AI, software and digital regulation, explained for Ireland.

A program that uses a language model to work out and perform the steps towards an outcome: finding a record, completing a form, calling an API. It can only use the tools and permissions it has been given, and each step it takes can be recorded.

A data platform that keeps data in open file and table formats on inexpensive object storage, like a data lake, and adds the features of a warehouse on top: transactions, schemas, access control and SQL. Open table formats like Apache Iceberg and Delta Lake are what make it work.

A dataset run as if it were a product. It has a named owner, a documented structure, published quality figures, clear access rules and agreed update times, so that other teams can rely on it without having to ask how it was put together.

Structured testing of an AI system on a reference set of questions or documents, scored on criteria agreed in advance: is it correct, is it supported by the sources, is it complete, and does it decline when it cannot know. It runs before launch and again whenever the model, the prompt or the data changes.

Controls placed around a language model to keep it inside agreed limits: input and output checks, limits on topics, masking of personal data, a permission check before any tool is used, and approval steps before actions with consequences.

AI output that reads as confident but has no basis in the sources or the facts. You can reduce it, though never remove it entirely, by basing answers on retrieved sources, demanding citations, allowing the system to say it doesn’t know, and tracking how often it happens during testing.

A set-up where a member of staff checks, corrects or approves what an AI produces before it has any effect. Under the AI Act, high-risk systems need effective oversight by people who have the competence and the authority to step in.

Reading, sorting and extracting data from documents like application forms, invoices, certificates and scanned letters, using text recognition, layout analysis and language models together. Every value it extracts has a confidence score, and anything under the threshold is passed to a person to check.

A neural network trained on huge volumes of text to predict which word comes next. It can draft, summarise, classify and pull information out of text in many languages. It is not a store of facts, though: unless it is grounded in your own sources, it can give smooth answers that are simply wrong.

The working practices that keep machine learning and language model systems dependable once they are live: version control for models, prompts and data, automated testing, release pipelines, and monitoring of quality, cost and response time.

An approach where the system first looks up the relevant passages in approved sources, for example circulars, procedures or case files, and the language model then answers using only those passages. Each answer can point to the document and section it relies on, and the user’s access rights are applied during the search.

Searching by meaning instead of by matching words. Text is turned into lists of numbers (embeddings), and the system looks for passages whose numbers lie near those of the question. It is normally paired with keyword search, since reference numbers, names and section numbers have to match exactly.

A way of working where a system’s interface is designed and agreed before anything is built, usually as an OpenAPI or AsyncAPI specification. Other systems, partners and front ends then connect through documented, versioned APIs rather than reaching into the database.

A cloud environment set up in advance, with the account or subscription layout, identity, networking, policies, logging and security baseline already in place when the first workload lands. Every project after that moves faster, and the controls stay the same across all of them.

A family of IEC standards (IEC 61970, IEC 61968 and IEC 62325) that describes electricity networks, their assets and market messages in a single shared data model. Network operators adopt it so that their planning, operational and market systems all describe the network in the same terms.

A digital model of a physical asset, process or network that is kept up to date with data from the real thing. It is used to track condition, try out changes before making them and plan maintenance. A 3D model with no live data feeding it is not a twin.

An architecture where systems send events, such as “planning application lodged” or “meter reading checked”, to a broker, and other systems respond when it suits them. Because the systems are loosely coupled, one can change or go down without halting the rest.

The open data standard for building information modelling (BIM), maintained by buildingSMART and published as ISO 16739-1. IFC 4.3 extends it to infrastructure, covering rail, roads, ports, waterways and bridges, so asset data passes from design to construction to operation without being keyed in again.

A platform in the cloud for building and operating integrations, bringing ready-made connectors, data mapping, orchestration and monitoring together. Examples include MuleSoft and SAP Integration Suite.

A machine-readable inventory of the components and dependencies inside a piece of software, normally in SPDX or CycloneDX format. When a new vulnerability is announced, it tells you fast whether you are affected. Under the Cyber Resilience Act, manufacturers must produce one for their products.

Cloud services where the location of the data, the running of the service and the law that governs it remain under European or national control. There is no single definition: some Member States have national schemes with extra requirements on protection from laws outside the EU. For Irish public bodies, Connecting Government 2030 sets cloud-first as a principle.

A method for replacing an old system gradually. A facade goes in front of it, functions move one by one to new services behind that facade, and the old system is switched off when no traffic reaches it any longer. There is never one big, risky changeover.

A manufacturing architecture pattern where one central event broker holds the live state of the plant, arranged by site, area, line and machine. Systems publish to it and read from it, rather than each being wired to the others individually.

A security approach in which no user, device or service is trusted simply because of where it sits on the network. Each request is authenticated, authorised and judged on identity, the state of the device and the context, and access only covers what the task requires.

The EU’s regulation on artificial intelligence, which classifies AI systems by risk. Certain practices are banned, high-risk systems must meet requirements on data, documentation, human oversight and accuracy, and some systems have transparency duties. The bans have applied since 2 February 2025 and the transparency duties since 2 August 2026; after the 2026 amendment, the Annex III high-risk obligations apply from 2 December 2027. In Ireland the Regulation of Artificial Intelligence Act 2026 gives effect to it, with the AI Office of Ireland as central coordinating authority.

The EU directive on the physical and organisational resilience of critical entities across eleven sectors, among them energy, transport, health, drinking water and digital infrastructure. Each Member State identifies its critical entities by 17 July 2026, after which those entities assess their risks and put resilience measures in place.

The EU regulation laying down cybersecurity requirements for products with digital elements, whether hardware or software, sold on the EU market. Manufacturers have to deal with vulnerabilities throughout the support period and report actively exploited ones from 11 September 2026, and the main obligations take effect on 11 December 2027.

The EU regulation on fair access to data and its use, applicable since 12 September 2025. Users of connected products get access to the data those products create, moving between cloud and data processing providers becomes easier, and unfair contract terms on data sharing are restricted.

The EU regulation on how resilient the financial sector is in its use of ICT, applicable since 17 January 2025 and directly in force in Ireland. It deals with ICT risk management, incident reporting, resilience testing and the oversight of ICT third-party providers, including required contract terms and a register of information.

The national facility where Irish public bodies publish their tender opportunities. Suppliers find requests for tender there and respond to each requirement within the competition.

The EU directive requiring a range of products and services to be accessible to people with disabilities, among them e-commerce, consumer banking, e-books, and the websites, apps and e-tickets of passenger transport. In Ireland it was transposed by S.I. No. 636 of 2023, which has applied since 28 June 2025 and is enforced by the CCPC, with ComReg and Coimisiún na Meán for their own services.

An app provided under the revised eIDAS Regulation where people keep their identity data and attestations, such as qualifications or licences, disclose only what a service asks for and sign documents. Each Member State must make at least one wallet available, and many public and private services will be obliged to accept it. Ireland plans a Government Digital Wallet linked to MyGovID.

The EU regulation governing personal data, in application since 25 May 2018. It lays down principles like purpose limitation and data minimisation, gives rights to the people whose data is used, and places duties on controllers and processors, among them impact assessments where processing is high risk. In Ireland the Data Protection Commission supervises it, under the Data Protection Act 2018.

A series of international standards for securing industrial automation and control systems. It splits a site into zones joined by conduits, defines security levels, and sets out what asset owners, system integrators and product suppliers are each responsible for.

The EU regulation on the interoperability of public services across borders. Public bodies must assess how new or changed trans-European digital public services affect interoperability, and they can share and reuse interoperability solutions through a common portal.

The international standard for information security management systems. A certified organisation runs an audited system for spotting security risks, selecting controls and improving them over time. FromNine holds ISO/IEC 27001 certification.

Ireland’s national digital identity for online public services, owned by the Department of Social Protection. Services built for the public service often use it for sign-in, and the planned Government Digital Wallet is linked to it.

The planned Irish law to transpose NIS2. Its General Scheme was published in August 2024 and, as of autumn 2026, the Bill is still being drafted. The National Cyber Security Centre is planned as the lead competent authority, and S.I. No. 360 of 2018 stays in force until the Bill is enacted.

The EU directive on cybersecurity for essential and important entities in sectors such as energy, transport, health, digital infrastructure and public administration. It calls for risk management measures, security in the supply chain and incident reporting, with an early warning inside 24 hours and a notification inside 72 hours. It takes effect through national law. In Ireland the National Cyber Security Bill is still being drafted as of autumn 2026, and S.I. No. 360 of 2018 applies until it is enacted.

The central purchasing office of the Irish public service. It runs central frameworks that public bodies can buy through, and it currently operates the Peppol Authority function for Ireland; Revenue intends to take over that role from 1 January 2027.

The EU system created under the Single Digital Gateway Regulation that lets public authorities swap official evidence across borders when a citizen or business expressly asks, so nobody has to supply documents that a government already holds. Its obligations have applied since 12 December 2023.

An international network, with its own specifications, for sending structured business documents such as invoices and orders through certified access points. Ireland uses Peppol for e-invoices to public bodies, which must receive and process EN 16931 e-invoices under S.I. No. 258 of 2019. Revenue’s planned VAT modernisation adds domestic B2B e-invoicing for large corporates from 1 November 2028.

The Irish Act that implements the EU AI Act, signed into law on 21 July 2026. Alongside it, S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, designates the AI Office of Ireland as central coordinating authority, market surveillance authority and single point of contact, with sector authorities that include the Central Bank of Ireland, the Data Protection Commission, the HPRA, the Health and Safety Authority, the CCPC and Coimisiún na Meán.

Secondary legislation made under an Act, cited by number and year, for example S.I. No. 358 of 2020. Ireland often transposes EU directives this way: the European Accessibility Act came in through S.I. No. 636 of 2023 and the first NIS directive through S.I. No. 360 of 2018.

Revenue’s programme for mandatory e-invoicing and digital reporting. Under the published timeline, VAT-registered large corporates issue EN 16931 e-invoices for domestic B2B trade and report the data to Revenue from 1 November 2028, and every business must be able to receive them from that date; a PDF does not count. Intra-EU B2B follows from 1 November 2029. The legal basis is in Finance Bill (No. 2) 2026, which has not yet been enacted, so the dates are still planned.

The W3C’s guidelines for accessible web content, made up of success criteria at levels A, AA and AAA. Level AA is the normal target in law and in tenders; WCAG 2.2 is the current version, while the European standard EN 301 549 still builds on WCAG 2.1. Irish public bodies are held to EN 301 549 under S.I. No. 358 of 2020, monitored by the National Disability Authority.