AI GovernanceUpdated September 19, 202615 min read

What EU AI Act requirements apply to Irish and UK-based organisations?

AAcompli Research

Irish organisations are directly subject to the EU AI Act where they provide, deploy, import, distribute or use AI systems in scope, while UK-based organisations can also fall in scope when they place AI systems on the EU market or where AI system outputs are used in the EU.

Illustration of EU AI Act risk tiers and compliance obligations with Ireland and UK map markers
On this page
1 / 12

01AI Governance

What are the EU AI Act requirements for organisations in Ireland and the UK?

The EU AI Act (Regulation (EU) 2024/1689) is a risk-based regulation that applies directly in Ireland and across the EU. It sorts AI systems into four tiers: prohibited practices under Article 5 (banned since 2 February 2025), high-risk systems under Article 6 with Annex I and Annex III (carrying the heaviest obligations), limited-risk systems with transparency duties under Article 50 (applying from 2 August 2026), and minimal-risk systems with no additional obligations. In the United Kingdom the Act does not apply domestically, but UK organisations must comply when they place AI systems on the EU market or when their system's output is used in the EU.

What an organisation must actually do depends on its role for each system - provider or deployer - and on the system's risk tier. In Ireland, enforcement is distributed: the AI Office of Ireland is an independent statutory body established under the Regulation of Artificial Intelligence Act 2026 and coordinates implementation with national and sectoral authorities. The UK has no AI Act equivalent and follows a principles-based, regulator-led approach through the ICO and sectoral regulators. In both jurisdictions, the GDPR continues to apply in full wherever an AI system processes personal data.

  • Ireland: the Act applies directly. Implementation is coordinated by the AI Office of Ireland, an independent statutory body established under the Regulation of Artificial Intelligence Act 2026, working with national and sectoral authorities.
  • UK: there is no domestic AI Act equivalent. The UK follows a principles-based, regulator-led approach through the ICO and sectoral regulators, alongside the AI Safety/Security Institute - but the EU AI Act reaches UK firms extraterritorially under Article 2.
  • Both jurisdictions: where an AI system processes personal data, GDPR duties continue in full - Article 30 records of processing and, for high-risk processing, an Article 35 DPIA - enforced by the DPC in Ireland and the ICO in the UK.
  • Already applying: Article 5 prohibitions, general AI literacy provisions (simplified by the AI Omnibus), and general-purpose AI model obligations.

02AI Governance

What is the first EU AI Act compliance step for Irish and UK organisations?

The first step is to create an AI inventory that records each AI system, purpose, owner, vendor, user group, data inputs, output use, geography, role, risk tier, evidence and review status.

For most Irish organisations, that inventory supports scope, role and risk classification under the EU AI Act. For UK-based organisations, it helps identify whether an EU market, EU use or EU-output link brings the system into scope. In Acompli, that inventory is a live record: each AI system carries its owner, role, risk tier and classification rationale, and every entry is routed to a named reviewer for approval.

  • System name and owner.
  • Business purpose and user group.
  • Whether the organisation is provider, deployer, importer, distributor or another operator.
  • Whether the system is internal, vendor-supplied or customer-facing.
  • Whether the system may fall into prohibited, high-risk, limited-risk or minimal-risk categories.
  • Whether Article 50 transparency duties may apply.
  • What evidence exists for human oversight, policies, testing, monitoring and approvals.
  • When the system must be reviewed again.

03AI Governance

The risk-based framework: four tiers of obligation

The Act regulates by risk, not by technology. The same underlying model can sit in different tiers depending on what the system is used for, and the obligations attach to the use case. Classification is therefore the first compliance task: every AI system in scope needs a documented tier decision before the organisation can know which duties apply to it.

The four tiers, and the headline obligation attached to each, are set out below.

  • Prohibited practices (Article 5): banned outright, applying since 2 February 2025.
  • High-risk systems (Article 6, with Annex I and Annex III): permitted but subject to the Act's core compliance regime - providers must complete a conformity assessment before placing the system on the EU market, and deployers carry use, oversight and, in some cases, fundamental rights impact assessment duties.
  • Transparency-risk systems (Article 50): systems that interact with people, generate or manipulate content, or perform emotion recognition or biometric categorisation carry disclosure duties from 2 August 2026.
  • Minimal-risk systems: no risk-tier obligations, while organisations should maintain proportionate AI literacy measures.

04AI Governance

When do the obligations apply? The EU AI Act timeline

Application is staged. Several tranches already apply, including Article 50 transparency obligations from 2 August 2026. The AI Omnibus entered into force on 27 July 2026 and moved the high-risk milestones to 2 December 2027 for Annex III systems and 2 August 2028 for high-risk AI embedded in Annex I regulated products.

Certain providers of systems generating synthetic content that were already on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). Use the European Commission's implementation timeline for the current milestones.

DateWhat starts to apply
2 February 2025Article 5 prohibited practices are banned; general provisions, including AI literacy, began to apply. The AI Omnibus simplifies the AI literacy requirement.
2 August 2025General-purpose AI (GPAI) model obligations apply to providers. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.
2 August 2026Article 50 transparency obligations apply, and the European Commission's AI Office gains its GPAI enforcement powers.
2 December 2026Article 50(2) transition ends for certain pre-existing systems generating synthetic content.
2 December 2027High-risk obligations for Annex III systems apply under the AI Omnibus timeline.
2 August 2028High-risk obligations for AI embedded in Annex I regulated products apply under the AI Omnibus timeline.

05AI Governance

Who must do what: provider duties vs deployer duties

The Act assigns obligations by role. A provider develops an AI system or places it on the EU market under its own name; a deployer uses an AI system under its own authority. Most organisations in Ireland and the UK are deployers of vendor-supplied AI for most of their systems, and deployer duties are lighter than provider duties - but they are real, and some have applied since February 2025.

The same organisation can hold both roles at once: a deployer of a procured HR screening tool can simultaneously be the provider of an AI feature it builds into its own product. The role decision therefore has to be made system by system and recorded.

  • Providers: must not place prohibited systems on the market; must complete a conformity assessment for high-risk systems before placing them on the EU market; providers of Annex III high-risk systems must register them in the EU database under Article 49; GPAI model providers carry the model obligations applying since 2 August 2025; and Article 50 transparency duties apply from 2 August 2026.
  • Deployers: must not use prohibited systems; maintain proportionate AI literacy measures; meet Article 50 transparency duties for in-scope systems; carry use and oversight duties for high-risk systems when the high-risk regime applies; and certain deployers must complete an Article 27 fundamental rights impact assessment before first use of a high-risk system.
  • Scope limit on registration: merely using a vendor-supplied high-risk tool does not require a deployer to register it in the EU database - only deployers that are public authorities register their use.
  • Both roles, both jurisdictions: where the system processes personal data, the GDPR applies in parallel - Article 30 records and, for high-risk processing, an Article 35 DPIA.

06AI Governance

Registration under Article 49: most organisations do not register

Registration in the EU database under Articles 49 and 71 is far narrower than many buyers assume. Providers of Annex III high-risk AI systems must register those systems in the EU database, and deployers that are public authorities must register their use of such systems. A company that merely uses a high-risk tool supplied by a vendor does not register it, and limited-risk and minimal-risk systems are never registered.

The practical consequence is that for most Irish and UK organisations the registration duty simply does not arise. What does remain worthwhile is an internal AI inventory with a documented tier and role decision for each system - not because Article 49 requires it of deployers, but because it is the evidence base every other obligation in this guide depends on. Acompli maintains that inventory with the tier and role decision recorded per system, so the evidence base exists even where no registration duty arises.

  • Must register: providers of Annex III high-risk AI systems, in the EU database.
  • Must register their use: deployers that are public authorities using Annex III high-risk systems.
  • Do not register: private organisations merely using a vendor-supplied high-risk tool.
  • Never registered: limited-risk (Article 50) and minimal-risk systems.

07AI Governance

Which systems are high-risk? The Annex III areas

Annex III lists eight areas in which AI systems are classified as high-risk under Article 6. The list is use-case based, and the European Commission can amend it, so classification should be treated as a living judgement that is revisited as the list and the organisation's systems change. The eight areas are:

  • Biometrics.
  • Critical infrastructure.
  • Education and vocational training.
  • Employment and worker management.
  • Access to essential private and public services, including creditworthiness assessment and life and health insurance pricing.
  • Law enforcement.
  • Migration, asylum and border control.
  • Administration of justice and democratic processes.

08AI Governance

Article 27: who must complete a fundamental rights impact assessment (FRIA)?

Article 27 requires certain deployers to complete a fundamental rights impact assessment before first use of a high-risk AI system. The duty falls on deployers that are public bodies or private operators providing public services, and on deployers of certain Annex III systems - specifically systems used for credit-scoring and for risk-pricing in life and health insurance.

The FRIA complements rather than replaces a GDPR Article 35 DPIA, so where a high-risk AI system processes personal data both assessments can apply, and evidence can be reused across them. For a side-by-side comparison of the DPIA and the FRIA, see the DPIA tools comparison guide in the related research below.

09AI Governance

Penalties under Article 99

Article 99 sets three tiers of administrative fines, each expressed as a fixed amount or a percentage of total worldwide annual turnover. For SMEs and start-ups the Act softens the regime: each fine is capped at the lower of the fixed amount and the turnover percentage.

In Ireland these penalties will be applied through the designated national competent authorities. In the UK there are no domestic AI Act fines, but a UK organisation in scope under Article 2 faces the same EU penalty tiers for its EU-facing systems - and the ICO can separately enforce UK GDPR penalties where AI processing of personal data breaches UK data protection law.

  • Prohibited practices (Article 5): up to EUR 35 million or 7% of total worldwide annual turnover.
  • Most other obligations, including Article 50 transparency duties and deployer duties: up to EUR 15 million or 3% of total worldwide annual turnover.
  • Supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1% of total worldwide annual turnover.
  • SMEs and start-ups: each fine is capped at the lower of the two amounts.

10AI Governance

The GDPR overlay: RoPA and DPIA duties still apply

The EU AI Act does not displace the GDPR. In both Ireland and the UK, an AI system that processes personal data must appear in the organisation's Article 30 record of processing activities (RoPA), and where the processing is likely to result in a high risk to individuals, an Article 35 DPIA is required before the processing begins. The DPC enforces these duties in Ireland under the EU GDPR, and the ICO enforces them in the UK under the UK GDPR - and in the UK this GDPR layer applies even though the AI Act itself does not apply domestically.

For most organisations the GDPR record is the foundation the AI Act evidence builds on: the Article 30 entry establishes what the system processes and why, and the DPIA carries most of the personal-data risk analysis that an AI Act file needs. With Acompli, each AI system links to its Article 30 entry and its DPIA, so the GDPR record and the AI Act evidence stay one connected file. The RoPA and DPIA guides linked under related research and related tools below cover those obligations in detail.

  • Article 30 RoPA: record the AI processing, its purposes, data categories, recipients, transfers and retention - in Ireland under the EU GDPR and in the UK under the UK GDPR.
  • Article 35 DPIA: required where AI processing is likely to result in a high risk to individuals; AI-driven profiling and innovative technology commonly trigger it.
  • Enforcement: the DPC (Ireland) and the ICO (UK) enforce the GDPR overlay in parallel with any AI Act duties.

11AI Governance

Ireland vs the UK: a side-by-side comparison

The same AI system can carry materially different statutory duties depending on which side of the Irish Sea it is deployed. The table below summarises how the position differs for an organisation operating in both markets.

Ireland (EU AI Act applies directly)United Kingdom (no domestic AI Act)
Legal status: Regulation (EU) 2024/1689 applies directly as EU law, on the staged timeline above.Legal status: the EU AI Act does not apply domestically, and the UK has no AI Act equivalent.
Regulatory model: distributed enforcement by national and sectoral authorities, coordinated by the AI Office of Ireland.Regulatory model: principles-based and regulator-led, through the ICO and sectoral regulators, alongside the AI Safety/Security Institute.
Coordination: the AI Office of Ireland is an independent statutory body established under the Regulation of Artificial Intelligence Act 2026 and acts as the central coordinating body for implementation.Coordination: no single AI statute or coordinating AI authority; existing regulators apply cross-sector principles within their own remits.
Extraterritorial exposure: not applicable - the Act already applies in Ireland.Extraterritorial exposure: UK organisations are in scope under Article 2 when they place AI systems on the EU market or when their system's output is used in the EU.
AI Act penalties: Article 99 tiers of up to EUR 35 million or 7% of worldwide annual turnover, applied through the designated national authorities.AI Act penalties: none domestically, but the EU tiers reach UK firms caught by Article 2.
Registration: providers of Annex III high-risk systems register in the EU database; public-authority deployers register their use.Registration: the same Article 49 duty applies to UK providers only when they place Annex III high-risk systems on the EU market.
GDPR overlay: Article 30 RoPA and Article 35 DPIA duties enforced by the DPC under the EU GDPR.GDPR overlay: Article 30 RoPA and Article 35 DPIA duties enforced by the ICO under the UK GDPR.

12AI Governance

How Acompli supports EU AI Act readiness

Acompli supports EU AI Act readiness alongside GDPR workflows. The platform helps teams inventory AI systems, classify each one by role and risk tier with the rationale recorded, draft and structure assessment content, and route every output to a named reviewer for approval. The AI System Register and Member-State conformity templates are available on opt-in (early access), not as shipped guarantees for every organisation. The software assists, drafts, classifies and surfaces; a human always reviews and approves, and final legal calls rest with your DPO or legal advisers.

Because AI Act evidence and GDPR evidence share the same underlying facts, the practical goal is one connected record: AI systems linked to their Article 30 entries, DPIAs, risks and suppliers, so the organisation can show how each classification and transparency position was reached. This guide is general information for compliance teams comparing obligations across Ireland and the UK; it is not legal advice, and the obligations that apply to a specific system should be confirmed with your own legal advisers.

Where Acompli fits for EU AI Act readiness

Best for teams that need AI Act evidence connected to GDPR records: Acompli keeps an AI inventory with owners, roles, risk tiers, classification rationale and review dates linked to the relevant Article 30 entries, DPIAs, suppliers and risks. The AI System Register and Member-State conformity templates are opt-in early access, so they should be treated as available readiness capabilities rather than universal shipped guarantees; every classification and legal judgement remains human-approved.

See Acompli EU AI Act workflows

Primary sources

EU AI Act requirements FAQ

Does the EU AI Act apply in Ireland?

Yes. The EU AI Act is directly applicable in Ireland and applies to organisations that fall within its scope as providers, deployers, importers, distributors or other operators.

Can the EU AI Act apply to UK-based organisations?

Yes. UK-based organisations can be in scope if they place AI systems on the EU market, put AI systems into service in the EU or if AI system outputs are used in the EU.

What is the first step for EU AI Act readiness?

The first step is to create an AI inventory that records systems, owners, purposes, vendors, roles, risk tiers, evidence and review dates.

Has the Digital Omnibus changed the AI Act deadlines?

Yes. The AI Omnibus entered into force on 27 July 2026. It moved the Annex III high-risk milestone to 2 December 2027 and the Annex I regulated-product milestone to 2 August 2028. Article 50 transparency obligations still applied from 2 August 2026, with a 2 December 2026 transition for certain pre-existing systems generating synthetic content under Article 50(2).

Does the EU AI Act apply in the UK?

No, not domestically. The EU AI Act (Regulation (EU) 2024/1689) does not apply within the United Kingdom, and the UK has no equivalent AI statute; it follows a principles-based, regulator-led approach through the ICO and sectoral regulators, alongside the AI Safety/Security Institute. However, UK organisations are caught extraterritorially under Article 2 when they place AI systems on the EU market or when their system's output is used in the EU. UK GDPR and ICO guidance also continue to govern any AI that processes personal data in the UK.

Do we need to register our AI systems under the EU AI Act?

Mostly no. Registration in the EU database under Articles 49 and 71 applies to providers of Annex III high-risk AI systems, and deployers that are public authorities must register their use of such systems. A company that merely uses a high-risk tool supplied by a vendor does not register it, and limited-risk and minimal-risk systems are never registered. Most Irish and UK organisations are deployers of vendor-supplied AI, so for most buyers the registration duty does not arise - although an internal AI inventory with documented tier and role decisions remains the evidence base the Act's other obligations depend on.

Who enforces the EU AI Act in Ireland under S.I. No. 366/2025?

Ireland uses a distributed enforcement model. The AI Office of Ireland is an independent statutory body established under the Regulation of Artificial Intelligence Act 2026 and acts as the central coordinating body for implementation of the EU AI Act. It works with national and sectoral authorities; where an AI system processes personal data, the DPC also enforces the GDPR in parallel.

What penalties apply under the EU AI Act for organisations in Ireland and the UK?

Article 99 sets three tiers of administrative fines. Prohibited practices under Article 5 attract fines of up to EUR 35 million or 7% of total worldwide annual turnover. Breaches of most other obligations, including the Article 50 transparency duties and deployer duties, attract up to EUR 15 million or 3%. Supplying incorrect, incomplete or misleading information to authorities attracts up to EUR 7.5 million or 1%. For SMEs and start-ups, each fine is capped at the lower of the fixed amount and the turnover percentage. In Ireland the tiers are applied through the designated national competent authorities; the Act sets no domestic UK fines, but a UK firm in scope under Article 2 faces the same EU tiers.

Will the Digital Omnibus delay the EU AI Act's high-risk deadlines?

Yes. The AI Omnibus entered into force on 27 July 2026. The high-risk Annex III milestone is 2 December 2027, and the deadline for high-risk AI embedded in Annex I regulated products is 2 August 2028. Article 50 transparency obligations applied from 2 August 2026; certain pre-existing systems generating synthetic content have an Article 50(2) transition until 2 December 2026.

Do organisations that only use AI tools have obligations under the EU AI Act?

Yes. Deployers - organisations using AI systems under their own authority - carry real duties even though they are lighter than provider duties. Article 50 transparency duties for in-scope systems have applied since 2 August 2026, and organisations should maintain proportionate AI literacy measures under the simplified framework. Deployers of Annex III high-risk systems carry use and oversight duties when the high-risk regime applies, and certain deployers - public bodies, private operators providing public services, and deployers of credit-scoring or life and health insurance risk-pricing systems - must complete an Article 27 fundamental rights impact assessment before first use. What deployers do not have to do is register vendor-supplied tools in the EU database; that duty sits with providers and with public-authority deployers only.

Which deployers must complete a FRIA under Article 27?

Article 27 requires a fundamental rights impact assessment from deployers that are public bodies or private operators providing public services, and from deployers of certain Annex III high-risk systems - specifically systems used for credit-scoring and for risk-pricing in life and health insurance. The assessment must be completed before the high-risk system is first used. The FRIA complements rather than replaces a GDPR Article 35 DPIA, so where the AI system processes personal data both assessments can apply and evidence can be reused across them.

Do AI systems still need GDPR records and DPIAs in Ireland and the UK?

Yes. The EU AI Act sits on top of the GDPR rather than replacing it. In both jurisdictions, an AI system that processes personal data must be recorded in the organisation's Article 30 record of processing activities, and where the processing is likely to result in a high risk to individuals an Article 35 DPIA is required before processing begins. The DPC enforces these duties in Ireland under the EU GDPR and the ICO enforces them in the UK under the UK GDPR - and in the UK this GDPR layer applies even though the AI Act itself does not apply domestically. For most organisations the GDPR record is the foundation that AI Act evidence builds on.

Can software make us EU AI Act compliant on its own?

No. Software can assist by inventorying AI systems, drafting and structuring assessment content, classifying systems for review, and routing outputs for sign-off, which saves time and keeps the evidence consistent. But classification decisions, fundamental rights impact assessments and final legal calls require human judgement and must be approved by a person, typically with input from the DPO or legal advisers. Acompli's EU AI Act capabilities are built on that model: the software drafts, classifies and surfaces, a human reviews and approves, and the AI System Register and Member-State conformity templates are available on opt-in (early access).

Market-specific questions (Deutschland / France / Nederland)

Welche Behörde überwacht die EU-KI-Verordnung in Deutschland?

In Deutschland soll die Bundesnetzagentur die zentrale nationale Marktüberwachungsbehörde für die EU-KI-Verordnung werden, als zentrale Anlaufstelle, zentrale Beschwerdestelle und notifizierende Behörde, während sektorspezifische Stellen (etwa die BaFin für den Finanzsektor) ihre Bereiche übernehmen und die Datenschutzbehörden mitwirken. Geschaffen wird diese Struktur durch das nationale Durchführungsgesetz (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG). Stand Mitte 2026 war das Gesetz noch nicht vollständig in Kraft (Kabinettsbeschluss am 11. Februar 2026, Bundestag am 11. Juni 2026, Zustimmung des Bundesrates noch ausstehend); Deutschland hatte die Benennungsfrist der KI-Verordnung (2. August 2025) nicht eingehalten.

Quelle autorité supervise le règlement IA en France ?

La France applique le règlement IA selon un modèle multi-autorités plutôt qu'avec un régulateur unique. La CNIL est appelée à superviser les pratiques d'IA interdites et les systèmes à haut risque dans des domaines sensibles (biométrie, emploi, forces de l'ordre, contrôle aux frontières, processus démocratiques), tandis que la DGCCRF assure une coordination et que d'autres autorités sectorielles (Arcom, ACPR, ANSM) couvrent leurs domaines. Ces désignations passent par le projet de loi DDADUE, qui modifie la loi de 1978 ; le volet numérique a été voté au Sénat le 17 février 2026, mais la France avait dépassé l'échéance de désignation du 2 août 2025 et la loi n'était pas encore pleinement adoptée. La CNIL est l'une de plusieurs autorités désignées, et non l'unique autorité chef de file.

Welke autoriteit houdt toezicht op de EU AI-verordening in Nederland?

Nederland kiest voor een gedecentraliseerd model met ongeveer acht markttoezichthouders. De Autoriteit Persoonsgegevens (AP) en de Rijksinspectie Digitale Infrastructuur (RDI) coördineren samen, waarbij de RDI als centraal contactpunt fungeert; de AP zou toezicht houden op verboden AI-praktijken, de meeste hoog-risico (bijlage III) systemen en de transparantieverplichtingen, naast sectortoezichthouders zoals de AFM en DNB (financiën) en de IGJ (zorg). Deze rollen staan in het concept van de Uitvoeringswet AI-verordening, dat van 20 april tot 1 juni 2026 ter consultatie lag. Medio 2026 waren de aanwijzingen nog voorlopig en had Nederland de aanwijzingsdeadline van 2 augustus 2025 niet gehaald.

Related Research

Related Tools