If something goes wrong with AI in your business, or a customer complains about it, the practical question is who you would actually be dealing with. Since July 2026 Ireland has an answer, and it is not one body.
General information, not legal advice. Which regulator applies depends on your sector and the specific use.
Applies to you if
- You use AI in a regulated sector: finance, health, media, communications, transport.
- You use AI in anything touching staff, hiring or workplace monitoring.
- You want to know where a complaint about your business would land.
- You are being sold “AI Act compliance” and want to know who actually enforces it.
Probably does not apply if
- You use AI for internal drafting and summarising and nothing customer-facing. Nobody is coming to look, though GDPR still applies to the data.
- You are looking for a single office to register with. There is no AI registration scheme for ordinary business use.
What Ireland actually set up
The Regulation of Artificial Intelligence Act 2026 was signed in July 2026 and established the AI Office of Ireland, Oifig IS na hÉireann, as the central coordinating authority and the single point of contact for the EU AI Act.
Its job is coordination: keeping supervision consistent across authorities, sharing information between them, and supporting joint investigation and enforcement. It is the front door and the coordinator, not the regulator for every question.
The distributed model, and why it was chosen
Ireland did not create one AI regulator. It designated existing sectoral regulators as market surveillance authorities, so AI questions go to the body that already understands the sector.
The logic is sound. An AI tool used in lending raises credit questions before it raises AI questions, and the Central Bank already knows what to ask. The trade-off is that “who regulates this?” stops having a single answer.
Authorities designated include the Data Protection Commission, the Workplace Relations Commission, the Central Bank of Ireland, the Competition and Consumer Protection Commission, Coimisiún na Meán, the Commission for Communications Regulation, the Health and Safety Authority, the Health Products Regulatory Authority, the Health Service Executive and the National Transport Authority, among others.
Three situations, worked through
An employee complains about AI monitoring their productivity. This is workplace territory, so the Workplace Relations Commission is the likely route, with the Data Protection Commission involved because monitoring is also processing personal data. Two regulators, one incident.
A customer says your chatbot misled them. Consumer protection, so the Competition and Consumer Protection Commission, with an AI Act transparency angle if the bot was passing itself off as a person.
A rejected applicant asks how your screening tool ranked them. GDPR gives them rights over automated decisions today, so the Data Protection Commission. The AI Act layer arrives with the high-risk obligations in December 2027.
The pattern is worth noticing: in each case the sector regulator leads and the Data Protection Commission is often also involved, because most AI in a small business touches personal data somewhere.
What this means practically
You do not register anything. There is no general AI register for ordinary business use, and anyone offering to register you is selling something that does not exist.
Your existing regulator relationship matters more than the new office. If you are already supervised by somebody, that is who will ask about your AI use.
Enforcement started on 2 August 2026. The supervisory structure is live, including for the AI literacy duty and the transparency rules.
Penalties are scaled. The headline figures are up to €35 million or 7% of worldwide turnover for prohibited practices. For SMEs the cap is the lower of the two, and Member States must take account of SME viability. That is a meaningfully different exposure from the number in the headlines.
Five things worth doing
- Work out which regulator already supervises you, if any. That is your most likely route for an AI question too.
- Write down where AI is used and which of those uses touches customers, staff or personal data.
- Check anything customer-facing is honest about being automated. Transparency duties apply now.
- Keep your GDPR house in order. In practice the Data Protection Commission is the authority a small business is most likely to hear from about AI.
- Ignore anyone selling certification. There is no compliance badge for ordinary business use of AI.
Common misconceptions
- “There is one AI regulator now.” There is one coordinator. Enforcement is distributed across existing sectoral authorities.
- “We need to register with the AI Office.” No. It is a coordinating body and single point of contact, not a registry for business users.
- “Fines are a share of turnover.” For SMEs the cap is the lower of the fixed amount or the percentage, which is the reverse of the general rule.
- “Nothing is enforceable yet.” Enforcement began on 2 August 2026. What moved to December 2027 is the high-risk obligations, not the whole Act.
The honest summary
For most small businesses this changes very little day to day. There is nobody to register with and nothing to file. What changed is that there is now a structure behind the rules, and a clear answer to who would ask.
This covers who enforces the rules rather than what the rules are. The Act itself is set out here, including which tier your own use of AI is likely to fall into, which is the question that decides whether any of this reaches you at all.
The practical takeaway is that your sector regulator, and the Data Protection Commission, are the ones to think about. If you are unsure which applies to something you are doing, describe the use and you will get a straight answer, including when the answer is that nobody is coming.
Sources
Regulation of Artificial Intelligence Act 2026 on the Irish Statute Book; the Department of Enterprise, Tourism and Employment on the establishment of the AI Office of Ireland; and Article 99 of Regulation (EU) 2024/1689 on penalties. Checked 6 August 2026.
Common questions
Do we have to register with the AI Office of Ireland?
No. It is the central coordinating authority and single point of contact, not a registry for businesses using AI. There is no general registration scheme for ordinary business use.
Which regulator would deal with a complaint about us?
It depends on the sector and the use. Ireland designated existing regulators as market surveillance authorities, so a staff monitoring issue goes to a different body than a financial services or advertising one. The Data Protection Commission is frequently involved as well.
Are the fines really 7% of turnover?
Up to €35 million or 7% of worldwide annual turnover, for prohibited practices, at the top tier. For SMEs the cap is the lower of the two figures rather than the higher, and Member States must take SME viability into account.