Ireland's AI Rulebook Changed in 2026

On 21 July 2026, President Connolly signed the Regulation of Artificial Intelligence Act 2026 into law. Nine days later the Department of Enterprise, Tourism and Employment announced that the AI Office of Ireland had been established, with Paul Byrne appointed as its first chief executive. The office was expected to be operational from 2 August 2026, and its full compulsory information-gathering powers commence in December 2026.

Most published commentary on Irish AI regulation has not caught up with this. Material written even a few months earlier describes the EU AI Act as an incoming framework Ireland was still preparing for. It is now implemented Irish law, with a named regulator, a named chief executive and a statutory architecture running to 10 Parts, 139 Sections and 4 Schedules.

If you run marketing, content or web for an Irish business, or you supply one from abroad, some of this reaches you directly. Not all of it. This piece tries to separate the parts that change your work from the parts that do not.

What Actually Changed, in Order

One detail in that timeline is easy to skim past and worth pausing on. The Act amends the Central Bank Act 1942 and the Competition and Consumer Protection Act 2014. That is not housekeeping. It means the financial regulator and the competition and consumer authority each gained sanctioning powers specifically for AI Act purposes, which tells you something about where Irish enforcement is expected to land.

Ireland Chose Fifteen Regulators, Not One

Most countries implementing the EU AI Act faced a design choice: build one dedicated AI regulator, or distribute the work across regulators that already exist. Ireland chose the second, and the consequence for anyone operating across sectors is significant.

The operational point is blunt. If your organisation uses AI in ways that touch more than one of those domains, you answer to more than one authority. A financial services firm using AI in customer communications sits under the Central Bank for the AI question, the DPC for the personal data question, and potentially the CCPC for the consumer claims question. Three regulators, one system.

That is not a hypothetical for Irish businesses. It is the normal condition for anything customer-facing.

The Precedent That Makes This Concrete

Regulatory frameworks are easy to discount as paper until something happens. In Ireland, something happened, and it is the single most useful fact in this entire article.

On 8 August 2024, the Data Protection Commission applied to the Irish High Court under Section 134 of the Data Protection Act 2018 against Twitter International Unlimited Company, the Irish entity behind X. The subject was the processing of personal data contained in the public posts of EU and EEA users, between 7 May and 1 August 2024, for the purpose of training Grok. The application was heard before Ms. Justice Reynolds.

In the DPC's own description, this was the first time any lead supervisory authority had taken such action, and the first time the Commission had sought to use its Section 134 powers. The proceedings were struck out on 4 September 2024 on the basis of a permanent undertaking. A further investigation into X and Grok opened in April 2025.

Read that again with the geography in mind. The first time a European lead supervisory authority moved to halt the training of an AI model, it happened in an Irish court, under Irish procedural law, brought by the Irish regulator. Meta had already paused its European AI training plans in June 2024 after DPC engagement, without a court application being necessary.

This is why Irish procurement questions about AI tooling are sharper than in most markets. The people asking them work in a jurisdiction whose regulator has demonstrated, in court, that it will move against the model providers themselves. A vendor arriving with vague assurances about data handling is walking into a room that has read the judgment.

Why This Lands on Marketing, Not Only Legal

The instinct is to file all of this under legal and carry on. Four reasons that does not work.

Marketing owns most of the AI tooling. Content generation, ad optimisation, personalisation, chatbots, lead scoring, subject-line testing. In a lot of Irish organisations the marketing function is the largest single consumer of AI systems, often procured without a formal review because individual tool costs are small.

Customer-facing output is where transparency obligations bite. If a system interacts with people, obligations around disclosure and human oversight attach to the interface, and the interface is usually a marketing property.

Claims made in marketing copy are separately regulated. This is the part most often missed. A regulated firm describing an AI-driven service in promotional material has to satisfy both the AI framework and the sectoral rules on how that claim may be worded. Two sets of obligations, one web page.

Prompt monitoring is itself data processing. Any programme that logs prompts and responses to measure AI visibility is processing data, and where those logs can be linked to individuals, it is processing personal data. More on that below, because it is where most agency relationships in this market are quietly non-compliant.

Mapped against actual marketing activity rather than against the legislation, the picture looks like this.

The Consumer Protection Code Is Already In Force

A correction worth making, because a great deal of published material still describes this in the future tense. The Central Bank of Ireland's Consumer Protection Code 2025 was published on 24 March 2025 and came into force on 24 March 2026, after a twelve month implementation period. It has been live for months.

It is given effect through two statutory instruments, replaces the 2012 Code in full, and consolidates the Code of Conduct on Mortgage Arrears. For anyone writing or approving financial content, two features matter most.

The definition of consumer now includes incorporated businesses with annual turnover below EUR 5 million, raised from the previous threshold. That widens the population of buyers whose interactions with a regulated firm attract consumer protections, and therefore widens the range of content that has to be written to a consumer standard rather than a professional one.

And the Code strengthens requirements in several areas that are squarely marketing problems: digitalisation of financial services, clear separation of unregulated products from regulated ones, fraud, mortgage credit switching, and climate risk including anti-greenwashing. Every one of those is a content and disclosure question before it is a compliance question.

Practically, if a page carries rate, fee, eligibility, risk or comparison claims, treat it as a controlled marketing communication and route it through compliance before publication rather than after. The same discipline shapes how we handle regulated categories in SEO work for Irish clients.

Pharmaceutical and Device Content Has Its Own Clock

For life sciences, which is a substantial part of the Irish economy, the AI framework sits on top of an existing approval regime that already governs publishing speed.

Under the Irish Pharmaceutical Healthcare Association Code of Practice, final promotional material must be examined and certified internally before release. Direct-to-consumer advertising of prescription-only medicines is prohibited. Over-the-counter medicine and medical device content falls under Health Products Regulatory Authority advertising rules.

I could not locate any market-wide study giving typical Irish approval turnaround times, so no figure is offered here. What matters operationally is the shape of the constraint rather than its duration: your compliance queue governs publishing velocity, not your agency's production capacity. An agency promising a fixed monthly content volume in a regulated Irish category without asking about the review process has not understood the account.

The workable response is to build the review requirements into the content calendar rather than treating them as a downstream gate. A claims table with sources mapped per assertion, named intended audience, named reviewer, version history, and a defined re-review trigger. Then approve reusable content modules independently, so a standard product description does not go back through full review every time it appears in a new asset.

Cross-Border Data, the Part Most Agencies Get Wrong

Now the section that applies directly to any Irish business working with a provider outside the European Economic Area, which includes us and includes every offshore agency selling into Dublin.

That last sentence in the footnote is the trap. A provider can state accurately that all client data sits on EU servers, while its staff access that data daily from outside the EEA. The access is the transfer. Any Irish procurement team that has read the Schrems II material will ask about it, and a provider who has not thought it through will answer badly.

What Prompt Monitoring Means Under This Regime

AI visibility monitoring, the discipline of testing prompts across assistants and recording which sources get cited, has a data protection dimension that almost nobody discusses.

Prompt logs and captured responses can contain personal data. If prompts are built around named individuals, if responses name people, or if logs are linkable to the person who ran them, you are processing personal data in a jurisdiction whose regulator has already gone to court over AI training data.

None of this is exotic. It is the ordinary content of a competent processing arrangement. The reason it is worth spelling out is that AI visibility work is new enough that a lot of it is being sold without any of it, and Ireland is the least forgiving market in Europe in which to test that. We build the evidence pack as a standing deliverable in GEO engagements for Irish clients rather than assembling it when a questionnaire arrives.

A Practical Sequence

If none of this is currently mapped in your organisation, the order that wastes least effort is roughly as follows.

Inventory the AI tooling marketing already uses. Every tool, what data it touches, where it processes, whether it is customer-facing. This almost always surfaces more systems than anyone expected, because individual subscriptions were small enough to bypass procurement.

Identify which of the fifteen authorities your use cases touch. Not to alarm anyone, but because a system that touches two domains needs an owner who knows it does.

Separate customer-facing systems from internal ones. Transparency and oversight obligations attach differently, and conflating them produces either over-engineering internally or under-engineering externally.

Fix the transfer stack before the next vendor review, not during it. The four items above take days to assemble and weeks to explain under pressure.

Route AI-related claims in marketing copy through the same review as product claims. Describing a service as AI-driven is a claim about how the service works, and in regulated sectors that is a regulated statement.

What Is Still Unclear

Three honest gaps.

Guidance from the AI Office is at an early stage. The office became operational in August 2026 and its full compulsory information powers commence only in December 2026, so the practical texture of Irish enforcement, what gets asked, how quickly, with what tolerance, is not yet observable. Anyone claiming to know how Irish AI enforcement will feel in practice is speculating.

The phasing of high-risk system obligations has moved. Dates currently indicated point to December 2027 and August 2028 for parts of the regime. Treat any specific compliance deadline you are quoted as provisional and check it against the current position rather than a briefing note from last year.

And there is no published Irish study of approval turnaround times in regulated content categories, which means realistic velocity planning in pharmaceutical, medical device and financial services content still has to be built from your own historical data rather than a benchmark.

What is not unclear is the direction. Ireland now has implemented AI legislation, an operational regulator with a named chief executive, fifteen designated sectoral authorities, a demonstrated willingness to litigate against model providers, and a financial consumer code that has been in force since March 2026. For marketing teams, the practical translation is that AI-related claims and AI-related data handling both moved from the optional-diligence column to the standing-requirement column, and they did so faster here than in most of Europe.

The wider argument about how regulated organisations should build for AI visibility without overclaiming is developed in Cited or Silent, and the gated edition is free to download. Our cross-market measurement work is published in the AI Citation Rate Report 2026.

Written by Tessar Napitupulu, Founder and CEO of PT Arfadia Digital Indonesia, a member of the Forbes Agency Council, and author of Found Before They Search and Cited or Silent. This article describes regulatory developments for general information and is not legal advice. Irish organisations should take advice from an Irish-qualified practitioner on their own circumstances.

Frequently Asked Questions

What is the Regulation of Artificial Intelligence Act 2026?

Ireland's implementing legislation for the EU AI Act, signed into law by President Connolly on 21 July 2026. It runs to 10 Parts, 139 Sections and 4 Schedules, and establishes the AI Office of Ireland as an independent statutory body acting as the country's central coordinating authority. It also amends the Central Bank Act 1942 and the Competition and Consumer Protection Act 2014 so that those bodies can impose administrative sanctions for AI Act purposes. The AI Office was expected to be operational from 2 August 2026, with full compulsory information-gathering powers commencing in December 2026.

Who runs the AI Office of Ireland?

Paul Byrne was announced as its first chief executive on 30 July 2026 by the Department of Enterprise, Tourism and Employment. He previously served as Executive Director of Education, Innovation and Artificial Intelligence at the Medical Council of Ireland, as President of CLEAR, an international alliance of professional regulators, and as a member of the World Health Organization Expert Working Group on Regulatory Considerations of AI for Health.

Does Ireland have one AI regulator or several?

Several, by deliberate design. Under S.I. No. 366 of 2025, the European Union (Artificial Intelligence) (Designation) Regulations 2025 published in Iris Oifigiúil on 29 July 2025, Ireland designated fifteen sectoral market surveillance authorities rather than creating a single dedicated AI regulator. The Central Bank of Ireland covers financial services under Article 74(6), the Data Protection Commission covers fundamental rights connected to personal data under Article 74(8), Coimisiún na Meán covers audiovisual media and online platforms, and further authorities cover communications, competition and consumer protection, employment, energy and health. The AI Office coordinates them and acts as single point of contact for the European Commission rather than replacing them.

What happens if our AI use spans several sectors?

You deal with more than one authority. A financial services firm using AI in customer communications may sit under the Central Bank for the AI system question, the Data Protection Commission for the personal data question, and potentially the Competition and Consumer Protection Commission for the consumer claims question. That is the normal condition for anything customer-facing rather than an edge case, and it is worth assigning an internal owner per system rather than per regulator.

Has the Irish regulator actually enforced anything against AI providers?

Yes, and it is the most significant precedent of its kind in Europe. On 8 August 2024 the Data Protection Commission applied to the Irish High Court under Section 134 of the Data Protection Act 2018 against Twitter International Unlimited Company, over the processing of EU and EEA users' public posts between 7 May and 1 August 2024 to train Grok. The application was heard before Ms. Justice Reynolds. The DPC described it as the first time any lead supervisory authority had taken such action and the first use of its Section 134 powers. Proceedings were struck out on 4 September 2024 on the basis of a permanent undertaking, and a further investigation into Grok opened in April 2025. Meta had separately paused its European AI training plans in June 2024 after DPC engagement.

Why is the Data Protection Commission so central to AI questions in Ireland?

Because of the GDPR one-stop-shop mechanism. Companies whose main EU establishment is in Ireland answer to the DPC as their lead supervisory authority, and that group includes Meta, Google, Apple, Microsoft, TikTok, X and, since February 2024, OpenAI Ireland Limited. The regulator that supervises the model providers is the same regulator that supervises Irish businesses using those models, which is a structural feature no other market shares.

Is the Consumer Protection Code 2025 in force yet?

Yes. It was published on 24 March 2025 and came into force on 24 March 2026 after a twelve month implementation period. A great deal of published material still describes it in the future tense, which is out of date. It is given effect through two statutory instruments, replaces the 2012 Code in full and consolidates the Code of Conduct on Mortgage Arrears. For content teams the most consequential change is that the definition of consumer now covers incorporated businesses with annual turnover below EUR 5 million, which widens the range of material that must be written to a consumer standard.

What does the Consumer Protection Code change for marketing content?

It strengthens requirements in several areas that are content problems before they are compliance problems: digitalisation of financial services, clear separation of unregulated products from regulated ones, fraud, mortgage credit switching, and climate risk including anti-greenwashing. The practical rule is that any page carrying rate, fee, eligibility, risk or comparison claims should be treated as a controlled marketing communication and routed through compliance before publication rather than corrected afterwards.

How do pharmaceutical and device rules affect content timelines?

They set your publishing velocity. Under the Irish Pharmaceutical Healthcare Association Code of Practice, final promotional material must be examined and certified internally before release, and direct-to-consumer advertising of prescription-only medicines is prohibited. Over-the-counter medicine and medical device content sits under Health Products Regulatory Authority advertising rules. No market-wide study of typical Irish approval turnaround times could be located, so no figure is quoted here. The practical response is to build claims tables, source mapping, named reviewers, version history and re-review triggers into the content calendar, and to approve reusable content modules independently so standard descriptions do not re-enter full review with every new asset.

Can an agency outside the EEA lawfully process our Irish data?

Yes, provided the transfer is properly constructed. Where the destination country has no European Commission adequacy decision, and Indonesia does not, a Chapter V safeguard is mandatory. In practice that means the 2021 Standard Contractual Clauses, Module 2 for controller to processor or Module 3 for processor to processor, a documented Transfer Impact Assessment following Schrems II, and an Article 28 data processing agreement. The pre-2021 clauses ceased to be valid after 27 December 2022 and any contract still citing them is defective.

Does hosting our data in the EU solve the transfer problem?

No, and this is the most common misunderstanding. Remote access from outside the European Economic Area is itself part of the transfer analysis. A provider can state accurately that all data sits on EU servers while its staff access that data daily from outside the EEA, and the access is the transfer. Any Irish procurement team familiar with the Schrems II material will ask about access location as well as storage location.

Is AI visibility monitoring itself regulated?

It is data processing, and where prompt logs or captured responses can be linked to individuals it is personal data processing. That matters more in Ireland than anywhere else, given the regulator's demonstrated willingness to litigate over AI training data. Sensible controls are scope minimisation using synthetic and business-only prompts wherever the purpose allows, no ingestion of special-category data, separate retention schedules for raw responses, prompt logs and derived reports, a disclosed subprocessor register naming model providers and cloud regions, role-based client-owned analytics access, and a workable data-subject request process. That last one is hard to retrofit, because unstructured and unindexed prompt logs make honouring a request technically difficult rather than merely inconvenient.

What are the penalties under the Irish regime?

Penalties follow the EU AI Act tiers, reaching up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, with fines confirmed by the High Court. Separately, the Act amended the Central Bank Act 1942 and the Competition and Consumer Protection Act 2014 so that those two bodies can impose administrative sanctions for AI Act purposes, which indicates where sectoral enforcement is expected to sit.

What is still unclear about Irish AI enforcement?

Three things. Guidance from the AI Office is at an early stage, since the office only became operational in August 2026 and its full compulsory information powers commence in December 2026, so the practical texture of enforcement is not yet observable. The phasing of high-risk system obligations has moved, with dates currently indicated for December 2027 and August 2028 for parts of the regime, so any specific deadline should be checked against the current position rather than an older briefing. And there is no published Irish study of approval turnaround times in regulated content categories, so velocity planning has to be built from your own historical data.