Does the EU AI Act apply to your business? Almost certainly. Here's exactly how.
Answer 10 quick questions about how your business uses AI. You'll get a tailored breakdown: which of your AI uses are high-risk, which just need a disclosure, which are fine as they are, and what to put in place for each.
How the Act sorts things
Every use of AI falls into one of four groups. Most Irish SMEs land in the bottom two.
Banned outright, like social scoring or inferring emotions at work. Rare in a small business.
AI in decisions about people: hiring, staff, credit, education, health. Allowed, with oversight and records.
Chatbots, and content that could pass for real people or events. Tell people it is AI. Already in force.
Everything else, which is nearly all of it. Train the team, mind your data, carry on.
Takes about 3 minutes. Built for Irish SMEs. This is practical guidance, not legal advice.
Your governance basics
Recorded staff training is a legal duty under Article 4. The other three are not requirements in themselves, but they are how you show the rest is under control.
This report is generated from your answers and reflects the EU AI Act (Regulation 2024/1689) as applied in Ireland under the Regulation of Artificial Intelligence Act 2026. It is practical guidance to help you understand your position, not legal advice. Risk classifications depend on specific circumstances. High-risk deployer obligations are subject to EU implementation timelines, currently December 2027 for most Annex III systems, but transparency and AI literacy obligations already apply.
You can read these without doing the check.
What about normal business use?
The everyday things Irish SMEs actually do with AI, and what the Act says about each.
I use ChatGPT to write quotes, emails and letters
Minimal risk. Nothing to disclose and nothing to register. Two things still apply: your team needs to know how to use it properly, which is the Article 4 literacy duty, and client or personal data should not go into a consumer account. Business tiers with a data processing agreement generally do not train on your data. Consumer ones may.
There's a chatbot on my website answering questions and taking bookings
Transparency. People have to know they are talking to AI, and this obligation is already in force. One clear line at the start of the chat does it, something like "You're chatting with our AI assistant". Give people a way to reach a human too. That is the whole requirement.
I use AI to write my social posts and make images for them
Minimal risk. There is no "Made with AI" label required on a post you wrote or edited yourself. The disclosure rules are aimed at content that could pass for real people or events, so an illustration or a stock-style image is fine. A person should still read everything before it goes out, because accuracy is on you, not the tool.
I use an AI notetaker in client meetings
Minimal risk under the Act, but GDPR is the real question here. Tell people at the start that the meeting is being recorded and transcribed, know where the recording is stored and for how long, and check whether the tool trains on your content. Add it to your tool register, because this is the one people forget.
I use AI to help shortlist CVs
High-risk. This is the one on the list that needs real work. A person must review the AI's shortlist and be able to override it, candidates should be told AI is used in the process, and you need to keep records of how the system is used. GDPR Article 22 also applies today: a fully automated rejection with no human involvement can breach a candidate's rights right now, well before the Act's 2027 deadline.
Does this mean…?
The things people worry about most when they first look at this.
Does this mean I have to stop using AI?
No. The Act bans a short list of practices and puts conditions on a slightly longer list. Everything else is allowed. Even a high-risk result does not mean stop, it means a person stays in charge of the decision and you keep a record of how the tool is used.
Does this mean I need a solicitor?
For most Irish SMEs using everyday tools, no. If you build or sell an AI product, operate in a regulated sector, or your result flagged a prohibited practice, then yes, get proper legal advice. We will tell you straight which of those you are.
Does this mean I'm going to be fined?
Not for the ordinary things. The headline penalty figures attach to prohibited practices and to provider obligations, not to a small business that has not written its AI policy yet. The realistic risk for an SME is a client, an insurer or a tender asking how you use AI and having no answer.
We just use ChatGPT. Does any of this really apply?
Two things do. The Article 4 duty to make sure staff working with AI know how to use it properly has applied since February 2025, and your data obligations under GDPR apply regardless of the AI Act. Neither is a big job. Both are worth doing.
What's the difference between a provider and a deployer?
A provider builds or sells an AI system. A deployer uses one in their business. Almost every Irish SME is a deployer, and deployer duties are much lighter: use the tool as intended, keep a person in the loop for decisions about people, tell people when they are dealing with AI, train your staff. If you build AI into a product your customers use, you are a provider, and that is a different and much heavier conversation.
Does this mean I need to do it all before December 2027?
No, because not all of it waits until then. December 2027 is the deadline for most high-risk deployer obligations. The AI literacy duty and the transparency rules for chatbots and synthetic content are already in force, so those are the ones worth closing now.