candidates during selection and hiring, and say that using emotion recognition in a recruitment process is prohibited. The WRC's page describes its role the same way, covering systems that infer the emotions of workers or job applicants.

The WRC's AI Act page is explanatory, not published guidance, and it is undated. It says further legislation will give the WRC its supervision and enforcement powers as a market surveillance authority, and that public guidance will follow as the implementation framework matures. It does not say what that legislation will add to the 2026 Act. The Act's enforcement and adjudication Parts have applied to the WRC since 31 July 2026. The data protection side of AI in hiring is covered in GDPR Article 22 and AI in hiring.

The Department's EU AI Act page, as read on 15 October 2026, no longer lists the competent authorities; it sends readers to the AI Office. It is also out of date on the dates, on AI literacy and on the Digital Omnibus, wrong on one number, and wrong on the day the AI Office was established.

It states that the rules on high-risk AI systems for Annex III use cases come into effect on 2 August 2026 and for Annex I products on 2 August 2027. Both moved: Regulation (EU) 2026/1744 took Annex III to 2 December 2027 and Annex I to 2 August 2028, and the Commission's own regulatory framework page carries the later dates.

It still says providers and deployers must ensure their staff have a sufficient level of AI literacy. Article 4, as replaced by Regulation (EU) 2026/1744, asks them to take measures to support the development of AI literacy, and says it does not require them to guarantee any specific level.

It still describes the Digital Omnibus of 19 November 2025, AI changes included, as a proposal. The AI changes were adopted as Regulation (EU) 2026/1744. The separate Digital Omnibus on data protection, data and cybersecurity is still a proposal: the European Parliament's procedure file shows it awaiting a committee decision.

It gives the third penalty tier as 1.5% of total worldwide annual turnover. Article 99(5) sets it at 7.5 million euro or 1%, whichever is higher. For a small or medium-sized business (SME), it is whichever is lower (Article 99(6)).

It says the AI Office of Ireland was established on 2 August 2026. S.I. No. 404 of 2026 appointed 31 July 2026 as the establishment day.

Those differences are a reason to read the legal texts themselves. They are why the dates piece exists.