AI GovernanceUpdated June 11, 2026; refreshed July 8, 202615 min read

What EU AI Act requirements apply to Irish and UK-based organisations?

AAcompli Research

Irish organisations are directly subject to the EU AI Act where they provide, deploy, import, distribute or use AI systems in scope, while UK-based organisations can also fall in scope when they place AI systems on the EU market or where AI system outputs are used in the EU.

Illustration of EU AI Act risk tiers and compliance obligations with Ireland and UK map markers
On this page
1 / 12

01AI Governance

What are the EU AI Act requirements for organisations in Ireland and the UK?

The EU AI Act (Regulation (EU) 2024/1689) is a risk-based regulation that applies directly in Ireland and across the EU. It sorts AI systems into four tiers: prohibited practices under Article 5 (banned since 2 February 2025), high-risk systems under Article 6 with Annex I and Annex III (carrying the heaviest obligations), limited-risk systems with transparency duties under Article 50 (applying from 2 August 2026), and minimal-risk systems with no additional obligations. In the United Kingdom the Act does not apply domestically, but UK organisations must comply when they place AI systems on the EU market or when their system's output is used in the EU.

What an organisation must actually do depends on its role for each system - provider or deployer - and on the system's risk tier. In Ireland, enforcement is distributed: eight national competent authorities were designated under S.I. No. 366/2025, including the Data Protection Commission (DPC), and an AI Office of Ireland is planned as the coordinating authority under the Regulation of Artificial Intelligence Bill 2026, which is not yet enacted. The UK has no AI Act equivalent and follows a principles-based, regulator-led approach through the ICO and sectoral regulators. In both jurisdictions, the GDPR continues to apply in full wherever an AI system processes personal data.

  • Ireland: the Act applies directly. Eight national competent authorities were designated under S.I. No. 366/2025 - including the DPC, the Central Bank of Ireland, the CCPC, ComReg, the Health and Safety Authority and the HPRA - with five more announced in September 2025 awaiting formalisation, to be coordinated by a planned AI Office of Ireland.
  • UK: there is no domestic AI Act equivalent. The UK follows a principles-based, regulator-led approach through the ICO and sectoral regulators, alongside the AI Safety/Security Institute - but the EU AI Act reaches UK firms extraterritorially under Article 2.
  • Both jurisdictions: where an AI system processes personal data, GDPR duties continue in full - Article 30 records of processing and, for high-risk processing, an Article 35 DPIA - enforced by the DPC in Ireland and the ICO in the UK.
  • Already applying: the Article 5 prohibitions and the Article 4 AI literacy duty since 2 February 2025, and general-purpose AI model obligations since 2 August 2025.

02AI Governance

What is the first EU AI Act compliance step for Irish and UK organisations?

The first step is to create an AI inventory that records each AI system, purpose, owner, vendor, user group, data inputs, output use, geography, role, risk tier, evidence and review status.

For most Irish organisations, that inventory supports scope, role and risk classification under the EU AI Act. For UK-based organisations, it helps identify whether an EU market, EU use or EU-output link brings the system into scope. In Acompli, that inventory is a live record: each AI system carries its owner, role, risk tier and classification rationale, and every entry is routed to a named reviewer for approval.

  • System name and owner.
  • Business purpose and user group.
  • Whether the organisation is provider, deployer, importer, distributor or another operator.
  • Whether the system is internal, vendor-supplied or customer-facing.
  • Whether the system may fall into prohibited, high-risk, limited-risk or minimal-risk categories.
  • Whether Article 50 transparency duties may apply.
  • What evidence exists for human oversight, policies, testing, monitoring and approvals.
  • When the system must be reviewed again.

03AI Governance

The risk-based framework: four tiers of obligation

The Act regulates by risk, not by technology. The same underlying model can sit in different tiers depending on what the system is used for, and the obligations attach to the use case. Classification is therefore the first compliance task: every AI system in scope needs a documented tier decision before the organisation can know which duties apply to it.

The four tiers, and the headline obligation attached to each, are set out below.

  • Prohibited practices (Article 5): banned outright, applying since 2 February 2025.
  • High-risk systems (Article 6, with Annex I and Annex III): permitted but subject to the Act's core compliance regime - providers must complete a conformity assessment before placing the system on the EU market, and deployers carry use, oversight and, in some cases, fundamental rights impact assessment duties.
  • Transparency-risk systems (Article 50): systems that interact with people, generate or manipulate content, or perform emotion recognition or biometric categorisation carry disclosure duties from 2 August 2026.
  • Minimal-risk systems: no additional obligations beyond the cross-cutting Article 4 AI literacy duty, which has applied to providers and deployers across all tiers since 2 February 2025.

04AI Governance

When do the obligations apply? The EU AI Act timeline

Application is staged. Several tranches already apply, the Article 50 transparency date of 2 August 2026 is settled, and the high-risk dates are the one moving part. Under current law, high-risk obligations apply from 2 August 2026 for Annex III systems and from 2 August 2027 for high-risk AI embedded in Annex I regulated products.

The 'Digital Omnibus' package, provisionally agreed on 7 May 2026 but not yet in force, would move those high-risk dates to 2 December 2027 and 2 August 2028 respectively. Until the Omnibus is formally adopted, organisations should plan against the current statutory dates and treat the later dates as provisional.

DateWhat starts to apply
2 February 2025Article 5 prohibited practices are banned, and the Article 4 AI literacy duty applies to providers and deployers across all risk tiers.
2 August 2025General-purpose AI (GPAI) model obligations apply to providers. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.
2 August 2026Article 50 transparency obligations apply, and the European Commission's AI Office gains its GPAI enforcement powers.
2 August 2026 (current law)High-risk obligations for Annex III systems apply. The provisionally agreed Digital Omnibus (not yet in force) would move this to 2 December 2027.
2 August 2027 (current law)High-risk obligations for AI embedded in Annex I regulated products apply. The provisionally agreed Digital Omnibus (not yet in force) would move this to 2 August 2028.

05AI Governance

Who must do what: provider duties vs deployer duties

The Act assigns obligations by role. A provider develops an AI system or places it on the EU market under its own name; a deployer uses an AI system under its own authority. Most organisations in Ireland and the UK are deployers of vendor-supplied AI for most of their systems, and deployer duties are lighter than provider duties - but they are real, and some have applied since February 2025.

The same organisation can hold both roles at once: a deployer of a procured HR screening tool can simultaneously be the provider of an AI feature it builds into its own product. The role decision therefore has to be made system by system and recorded.

  • Providers: must not place prohibited systems on the market; must complete a conformity assessment for high-risk systems before placing them on the EU market; providers of Annex III high-risk systems must register them in the EU database under Article 49; GPAI model providers carry the model obligations applying since 2 August 2025; and Article 50 transparency duties apply from 2 August 2026.
  • Deployers: must not use prohibited systems; carry the Article 4 AI literacy duty (since 2 February 2025); meet Article 50 transparency duties for in-scope systems from 2 August 2026; carry use and oversight duties for high-risk systems when the high-risk regime applies; and certain deployers must complete an Article 27 fundamental rights impact assessment before first use of a high-risk system.
  • Scope limit on registration: merely using a vendor-supplied high-risk tool does not require a deployer to register it in the EU database - only deployers that are public authorities register their use.
  • Both roles, both jurisdictions: where the system processes personal data, the GDPR applies in parallel - Article 30 records and, for high-risk processing, an Article 35 DPIA.

06AI Governance

Registration under Article 49: most organisations do not register

Registration in the EU database under Articles 49 and 71 is far narrower than many buyers assume. Providers of Annex III high-risk AI systems must register those systems in the EU database, and deployers that are public authorities must register their use of such systems. A company that merely uses a high-risk tool supplied by a vendor does not register it, and limited-risk and minimal-risk systems are never registered.

The practical consequence is that for most Irish and UK organisations the registration duty simply does not arise. What does remain worthwhile is an internal AI inventory with a documented tier and role decision for each system - not because Article 49 requires it of deployers, but because it is the evidence base every other obligation in this guide depends on. Acompli maintains that inventory with the tier and role decision recorded per system, so the evidence base exists even where no registration duty arises.

  • Must register: providers of Annex III high-risk AI systems, in the EU database.
  • Must register their use: deployers that are public authorities using Annex III high-risk systems.
  • Do not register: private organisations merely using a vendor-supplied high-risk tool.
  • Never registered: limited-risk (Article 50) and minimal-risk systems.

07AI Governance

Which systems are high-risk? The Annex III areas

Annex III lists eight areas in which AI systems are classified as high-risk under Article 6. The list is use-case based, and the European Commission can amend it, so classification should be treated as a living judgement that is revisited as the list and the organisation's systems change. The eight areas are:

  • Biometrics.
  • Critical infrastructure.
  • Education and vocational training.
  • Employment and worker management.
  • Access to essential private and public services, including creditworthiness assessment and life and health insurance pricing.
  • Law enforcement.
  • Migration, asylum and border control.
  • Administration of justice and democratic processes.

08AI Governance

Article 27: who must complete a fundamental rights impact assessment (FRIA)?

Article 27 requires certain deployers to complete a fundamental rights impact assessment before first use of a high-risk AI system. The duty falls on deployers that are public bodies or private operators providing public services, and on deployers of certain Annex III systems - specifically systems used for credit-scoring and for risk-pricing in life and health insurance.

The FRIA complements rather than replaces a GDPR Article 35 DPIA, so where a high-risk AI system processes personal data both assessments can apply, and evidence can be reused across them. For a side-by-side comparison of the DPIA and the FRIA, see the DPIA tools comparison guide in the related research below.

09AI Governance

Penalties under Article 99

Article 99 sets three tiers of administrative fines, each expressed as a fixed amount or a percentage of total worldwide annual turnover. For SMEs and start-ups the Act softens the regime: each fine is capped at the lower of the fixed amount and the turnover percentage.

In Ireland these penalties will be applied through the designated national competent authorities. In the UK there are no domestic AI Act fines, but a UK organisation in scope under Article 2 faces the same EU penalty tiers for its EU-facing systems - and the ICO can separately enforce UK GDPR penalties where AI processing of personal data breaches UK data protection law.

  • Prohibited practices (Article 5): up to EUR 35 million or 7% of total worldwide annual turnover.
  • Most other obligations, including Article 50 transparency duties and deployer duties: up to EUR 15 million or 3% of total worldwide annual turnover.
  • Supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1% of total worldwide annual turnover.
  • SMEs and start-ups: each fine is capped at the lower of the two amounts.

10AI Governance

The GDPR overlay: RoPA and DPIA duties still apply

The EU AI Act does not displace the GDPR. In both Ireland and the UK, an AI system that processes personal data must appear in the organisation's Article 30 record of processing activities (RoPA), and where the processing is likely to result in a high risk to individuals, an Article 35 DPIA is required before the processing begins. The DPC enforces these duties in Ireland under the EU GDPR, and the ICO enforces them in the UK under the UK GDPR - and in the UK this GDPR layer applies even though the AI Act itself does not apply domestically.

For most organisations the GDPR record is the foundation the AI Act evidence builds on: the Article 30 entry establishes what the system processes and why, and the DPIA carries most of the personal-data risk analysis that an AI Act file needs. With Acompli, each AI system links to its Article 30 entry and its DPIA, so the GDPR record and the AI Act evidence stay one connected file. The RoPA and DPIA guides linked under related research and related tools below cover those obligations in detail.

  • Article 30 RoPA: record the AI processing, its purposes, data categories, recipients, transfers and retention - in Ireland under the EU GDPR and in the UK under the UK GDPR.
  • Article 35 DPIA: required where AI processing is likely to result in a high risk to individuals; AI-driven profiling and innovative technology commonly trigger it.
  • Enforcement: the DPC (Ireland) and the ICO (UK) enforce the GDPR overlay in parallel with any AI Act duties.

11AI Governance

Ireland vs the UK: a side-by-side comparison

The same AI system can carry materially different statutory duties depending on which side of the Irish Sea it is deployed. The table below summarises how the position differs for an organisation operating in both markets.

Ireland (EU AI Act applies directly)United Kingdom (no domestic AI Act)
Legal status: Regulation (EU) 2024/1689 applies directly as EU law, on the staged timeline above.Legal status: the EU AI Act does not apply domestically, and the UK has no AI Act equivalent.
Regulatory model: distributed enforcement by national competent authorities - eight designated under S.I. No. 366/2025, including the DPC, the Central Bank of Ireland, the CCPC, ComReg, the Health and Safety Authority and the HPRA, with five more announced in September 2025 awaiting formalisation.Regulatory model: principles-based and regulator-led, through the ICO and sectoral regulators, alongside the AI Safety/Security Institute.
Coordination: an AI Office of Ireland is planned under the Regulation of Artificial Intelligence Bill 2026; the Bill is not yet enacted, with the office targeted to be operational around 1 August 2026.Coordination: no single AI statute or coordinating AI authority; existing regulators apply cross-sector principles within their own remits.
Extraterritorial exposure: not applicable - the Act already applies in Ireland.Extraterritorial exposure: UK organisations are in scope under Article 2 when they place AI systems on the EU market or when their system's output is used in the EU.
AI Act penalties: Article 99 tiers of up to EUR 35 million or 7% of worldwide annual turnover, applied through the designated national authorities.AI Act penalties: none domestically, but the EU tiers reach UK firms caught by Article 2.
Registration: providers of Annex III high-risk systems register in the EU database; public-authority deployers register their use.Registration: the same Article 49 duty applies to UK providers only when they place Annex III high-risk systems on the EU market.
GDPR overlay: Article 30 RoPA and Article 35 DPIA duties enforced by the DPC under the EU GDPR.GDPR overlay: Article 30 RoPA and Article 35 DPIA duties enforced by the ICO under the UK GDPR.

12AI Governance

How Acompli supports EU AI Act readiness

Acompli supports EU AI Act readiness alongside GDPR workflows. The platform helps teams inventory AI systems, classify each one by role and risk tier with the rationale recorded, draft and structure assessment content, and route every output to a named reviewer for approval. The AI System Register and Member-State conformity templates are available on opt-in (early access), not as shipped guarantees for every organisation. The software assists, drafts, classifies and surfaces; a human always reviews and approves, and final legal calls rest with your DPO or legal advisers.

Because AI Act evidence and GDPR evidence share the same underlying facts, the practical goal is one connected record: AI systems linked to their Article 30 entries, DPIAs, risks and suppliers, so the organisation can show how each classification and transparency position was reached. This guide is general information for compliance teams comparing obligations across Ireland and the UK; it is not legal advice, and the obligations that apply to a specific system should be confirmed with your own legal advisers.

Where Acompli fits for EU AI Act readiness

Best for teams that need AI Act evidence connected to GDPR records: Acompli keeps an AI inventory with owners, roles, risk tiers, classification rationale and review dates linked to the relevant Article 30 entries, DPIAs, suppliers and risks. The AI System Register and Member-State conformity templates are opt-in early access, so they should be treated as available readiness capabilities rather than universal shipped guarantees; every classification and legal judgement remains human-approved.

See Acompli EU AI Act workflows

Primary sources

EU AI Act requirements FAQ

Does the EU AI Act apply in Ireland?

Yes. The EU AI Act is directly applicable in Ireland and applies to organisations that fall within its scope as providers, deployers, importers, distributors or other operators.

Can the EU AI Act apply to UK-based organisations?

Yes. UK-based organisations can be in scope if they place AI systems on the EU market, put AI systems into service in the EU or if AI system outputs are used in the EU.

What is the first step for EU AI Act readiness?

The first step is to create an AI inventory that records systems, owners, purposes, vendors, roles, risk tiers, evidence and review dates.

Who enforces the EU AI Act in Ireland?

Ireland is using a distributed model of competent authorities coordinated by an AI Office of Ireland. The exact operational model should be checked against the latest Irish legislation and government notices before publication.

Has the Digital Omnibus changed the AI Act deadlines?

As of 11 June 2026, official EU sources showed that Digital Omnibus changes to the AI Act had reached provisional agreement but had not yet entered into force. Treat changes as provisional or pending unless formal adoption and publication are confirmed.

Does the EU AI Act apply in the UK?

No, not domestically. The EU AI Act (Regulation (EU) 2024/1689) does not apply within the United Kingdom, and the UK has no equivalent AI statute; it follows a principles-based, regulator-led approach through the ICO and sectoral regulators, alongside the AI Safety/Security Institute. However, UK organisations are caught extraterritorially under Article 2 when they place AI systems on the EU market or when their system's output is used in the EU. UK GDPR and ICO guidance also continue to govern any AI that processes personal data in the UK.

Do we need to register our AI systems under the EU AI Act?

Mostly no. Registration in the EU database under Articles 49 and 71 applies to providers of Annex III high-risk AI systems, and deployers that are public authorities must register their use of such systems. A company that merely uses a high-risk tool supplied by a vendor does not register it, and limited-risk and minimal-risk systems are never registered. Most Irish and UK organisations are deployers of vendor-supplied AI, so for most buyers the registration duty does not arise - although an internal AI inventory with documented tier and role decisions remains the evidence base the Act's other obligations depend on.

Who enforces the EU AI Act in Ireland under S.I. No. 366/2025?

Ireland uses a distributed enforcement model. Eight national competent authorities were designated under S.I. No. 366/2025, including the Data Protection Commission, the Central Bank of Ireland, the Competition and Consumer Protection Commission, ComReg, the Health and Safety Authority and the Health Products Regulatory Authority, with five further authorities announced in September 2025 awaiting formalisation. They are to be coordinated by an AI Office of Ireland under the Regulation of Artificial Intelligence Bill 2026; the Bill is not yet enacted, so the office should be treated as planned rather than operational, with a target of around 1 August 2026. Where an AI system processes personal data, the DPC also enforces the GDPR in parallel.

What penalties apply under the EU AI Act for organisations in Ireland and the UK?

Article 99 sets three tiers of administrative fines. Prohibited practices under Article 5 attract fines of up to EUR 35 million or 7% of total worldwide annual turnover. Breaches of most other obligations, including the Article 50 transparency duties and deployer duties, attract up to EUR 15 million or 3%. Supplying incorrect, incomplete or misleading information to authorities attracts up to EUR 7.5 million or 1%. For SMEs and start-ups, each fine is capped at the lower of the fixed amount and the turnover percentage. In Ireland the tiers are applied through the designated national competent authorities; the Act sets no domestic UK fines, but a UK firm in scope under Article 2 faces the same EU tiers.

Will the Digital Omnibus delay the EU AI Act's high-risk deadlines?

Possibly, but it is not law yet. Under current law the high-risk obligations apply from 2 August 2026 for Annex III systems and from 2 August 2027 for high-risk AI embedded in Annex I regulated products. The Digital Omnibus package was provisionally agreed on 7 May 2026 but is not yet in force; if adopted, it would move those dates to 2 December 2027 and 2 August 2028 respectively. The Article 50 transparency date of 2 August 2026 is settled. Until the Omnibus formally enters into force, organisations should plan against the current statutory dates and treat the later dates as provisional.

Do organisations that only use AI tools have obligations under the EU AI Act?

Yes. Deployers - organisations using AI systems under their own authority - carry real duties even though they are lighter than provider duties. The Article 4 AI literacy duty has applied to deployers across all risk tiers since 2 February 2025. Article 50 transparency duties for in-scope systems apply from 2 August 2026. Deployers of Annex III high-risk systems carry use and oversight duties when the high-risk regime applies, and certain deployers - public bodies, private operators providing public services, and deployers of credit-scoring or life and health insurance risk-pricing systems - must complete an Article 27 fundamental rights impact assessment before first use. What deployers do not have to do is register vendor-supplied tools in the EU database; that duty sits with providers and with public-authority deployers only.

Which deployers must complete a FRIA under Article 27?

Article 27 requires a fundamental rights impact assessment from deployers that are public bodies or private operators providing public services, and from deployers of certain Annex III high-risk systems - specifically systems used for credit-scoring and for risk-pricing in life and health insurance. The assessment must be completed before the high-risk system is first used. The FRIA complements rather than replaces a GDPR Article 35 DPIA, so where the AI system processes personal data both assessments can apply and evidence can be reused across them.

Do AI systems still need GDPR records and DPIAs in Ireland and the UK?

Yes. The EU AI Act sits on top of the GDPR rather than replacing it. In both jurisdictions, an AI system that processes personal data must be recorded in the organisation's Article 30 record of processing activities, and where the processing is likely to result in a high risk to individuals an Article 35 DPIA is required before processing begins. The DPC enforces these duties in Ireland under the EU GDPR and the ICO enforces them in the UK under the UK GDPR - and in the UK this GDPR layer applies even though the AI Act itself does not apply domestically. For most organisations the GDPR record is the foundation that AI Act evidence builds on.

Can software make us EU AI Act compliant on its own?

No. Software can assist by inventorying AI systems, drafting and structuring assessment content, classifying systems for review, and routing outputs for sign-off, which saves time and keeps the evidence consistent. But classification decisions, fundamental rights impact assessments and final legal calls require human judgement and must be approved by a person, typically with input from the DPO or legal advisers. Acompli's EU AI Act capabilities are built on that model: the software drafts, classifies and surfaces, a human reviews and approves, and the AI System Register and Member-State conformity templates are available on opt-in (early access).

Market-specific questions (Deutschland / France / Nederland)

Welche Behörde überwacht die EU-KI-Verordnung in Deutschland?

In Deutschland soll die Bundesnetzagentur die zentrale nationale Marktüberwachungsbehörde für die EU-KI-Verordnung werden, als zentrale Anlaufstelle, zentrale Beschwerdestelle und notifizierende Behörde, während sektorspezifische Stellen (etwa die BaFin für den Finanzsektor) ihre Bereiche übernehmen und die Datenschutzbehörden mitwirken. Geschaffen wird diese Struktur durch das nationale Durchführungsgesetz (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG). Stand Mitte 2026 war das Gesetz noch nicht vollständig in Kraft (Kabinettsbeschluss am 11. Februar 2026, Bundestag am 11. Juni 2026, Zustimmung des Bundesrates noch ausstehend); Deutschland hatte die Benennungsfrist der KI-Verordnung (2. August 2025) nicht eingehalten.

Quelle autorité supervise le règlement IA en France ?

La France applique le règlement IA selon un modèle multi-autorités plutôt qu'avec un régulateur unique. La CNIL est appelée à superviser les pratiques d'IA interdites et les systèmes à haut risque dans des domaines sensibles (biométrie, emploi, forces de l'ordre, contrôle aux frontières, processus démocratiques), tandis que la DGCCRF assure une coordination et que d'autres autorités sectorielles (Arcom, ACPR, ANSM) couvrent leurs domaines. Ces désignations passent par le projet de loi DDADUE, qui modifie la loi de 1978 ; le volet numérique a été voté au Sénat le 17 février 2026, mais la France avait dépassé l'échéance de désignation du 2 août 2025 et la loi n'était pas encore pleinement adoptée. La CNIL est l'une de plusieurs autorités désignées, et non l'unique autorité chef de file.

Welke autoriteit houdt toezicht op de EU AI-verordening in Nederland?

Nederland kiest voor een gedecentraliseerd model met ongeveer acht markttoezichthouders. De Autoriteit Persoonsgegevens (AP) en de Rijksinspectie Digitale Infrastructuur (RDI) coördineren samen, waarbij de RDI als centraal contactpunt fungeert; de AP zou toezicht houden op verboden AI-praktijken, de meeste hoog-risico (bijlage III) systemen en de transparantieverplichtingen, naast sectortoezichthouders zoals de AFM en DNB (financiën) en de IGJ (zorg). Deze rollen staan in het concept van de Uitvoeringswet AI-verordening, dat van 20 april tot 1 juni 2026 ter consultatie lag. Medio 2026 waren de aanwijzingen nog voorlopig en had Nederland de aanwijzingsdeadline van 2 augustus 2025 niet gehaald.

Related Research

Related Tools