The EU AI Act now applies in Ireland. For most small businesses it is one label and one switch

Nothing here raises your costs this quarter, and that is the useful part. The compliance work that was due on 2 August has been pushed to December 2027, the cheap AI that answers your phone and chases your no-shows stays legal, and the only jobs on your desk are one label to make your supplier prove and one kind of tool to switch off. Here is what binds you, what does not, and what the 16 month gap is worth if you use it.

Three questions and you are done

Ask them in this order.

Does anything in your business talk to customers on its own? A chat window on your site, an AI phone line that takes bookings after hours, an assistant answering WhatsApp. The duty to tell people they are dealing with a machine sits on the company that built the tool, not on you.

Do you use AI to make images, video or audio that look real? A generated photo of a treatment room, a synthetic voice, a face in an ad. That one is yours, and it is one line of text.

Do you use AI to make decisions about the people who work for you? Sifting CVs, allocating work based on how someone behaves, scoring performance, reading mood. That is the expensive category. Its rules just moved to 2 December 2027, although one kind of tool in that space has been banned outright since February 2025.

Three noes and nothing here costs you money this year. Read the last two sections anyway, because the gap is worth money.

What actually applied on 2 August

Regulation (EU) 2024/1689, the AI Act, became generally applicable on 2 August 2026 under Article 113. The part that reaches an ordinary business is Article 50, and it is short.

Article 50(1) puts the duty on the provider: a system meant to interact directly with people has to be built so the person is told they are interacting with an AI system, "unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect". So if your booking bot does not say it is a bot, the breach is your supplier's. It is still your problem commercially, because a tool that cannot be sold legally in the EU is a tool that gets rewritten or withdrawn underneath your bookings.

Article 50(4) is the one that lands on you, as the deployer. Use AI to generate or manipulate image, audio or video content that counts as a deep fake and you have to disclose that it was artificially generated. Article 3(60) defines a deep fake as content "that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". A cartoon is not caught. A photorealistic salon you do not have, or a face that reads as a real client, is.

Article 50(5) fixes the timing: the information goes to the person "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure". Not in your terms and conditions.

Two limits are worth knowing. Obviously artistic or satirical work only needs the existence of the generated content flagged, in a way that does not spoil it. And the text limb of Article 50(4) only bites where AI text is published to inform the public on matters of public interest, so an AI-drafted Instagram caption sits outside it.

The expensive part moved to 2 December 2027

Annex III point 4 makes AI used for "the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" high risk. So is AI used to decide terms of employment, promotion or termination, to allocate tasks based on individual behaviour or traits, or "to monitor and evaluate the performance and behaviour" of workers.

Those obligations were also due on 2 August 2026. Then Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July 2026. It rewrites Article 113 so the high-risk requirements and obligations now apply from 2 December 2027 for the Annex III list, and from 2 August 2028 for AI built into regulated products.

The reason is in the EU legislature's own words. Recital 2 records that delayed standards and delayed national governance "has resulted in a compliance burden that is heavier than expected".

The same regulation quietly softened the staff training duty that consultants have been selling. This is the one obligation that does reach you whatever you use, because it applies to every deployer of any AI system, and it has been in force since 2 February 2025. Article 4 used to require providers and deployers to "ensure" AI literacy. It now says take measures to support the development of AI literacy, and adds in the text that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". In plain terms, show your team how the tools work and where they go wrong. You do not need a policy document or a certificate.

When the high-risk rules do arrive, two details decide whether they touch you. Article 6(3) lets an Annex III system out of the category where it performs a narrow procedural task, improves the result of a completed human activity, or does preparatory work, but the same paragraph says a system "shall always be considered to be high-risk where the AI system performs profiling of natural persons". And Article 26(7) will require you, before putting such a system to work, to tell affected workers and their representatives that they will be subject to it.

In Ireland the regulator for that category is not a technology body. Under S.I. No. 405 of 2026, the market surveillance authority for Annex III point 4 is the Workplace Relations Commission, the same body that inspects the payroll records behind your employment costs.

The one to switch off this week

Article 5(1)(f) prohibits AI systems used "to infer emotions of a natural person in the areas of workplace and education institutions", except where the system is intended for medical or safety reasons. The prohibitions have applied since 2 February 2025 and they sit in the top penalty band, up to 7% of turnover under Article 99(3).

In practice that means anything scoring your team's mood, tone or engagement:

• Call software that rates how happy a staff member sounded.
• Camera analytics sold with a sentiment or wellbeing feature, pointed at the counter.
• A rota tool that flags who looks stressed.

Customers are a separate question. Emotion inference on customers is not caught by that prohibition, but Article 50(3) requires a deployer of an emotion recognition or biometric categorisation system to inform the people exposed to it and to comply with data protection law, and Article 5(1)(g) bans biometric categorisation that infers things like race, religion, trade union membership or sexual orientation. If a camera vendor is offering demographic profiling of your queue as a free upgrade, that is a conversation for your solicitor.

Ireland turned its own machinery on two days early

Almost nobody has noticed this, and it is why the dates are real rather than theoretical.

The Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed on 21 July 2026. By S.I. No. 403 of 2026 the Minister brought it into operation on 31 July 2026, everything except paragraphs (a) and (e) of the definition of "applicable market surveillance authority" in section 78, which are Coimisiún na Meán and the Data Protection Commission. Establishment day for Oifig IS na hÉireann, the AI Office of Ireland, was the same 31 July, and the department said on 30 July that it expected the Office to be operational by 2 August, with Paul Byrne as first chief executive.

So the enforcement structure was in place before the EU rules became applicable, which is not the usual pattern in Irish implementation.

Who holds what: the AI Office is designated as a market surveillance authority under Article 70(1) generally, Coimisiún na Meán holds Article 50 where the provider or deployer is an intermediary service, an audiovisual or sound broadcasting service, a designated online service or a hosting service, and the Workplace Relations Commission holds employment AI. A salon or a cafe is none of those media categories, so your regulator is the new Office.

What a fine looks like at your size

The €15 million figure in every headline is not your number.

An Article 50 breach sits in the Article 99(4) band: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Article 99(6) then reverses it for smaller businesses. "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower." Ireland wrote that straight into section 105(5)(b) of the new Act.

An SME on the Commission's standard definition has fewer than 250 staff and turnover of €50 million or less, so for you the ceiling is the percentage. An illustration and not a forecast: on €450,000 of turnover the theoretical maximum for a transparency breach is €13,500, and for a prohibited practice at 7% it is €31,500.

There is also no such thing as a fine by letter. An authorised officer has to serve a notice of suspected non-compliance and give you a chance to make submissions (section 79), the matter goes to an independent adjudicator, and section 114(1) says an adjudication only takes effect once the High Court confirms it. Which is to say: keep this on the same list as your other paperwork, not above it. Our compliance checklist for small businesses is where it belongs. Note too that the Act's fine route runs through the eleven sector regulators named in section 78, and the new AI Office is not one of them.

The 16 months are the asset, not the relief

Nobody pays a premium for a business because it has a chatbot. They pay for one that keeps running when the owner is not in it, and AI is currently the cheapest way to get an owner off the critical path: the call that rings while you are mid-cut, the 9pm booking, the reminder that stops a no-show.

Now look at what the Act has just priced. Customer-facing automation costs you a label. Staff-facing decisions cost documentation, human oversight and worker notification from December 2027. That is a clear instruction about sequence. Automate the front of house now, and leave decisions about people with people.

The window matters for a second reason. From December 2027, any AI touching hiring, task allocation or performance comes with a paper trail a buyer can ask to see, and diligence questions get answered either out of documents or out of the price. An owner who spends the next 16 months moving customer contact onto systems arrives at a sale able to demonstrate transferability. An owner who spends it running staff decisions through a tool nobody documented arrives with a warranty request instead. If you only fix one thing, fix the owner-dependence in your phone line.