Who regulates AI in Ireland, and which one is yours

Article 70 of the AI Act requires each member state to designate national competent authorities and a single point of contact. It does not require a new regulator, and Ireland did not create one for supervision. It distributed the job across the regulators that already supervise the sectors AI is used in.

The practical effect is that your AI Act regulator is decided by your industry, not by your technology. A recruitment tool used by an Irish employer is supervised by the body that supervises employment. The same tool used inside a bank engages the Central Bank. The personal data going through either engages the Data Protection Commission.

That has one clear advantage and one clear cost. The advantage is that the supervisor already understands the sector. The cost is that a business with an ordinary spread of activities can have three regulators with an interest in the same system, and none of them is the obvious first phone call.

The instrument is the European Union (Artificial Intelligence) (Designation) Regulations 2025, S.I. No. 366 of 2025, made by the Minister for Enterprise, Tourism and Employment under section 3 of the European Communities Act 1972. It was given under the Minister's official seal on 25 July 2025, and notice of its making was published in Iris Oifigiúil on 29 July 2025.

Read in full, it does four things. It designates the Minister as a national competent authority and as the single point of contact under Article 70(2). It designates six market surveillance authorities against the fourteen rows of its Schedule, mapping each point of Section A of Annex I to a regulator: the Health and Safety Authority, the Competition and Consumer Protection Commission, the Marine Survey Office, the Commission for Communications Regulation, the Commission for Railway Regulation and the Health Products Regulatory Authority. It designates the Central Bank of Ireland for the purposes of Article 74(6) and the Data Protection Commission for the purposes of Article 74(8). And it names notifying authorities under Article 28.

Those Annex I points are the product safety route into the Act: machinery, toys, lifts, radio equipment, medical devices and the rest. They are the reason the Health and Safety Authority appears four times in one Schedule.

The Department of Enterprise, Tourism and Employment publishes the working list. As fetched on 31 August 2026 it names fourteen bodies. Four of them cover most of what an ordinary Irish business does.

The coordination problem that comes with a distributed model is what the AI Office of Ireland exists to answer. It was established under the Regulation of Artificial Intelligence Act 2026, which the Department confirms was signed into law by President Connolly on 21 July 2026. The Bill is recorded in the Oireachtas register as the Regulation of Artificial Intelligence Bill 2026, Bill No. 69 of 2026, with a status of enacted.

The Office is Ireland's central coordinating authority for implementing the AI Act. On the Department's own account it acts as the single point of contact for the European Commission, for the national sectoral regulators and for the public, works towards a consistent regulatory approach across the designated authorities, gives those authorities centralised access to technical expertise, and has a remit to drive AI innovation and adoption alongside the supervisory work.

Its first chief executive is Paul Byrne, whose appointment was announced on 30 July 2026, and it was to be operational by 2 August 2026.

It is very new. That is worth holding in mind before reading anything that presents Irish AI supervision as a settled machine.

We have not found a published Irish AI Act enforcement action, and we would rather say that plainly than imply an enforcement climate that does not exist yet. That is a statement about what is published, not proof that nothing has happened: regulators are not obliged to announce every step they take.

There is a live Irish enforcement record on the adjacent regulation, and it is where a business should look for its sense of exposure. The Data Protection Commission publishes decisions, including against small organisations, and the pattern in them is consistent: an incident starts the investigation and the missing paperwork is what the fine is for.

Coimisiún na Meán has an enforcement record too, under the Digital Services Act rather than the AI Act. Which Irish body regulates what online sets that out.

For an ordinary Irish employer the WRC is the interesting entry, because employment is where the Act's live prohibition sits rather than where its deferred obligations sit.

Article 5 prohibits the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended to be put in place or on the market for medical or safety reasons. That has applied since 2 February 2025 and carries the top penalty tier.

One definitional point is worth knowing before anybody panics. Article 3(39) defines an emotion recognition system as one inferring emotions or intentions on the basis of biometric data. A tool that scores a written answer for tone is not obviously inside that definition; a tool that scores a candidate's face or voice in a recorded interview plainly is.

The WRC has a page on the AI Act. It is an explanatory page rather than published guidance, and the Commission's supervisory framework in Ireland is still being built out.

The Department's EU AI Act page is the most useful Irish list of authorities in existence and it is also, as fetched on 31 August 2026, out of date on the dates and wrong on one number.

It states that the rules on high-risk AI systems for Annex III use cases come into effect on 2 August 2026 and for Annex I products on 2 August 2027. Both moved: Regulation (EU) 2026/1744 took Annex III to 2 December 2027 and Annex I to 2 August 2028, and the Commission's own regulatory framework page now carries the later dates. The Department's page still describes the Digital Omnibus as a proposal.

It also gives the third penalty tier as 1.5% of total worldwide annual turnover. Article 99(5) sets it at 7.5 million euro or 1%.

None of that is a criticism worth much on its own. It is a reason to read the Regulation rather than a summary of it, and it is why the dates piece exists.