What is the EU AI Act and which businesses must comply

What is the AI Act

The AI Act is an EU regulation that sets out which uses of artificial intelligence are banned, which are high risk, and what duties fall on those who build AI and those who use it. Because it’s a regulation, it applies directly in every EU country, like the GDPR. It doesn’t need to be transposed into national law.

Its official English name is the Artificial Intelligence Act. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August that year. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, has amended it since 27 July 2026, moving several dates and adding a new ban.

The regulation defines an “AI system” broadly: a machine-based system, with some degree of autonomy, that uses the input it receives to generate predictions, content, recommendations or decisions. Art. 3(1) A language model drafting replies to customers fits. A spreadsheet with fixed formulas doesn’t.

Why it was made

The regulation sets out its own purpose: to improve how the internal market works by setting a uniform legal framework for AI, one that promotes human-centric, trustworthy AI and protects people’s health, safety and fundamental rights.

In practice it tackles two problems. The first is fragmentation: without common rules, each country could write its own, and anyone selling a product with AI in it would have to follow 27 different laws. The second is the risk to people. A system that decides who gets a job interview, who gets credit or who is identified by a camera can discriminate or get things wrong without anyone understanding why.

Its answer is to regulate AI according to risk. Almost everything businesses use day to day (spam filters, translation tools, writing assistants) stays outside the heaviest rules. The more likely a use is to affect people’s lives, the more obligations it carries, and some uses are banned outright.

The four levels of risk

Banned practices

Since 2 February 2025, you may not place on the market or use AI systems that: Art. 5(1)

• manipulate people with subliminal or deceptive techniques that cause them significant harm;
• exploit vulnerabilities linked to age, disability or a person’s social or economic situation;
• carry out social scoring that leads to detrimental or disproportionate treatment;
• predict that someone will commit a crime based only on profiling or personality traits;
• scrape facial images from the internet or CCTV footage in an untargeted way to build facial recognition databases;
• recognise emotions in the workplace or in schools, except for medical or safety reasons;
• infer race, political opinions, trade union membership, religion or sexual orientation from biometric data;
• carry out real-time remote biometric identification in public spaces for law enforcement, apart from a few narrow exceptions.

The Digital Omnibus on AI, the part of the Digital Omnibus that has already been adopted, added a ban that applies from 2 December 2026. It covers systems that generate intimate or sexually explicit images, video or audio of an identifiable person without their consent, and systems that generate child sexual abuse material.

For a small business, the ban most likely to come up is emotion recognition. Software that analyses call centre agents’ voices to measure their emotional state, or cameras that “read” employees’ mood, is caught by it.

High risk

Two groups of AI systems are high risk: those that act as a safety component of products that are already regulated (machinery, toys, medical devices and others), and those used in the eight areas listed in Annex III: Art. 6 and Annex III

1. biometrics;
2. critical infrastructure;
3. education and vocational training;
4. employment, workers’ management and access to self-employment;
5. access to essential private services and essential public services and benefits, such as credit and life and health insurance;
6. law enforcement;
7. migration, asylum and border control;
8. administration of justice and democratic processes.

There’s a way out. A system in an Annex III area isn’t high risk if it only performs a narrow procedural task, improves the result of work a person has already finished, detects patterns without replacing human assessment, or carries out a preparatory task for an assessment. But a system that profiles people is always high risk. Art. 6(3)

If you don’t build AI yourself, recruitment is the example you’re most likely to meet. Software that ranks applications or assesses candidates falls in area 4.

Transparency

Some systems aren’t high risk but still come with a duty to tell people about them. These rules have applied since 2 August 2026: Art. 50

• a provider of a chatbot must design it so that people know they’re talking to a machine, unless that’s obvious;
• a provider of AI that generates text, images, audio or video must mark that content in a machine-readable way. Systems already on the market before 2 August 2026 have four months to catch up, until 2 December 2026;
• anyone who uses emotion recognition or biometric categorisation (where it isn’t banned) must inform the people exposed to it;
• anyone who publishes deepfakes must say the content was generated or manipulated by AI. The same goes for AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and someone takes editorial responsibility.

Minimal risk

Everything else. These systems carry no specific obligations, apart from the AI literacy duty that applies to everyone (see below).

What about models like GPT or Gemini?

General-purpose AI models, the large models behind tools such as ChatGPT, have had their own rules since 2 August 2025. Those rules are for the companies that build the models, not for a business that uses the tool.

Which businesses must comply

The AI Act covers the whole supply chain, and your role decides what you have to do. Art. 2(1)

• Provider: whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Art. 3(3) Most of the obligations for high-risk systems fall on the provider.
• Deployer: whoever uses an AI system under its authority, except in a personal, non-professional activity. Art. 3(4) That’s most businesses: they buy or subscribe to a tool and use it at work.
• Importers, distributors and authorised representatives of AI systems coming from outside the EU.

Size makes no difference. There’s no SME exemption, so a ten-person company using an AI assistant is a deployer. Where SMEs are treated differently is the fine ceiling and some simplified documentation.

The regulation also reaches businesses outside the EU when the output of their AI system is used in the Union. A US provider selling recruitment software to Irish companies has to comply.

It doesn’t cover AI used only for military, defence or national security purposes, AI developed only for scientific research, personal non-professional use, or open-source systems, unless those are high risk, banned or caught by the transparency rules. Art. 2(3), (6), (10) and (12)

What to do now if you only use AI

AI literacy, since 2 February 2025

Take steps so that your staff, and anyone else using AI on your behalf, understand what they’re doing, given their knowledge, the context and the people affected. Art. 4 The Digital Omnibus on AI softened the wording: you have to support the development of that literacy, but you don’t have to guarantee a set level in each person. The Commission and the Member States now have to help, especially SMEs.

In practice, find out which AI tools people in the business are using, write simple rules for them (which data never goes into a chatbot, who checks what comes out) and give the people who use them a short training session. Keep a record of what you did.

Transparency, since 2 August 2026

If your business publishes AI-generated images, video or audio that look real, or AI-generated text on matters of public interest without editorial review, say so. If you have a chatbot on your website, check with the provider that it tells people they’re talking to AI.

High risk, from 2 December 2027

If you use AI in an Annex III area, such as recruitment or assessing staff, you have another year to prepare. From that date, as a deployer you must: Art. 26

• use the system in line with the provider’s instructions;
• assign people with the right skills and authority to oversee it;
• make sure the input data is relevant and representative, where you control it;
• monitor how it works and stop using it if there’s a risk, informing the provider and the authority;
• keep the logs the system generates for at least six months;
• tell workers’ representatives and the affected workers before you use the system in the workplace;
• inform the people the system makes decisions about, or helps make decisions about.

Public bodies, private companies providing public services, and anyone using AI to assess creditworthiness or price life and health insurance must also carry out a fundamental rights impact assessment before first use. Art. 27

The AI Act and the GDPR

The AI Act doesn’t change the GDPR. Art. 2(7) If an AI system processes personal data, both apply: you need a lawful basis, you have to inform people, you need a contract with the supplier and you’ll often need a data protection impact assessment (DPIA). The AI Act itself tells deployers to use the information they get from the provider to carry out the DPIA. Art. 26(9)

If you’re putting AI to work on customer and staff data, our article on AI agents and the GDPR has a checklist of what to look at before you give a tool access to that data. It applies just as well to AI tools that aren’t agents.

The Digital Omnibus on AI also added a rule that overlaps with the GDPR. As an exception, and only where strictly necessary, it allows special categories of personal data to be processed to detect and correct bias in AI systems. The conditions are tight: the data can’t be replaced by synthetic or anonymised data, it can’t be shared with third parties, and it must be deleted as soon as the bias is corrected. Art. 4a

The amendments to the GDPR itself proposed in the Digital Omnibus are a separate text, still under negotiation. Our article on the Digital Omnibus has the latest.

Fines

These are the maximum fines. In each case, whichever amount is higher applies: Art. 99(3) to (5)

• banned practices: up to €35 million or 7% of worldwide annual turnover;
• other obligations, including those for deployers and the transparency rules: up to €15 million or 3%;
• incorrect, incomplete or misleading information given to the authorities: up to €7.5 million or 1%.

For SMEs and start-ups, whichever amount is lower applies. Art. 99(6)

Who enforces it in Ireland

Ireland doesn’t have a single AI regulator. It uses a distributed model: several existing regulators act as market surveillance authorities, each for the uses of AI in its own area, and a new body coordinates them.

That body is the AI Office of Ireland (Oifig IS na hÉireann), set up by the Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026). The Act was signed into law on 21 July 2026 and came into operation on 31 July 2026, the same day the AI Office was established. The Office is independent. It is Ireland’s single point of contact for the AI Act and runs a service desk for businesses and the public. The Act also gives the authorities their enforcement powers, from compliance notices through to prohibition, seizure, administrative fines and prosecution.

The authorities themselves are designated by statutory instrument (S.I. No. 366 of 2025, amended by S.I. No. 405 of 2026). As of 2 November 2026, the AI Office lists 13: the Central Bank of Ireland, Coimisiún na Meán, ComReg, the Commission for Railway Regulation, the Commission for Regulation of Utilities, the Competition and Consumer Protection Commission, the Data Protection Commission, the Health and Safety Authority, the Health Products Regulatory Authority, the Health Service Executive, the Marine Survey Office of the Department of Transport, the National Transport Authority and the Workplace Relations Commission. The Office says the list may grow. If you’re not sure which one covers your use of AI, ask the AI Office.

The Data Protection Commission (DPC) continues to supervise the data protection side of any AI system that processes personal data, under the GDPR and the Data Protection Act 2018. Under the AI Act it is also the market surveillance authority for certain banned practices and certain high-risk uses. The split between AI regulator and data protection authority looks the same elsewhere: in Portugal, for example, the CNPD (Portugal’s data protection authority) keeps the data protection side while the country’s AI Act authorities are still to be named by law.

The AI Act isn’t UK law, but a UK business is still caught by it if it places AI systems on the EU market or if the output of its AI system is used in the EU. Art. 2(1)(a) and (c) For personal data processed in the UK, the UK GDPR and the Data Protection Act 2018 apply, and your regulator is the Information Commissioner’s Office (ICO).

Frequently asked questions

My business only uses ChatGPT. Does the AI Act apply?

Yes, as a deployer. Today that mostly means AI literacy: rules for using the tool and training for the people who use it. If you publish content made with it in a situation the transparency rules cover, you also have to label it. The obligations for the model itself fall on the company that develops it.

Has the AI Act been postponed?

Partly. The Digital Omnibus on AI pushed the high-risk rules back to 2 December 2027 (Annex III areas) and 2 August 2028 (AI in regulated products). The bans and AI literacy have applied since February 2025, the rules for general-purpose AI models since August 2025 and the transparency rules since August 2026.

I use AI to screen CVs. What should I do now?

That’s a high-risk use, and its rules start on 2 December 2027. Until then, the GDPR already requires you to inform candidates, have a lawful basis and make sure no decision with significant effects is made by the machine alone without real human involvement. Art. 22 GDPR In the UK, the UK GDPR has its own rules on automated decisions, explained in the ICO’s guidance. Ask the provider now for the instructions for use and the information you’ll need for your DPIA.

Sources

• Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of 12 July 2024 (EUR-Lex). The reasons for the regulation are in recital 1.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), of 8 July 2026, Official Journal of 24 July 2026 (EUR-Lex)
• European Commission, AI Act Service Desk, consolidated text as of 27 July 2026
• European Commission, Regulatory framework for AI, updated 19 October 2026
• European Commission, Enforcement of the AI Act, updated 20 October 2026
• European Commission, Market surveillance authorities under the AI Act
• Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026), as enacted (Houses of the Oireachtas)
• Department of Enterprise, Tourism and Employment, AI Office of Ireland established under the AI Regulation Bill 2026, Paul Byrne appointed as CEO, 30 July 2026
• S.I. No. 403 of 2026, Regulation of Artificial Intelligence Act 2026 (Commencement) Order 2026 and S.I. No. 404 of 2026 (Establishment Day) Order 2026, 31 July 2026
• S.I. No. 366 of 2025, European Union (Artificial Intelligence) (Designation) Regulations 2025 (Irish Statute Book) and S.I. No. 405 of 2026 (Designation) (Amendment) Regulations 2026
• AI Office of Ireland, National Competent Authorities (checked 2 November 2026)
• ICO, What does the UK GDPR say about automated decision-making, draft guidance updated 31 March 2026
• Data Protection Act 2018 (legislation.gov.uk)
• Regulation (EU) 2016/679 (GDPR), Art. 22 and 35 (EUR-Lex)

Updated: 2 November 2026. This article is general information and isn’t a substitute for legal advice on a specific case.