The AI Act for Irish public bodies: the 2026 Act, the AI Office and December 2027

01The Irish and EU position in autumn 2026

The EU’s AI Act (opens external site) (Regulation (EU) 2024/1689) has been law since August 2024 and switches on in phases. This summer Brussels changed the timetable: the Digital Omnibus on AI, Regulation (EU) 2026/1744 (opens external site), delayed the high-risk obligations and adjusted other articles. It came into force on 27 July 2026, days before the high-risk rules would otherwise have started.

Ireland completed its side in the same month. The Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed into law on 21 July 2026. S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, makes the AI Office of Ireland (Oifig IS na hÉireann) the central coordinating authority, a market surveillance authority and the single point of contact for the AI Act. Sector authorities sit beside it, among them the Central Bank of Ireland, the Data Protection Commission, the HPRA, the Health and Safety Authority, the CCPC and Coimisiún na Meán. For a public body, the practical message is that Irish supervisors now exist for these rules.

The Omnibus also reworded Article 4. Providers and deployers must now take measures to support their staff’s AI literacy, rather than ensure a sufficient level of it. The obligation stays; the evidence you need is different. Role-based training, with a record of who completed it, remains the sensible response.

02Provider or deployer?

In most cases an Irish public body will be a deployer, using an AI system under its own authority. It is a provider if it builds a system, or commissions one, and puts it into service under its own name; a tool developed in-house, or by a contractor working to the body’s specification, counts.

The role can move. Article 25 turns a deployer into a provider if it makes a substantial modification to a high-risk system, or repurposes a system so it becomes high-risk. Spell out who is which in the request for tender and the contract, before an auditor has to work it out.

03Which public uses count as high-risk

Annex III names the areas in which AI systems are treated as high-risk. The ones most likely to arise in the Irish public service:

• Access to essential public services and benefits: deciding eligibility for a scheme or grant, and awarding, cutting, withdrawing or recovering it; think of entitlement checks in a department or housing allocation in a local authority.
• Migration, asylum and border control, law enforcement and the administration of justice.
• Education and vocational training: admissions, assessing learning outcomes, monitoring during examinations.
• Employment: recruitment, promotion, allocating work and monitoring staff. Every public body is an employer as well.
• Critical infrastructure: safety components in managing digital infrastructure, road traffic and utilities.

Falling within an Annex III area is only the first test. Article 6(3) takes a system out of the high-risk category if it creates no significant risk of harm: a narrow procedural job, polishing work a person has already finished, pattern detection that does not replace an officer’s judgement, or preparatory steps. Profiling of individuals keeps a system high-risk regardless. Put your reasoning on file if you rely on this.

Plenty of useful tools fall outside the high-risk regime: drafting help, internal search over circulars, translation between Irish and English, summaries. Transparency duties and the GDPR still apply to them; the high-risk obligations do not.

04Duties of a public body deploying a high-risk system

When a department, agency or council deploys an Annex III system after 2 December 2027, Article 26 (opens external site) applies to it. In short, the body must:

• Operate the system as the provider’s instructions for use say, with suitable technical and organisational measures.
• Give oversight to people with the competence, training and authority it requires, and support them.
• Ensure input data under your control is relevant and representative enough for the purpose.
• Monitor how it runs, and tell the provider and the authorities without undue delay about risks and serious incidents.
• Hold the automatically generated logs for six months at least, unless other EU or Irish law sets a different period.
• Inform staff representatives and affected employees before using a high-risk system in the workplace.
• Register your use in the EU database before first use, as a public authority must (Article 26(8) and Article 49). A system that is not registered may not be used.
• Tell people when a high-risk system makes, or helps make, decisions about them (Article 26(11)); they also have a right to an explanation of individual decisions (Article 86).

Fundamental rights impact assessment

A further step applies to the public service. Bodies governed by public law, and private firms delivering public services, must complete a fundamental rights impact assessment before they first put most Annex III systems to use, as Article 27 (opens external site) sets out; critical infrastructure systems are the exception. It records:

1. 01the processes the system will be used in, consistent with its intended purpose;
2. 02how long and how often it will be used;
3. 03the categories of people and groups likely to be affected;
4. 04the particular risks of harm to them;
5. 05how oversight by people is organised;
6. 06what happens if a risk materialises, including internal governance and complaint routes.

Send the outcome to the market surveillance authority. Because the exercise overlaps with a data protection impact assessment under GDPR Article 35, do both in one process and reuse the DPIA work; the DPC still supervises the data protection side. The EU AI Office is to publish a template questionnaire under Article 27(5), so see whether it is available before inventing your own. Other countries have their own methods, the Dutch IAMA for example.

05Transparency duties in force today

Since August 2026 the transparency rules of Article 50 have been live. On the provider side, a system that talks to people must let them know it is AI unless that is plain from the context, and synthetic output must carry a machine-readable mark. On the deployer side, a public body must label deepfakes, and must label AI-written or altered text it publishes to inform people on public matters, except where a person has reviewed the text and someone is editorially responsible for it.

The usual public-sector case is a chat assistant on a council or agency website. Say plainly that it is an AI system, explain what it can help with and what it cannot, offer a way to reach a person, and provide it in Irish and English where your Official Languages Act duties require.

06A plan for the months to December 2027

1. 01Inventory, starting now. List every AI system in use or being procured, AI features inside licensed platforms included. Note owner, purpose, provider, data and the people affected.
2. 02Classify by early 2027. Prohibited, high-risk (with the Article 6(3) reasoning on file), transparency only, or minimal risk, with your role as provider or deployer for each.
3. 03Fix contracts through 2027. Require instructions for use, conformity documentation and log access from providers, and make support for your impact assessment and incident reporting a contract term, including in mini-competitions under existing frameworks.
4. 04Design the oversight. Name the roles, train them, give them power to override and a route to escalate. Design against automation bias; our article on when an AI agent must wait for a person shows how.
5. 05Put logging and monitoring in place. Keep logs for six months at least, and define what a serious incident is and who reports it.
6. 06Before first use. Complete the fundamental rights impact assessment alongside the DPIA, register in the EU database, and inform staff and the people affected.
7. 07Keep literacy current. Role-based training for users, reviewers and decision-makers, refreshed as systems change, with a record of completion.

07Enforcement in Ireland

Penalty rules are set nationally, and Article 99(8) leaves each Member State to decide whether, and how far, administrative fines can be imposed on its public authorities. Check how the 2026 Act deals with that for your body. Either way, waiting is a poor strategy: the AI Office and the sector authorities can require corrective action, and a public decision is only as legitimate as your ability to explain it and let it be challenged.

08Points to follow

• Guidance from the Commission on how to classify high-risk systems under Article 6(5), to sit next to the prohibited practices guidelines (opens external site) it has already issued.
• Harmonised standards for the high-risk requirements, which providers will rely on to show conformity.
• Guidance from the AI Office of Ireland and the sector authorities for public deployers.
• The EU AI Office’s template for the fundamental rights impact assessment.

For the official timeline and plain explanations of each article, the Commission’s AI Act Service Desk (opens external site) is the reference. Keep it bookmarked with the Irish Statute Book, and put a date on each internal note, since the rules are still shifting.