The EU AI Act in plain English for Irish SMEs
The EU AI Act applies lightly to most Irish small businesses: if you use ordinary AI tools, your duties are transparency and staff training, not paperwork.
Does the EU AI Act apply to my business?
Almost certainly yes, but probably not in the way you fear. The Act covers anyone who puts an AI system on the EU market and anyone who uses one in a professional capacity. A café using a chatbot to answer enquiries counts as a user (the Act calls this a “deployer”), and so does an accountant running client emails through ChatGPT.
The important thing is that the Act sorts systems by risk, not by company size. Most of what a small Irish business actually uses sits in the lowest risk band, where the obligations are modest. The heavy requirements (conformity assessments, technical documentation, registration) land on high-risk systems and on the companies that build AI models, not on the shop using one.
This is general information rather than legal advice. If you are doing something unusual with AI, particularly around hiring, credit, or health, talk to a solicitor who knows the area.
The EU AI Act explained simply: four risk bands
The whole law is easier to hold in your head once you see the structure. Systems fall into one of four buckets:
- Unacceptable risk (banned). Social scoring, manipulative systems that exploit vulnerable people, emotion recognition in workplaces and schools, most real-time biometric identification in public. These are prohibited outright. If you are reading this, you are not doing any of them.
- High risk. AI used in recruitment and worker management, access to education, credit scoring, essential public services, some safety components in regulated products. This band carries real obligations: risk management, data governance, human oversight, logging, documentation.
- Limited risk (transparency). Chatbots, AI that generates or manipulates content, deepfakes. The duty here is honesty: people should know they are dealing with a machine or looking at AI-generated material.
- Minimal risk. Everything else. Spam filters, AI in your accounting software, a tool that drafts a social post. No specific obligations.
For the typical Cork SME, the realistic answer is that you live in the bottom two bands, with one exception worth flagging.
The one place small businesses do become high risk: hiring
If you use AI to screen CVs, rank candidates, or make decisions about promotion, pay or task allocation for staff, that is explicitly high risk under the Act. It does not matter that you are a ten-person firm rather than a multinational.
In practice most small businesses buy this capability rather than build it, in which case the provider carries the bulk of the compliance burden. Your side of it is still real though: you need to use the system as intended, keep a human genuinely in the loop (not a rubber stamp), keep the logs the system produces, and tell candidates that an automated system is involved. If you are running CVs through a general chatbot and asking it to rank them, you have effectively built your own screening tool, and you own more of the risk than you might think.
The simplest way to stay out of this band is to keep AI on the admin side of hiring (drafting the job ad, summarising a call you sat in on) and keep the actual judgement with a person.
AI Act compliance for SMEs: what to actually do
Here is the practical version, in order:
- Write down what you use. A single page listing every AI tool in the business, who uses it, and what for. This takes twenty minutes and solves half the problem, because most owners genuinely do not know what has crept in across the team.
- Check nothing sits in the banned or high-risk bands. Hiring and staff management is the one to look at closely. Customer service, drafting, scheduling and note-taking are almost never high risk.
- Be transparent where you should be. If a customer is talking to a chatbot, make that obvious. If you publish AI-generated images or text where a reader might reasonably assume a human made it, say so.
- Train the people using it. The Act has required AI literacy since February 2025 for anyone deploying AI at work. For a small business this means an actual conversation about what the tools can and cannot do, what must never be pasted into them, and who to ask when unsure. Write down that you did it and when.
- Do not confuse this with GDPR. They are separate laws that overlap. Most of the client-data risk owners worry about is a data protection question, which I cover in is it safe to put client data into AI tools?
When do the rules bite?
The Act came into force in August 2024 and applies in stages. The bans on unacceptable-risk systems and the AI literacy duty came first, in early 2025. Obligations on general-purpose AI models followed in August 2025. The bulk of the high-risk rules phase in through 2026 and 2027, with the longest runway for AI embedded in regulated products.
There has been ongoing discussion at EU level about simplifying parts of the timetable, so treat any specific date as worth rechecking rather than fixed. For a small business in the low-risk bands, none of this changes the answer: the transparency and literacy pieces are already live, and they are the ones that apply to you.
Who enforces it in Ireland?
Ireland has designated a set of existing regulators as market surveillance authorities rather than creating one new AI regulator, coordinated centrally, with a national AI Office role sitting alongside the EU AI Office. The fines quoted in headlines (up to 35 million euro or 7 percent of global turnover) attach to the banned practices, not to a small firm that forgot to label a chatbot. Proportionality for SMEs is written into the Act.
The honest read for most Cork and Munster businesses: this is a housekeeping job, not an existential one. An afternoon spent listing your tools, checking hiring is clean, labelling your chatbot and briefing your staff puts you in a reasonable position, and leaves you with a document you can show anyone who asks.
If you would rather that afternoon produced a plan for using AI well as well as legally, that is roughly what my AI Opportunity Assessment does: a look at how your week actually runs, what is worth automating, and what to keep away from. If you are still at the stage of deciding whether any of it is worth the bother, is AI actually worth it for a small business? is the better place to start.
The assessment is credited in full if you go on to a build, and if I can’t find you five hours a week you pay nothing. See how it works.

































