The EU AI Act for Irish SMEs: what you actually need to do.

If you run an Irish business and you use AI anywhere, in a product, in hiring, in customer service, the EU AI Act now applies to you. Ireland is a member state, so there is no question of whether you are in scope. The good news is that for most small and mid-sized businesses the obligations are lighter than the headlines suggest, and the Act deliberately goes easier on smaller firms. The bad news is that the sentence most owners want to say, that it does not apply to us, is rarely true.

The Act sorts AI by risk, not by company size

The core idea is straightforward. AI uses are grouped by how much harm they could do. A small number are banned outright. A defined set is treated as high-risk, things like AI used to make hiring decisions, score creditworthiness, or control access to essential services, and these carry real obligations. Most ordinary business uses fall into a lighter tier, where the main duty is transparency: being clear with people when they are dealing with AI. The first job is simply to work out which tier your uses fall into, and for most businesses the answer is the lightest one.

The first task is not compliance. It is knowing which of the things you already do the Act considers high-risk, because that is where the real duties begin.

The dates that matter

Some obligations are already live. Rules for general-purpose AI models have applied since August 2025. From August 2026, transparency duties apply broadly, so if AI generates content or interacts with your customers you generally have to make that clear. The heaviest high-risk obligations were pushed back under a 2026 revision of the timeline and now fall due in late 2027, which gives most businesses time to prepare rather than scramble. Dates have moved before and may move again, so the point is to understand your own exposure now, not to memorise a calendar.

• August 2025: rules for general-purpose AI models already in force.
• August 2026: broad transparency duties, including labelling AI-generated content and AI interactions with customers.
• Late 2027: the main high-risk obligations, deferred from the original timeline.
• Throughout: proportionate penalty caps that go easier on smaller firms than on large ones.

What a sensible Irish SME should do now

You do not need a six-figure compliance programme. You need to know what you are running. Make a short inventory of every place AI touches your business. Decide which tier each use sits in. Add clear labelling wherever a customer meets AI. Keep a simple record of what each system does and what data it uses. For the large majority of businesses, that is most of the work done. If one of your uses genuinely lands in the high-risk category, that is the point where you bring in help, because that is where documentation, human oversight, and testing become real obligations rather than good practice.

The Act is not designed to stop an ordinary business using AI. It is designed to make sure the risky uses are handled carefully and that people know when AI is involved. Treat it as an inventory exercise first and a legal exercise only where the inventory tells you that you have to. Most Irish SMEs will find the inventory is nearly the whole job.