The EU AI Act is already partly in force, and more of it is coming. Most Irish SMEs are lower-risk than they fear — but very few have actually checked. This page explains the parts that matter, in plain English, with no jargon and no countdown clock.
Article 4 of the EU AI Act requires organisations to take measures to ensure staff — and anyone else using AI on their behalf — have “a sufficient level of AI literacy.” In plain English: if your team uses AI tools for work, you’re expected to make sure they understand what those tools do, where they can go wrong, and how to use them responsibly.
is when the AI literacy obligation came into force — it isn’t a future deadline, it’s already the law.
is specifically attached to this obligation for most everyday business use — this is about good practice, not a penalty regime.
is usually all it takes: most SMEs have staff using AI, but no formal training or written guidance behind it yet.
The EU AI Act sorts AI use into four tiers based on risk, not on how modern or impressive the tool is. Click each one to see what it covers, what it means in practice for an Irish SME, and when it applies. Limited risk is open below by default, because that’s genuinely where most SMEs sit.
The everyday use most SMEs are already doing.
What it covers: General-purpose productivity use — drafting, summarising, research, spam filters, basic scheduling or recommendation tools.
What this looks like for an Irish SME: Using ChatGPT, Copilot or Gemini to draft emails, summarise reports or brainstorm marketing copy. A booking system that suggests appointment slots.
What’s required: No specific obligations beyond the general AI literacy requirement that applies across every tier — make sure the people using these tools understand what they do and where they can go wrong.
Where most Irish SMEs using customer-facing AI actually sit.
What it covers: AI that people could mistake for a human, or content that could be mistaken for something real — this tier is about honest disclosure, not heavy compliance.
What this looks like for an Irish SME: A customer-facing chatbot on your website. AI-generated images, voiceovers or video used in marketing that could otherwise pass as genuine.
What’s required: Let people know they’re talking to an AI system, and label AI-generated or synthetic content clearly. That’s the core of it.
Uncommon for most SMEs — but worth checking if AI touches HR or credit decisions.
What it covers: AI used in areas like recruitment and HR decisions, credit or loan scoring, education and exam assessment, law enforcement, and biometric identification.
What this looks like for an Irish SME: A tool that screens job applications or ranks CVs automatically. Software that scores loan or credit applications. A biometric access-control system.
What’s required: A significantly higher bar — risk management, data governance, technical documentation, human oversight and a conformity assessment before the system can be used.
Very few Irish SMEs go anywhere near this category.
What it covers: A short, specific list of practices banned outright — social scoring, manipulative or subliminal techniques designed to cause harm, exploiting people’s vulnerabilities, most real-time remote biometric identification in public spaces for law enforcement, and untargeted scraping of facial images to build recognition databases.
What this looks like for an Irish SME: Realistically, almost nothing in ordinary business use. This tier targets specific, deliberate practices — not everyday AI-assisted admin, marketing or customer service.
What’s required: These practices simply can’t be used. Most of this list has applied since 2 February 2025; two further prohibitions take effect on 2 December 2026.
Answer honestly — “not sure” is a completely normal answer, and it’s useful information in itself. This gives you a qualitative sense of where you stand, not a score out of 100. There’s no such thing as false precision here.
1. Does anyone on your team currently use AI tools for work (ChatGPT, Copilot, Gemini, or similar)?
2. Do you have any written guidance or policy on how AI should and shouldn’t be used?
3. Have staff had any actual training on using AI safely and well?
4. Do any of the AI tools you use help make decisions about customers or employees (e.g. hiring, credit, screening applications)?
5. Has anyone told your team what’s safe — and not safe — to paste into a public AI tool (customer data, contracts, personal information)?
This self-check gives a general, qualitative sense of where you stand — it’s a starting point, not a legal determination. Nothing you enter is stored; it exists only in your browser for this visit.
The Act phases in over several years. Some deadlines have already passed; the main high-risk obligations were pushed back by the Digital Omnibus. Deferred dates are marked and are subject to formal adoption.
Regulation (EU) 2024/1689 formally becomes law, starting the phase-in clock for every later date on this page.
Every organisation the Act eventually covers — this date itself doesn’t impose any obligations yet.
Does this affect a typical Irish SME? No — this date only started the clock; nothing was required of businesses on this day itself.
A short list of AI practices became illegal outright, and organisations must ensure staff using AI have adequate AI literacy.
The literacy duty applies to any organisation whose staff use AI tools for work — in practice, almost everyone.
Does this affect a typical Irish SME? Yes — if your team uses AI at all, the literacy obligation already applies to you, right now.
Providers of general-purpose AI models — the companies building tools like large language models — took on new transparency and documentation duties.
Model providers such as OpenAI, Google, Anthropic and similar — not the businesses using their tools.
Does this affect a typical Irish SME? Unlikely — this is aimed at the companies building AI models, not the businesses using them day to day.
The Act now applies broadly, including a duty to disclose AI chatbots and label AI-generated or synthetic content under Article 50.
Any business using a customer-facing chatbot, or publishing AI-generated images, audio or video that could pass as real.
Does this affect a typical Irish SME? Only if you use a customer-facing chatbot or publish AI-generated content — otherwise there’s no direct obligation here.
Two more specific practices join the banned list under Article 5, on top of the ones prohibited since February 2025.
Organisations engaged in those specific practices — narrowly defined categories, not everyday AI use.
Does this affect a typical Irish SME? Unlikely — these prohibitions target narrow, specific practices most ordinary businesses never go near.
Full obligations take effect for “high-risk” AI systems — recruitment, credit scoring, education, biometric identification and more. Originally due August 2026, deferred to this date by the Digital Omnibus (agreed 7 May 2026, subject to formal adoption).
Businesses deploying AI that makes or materially influences decisions about people in these specific high-stakes categories.
Does this affect a typical Irish SME? Only if you use AI to screen job candidates, score credit or loan applications, or similar high-stakes decisions — most SMEs don’t.
High-risk AI embedded inside products already regulated for safety — machinery, medical devices and similar — must meet the Act’s requirements too.
Manufacturers of regulated physical products with embedded AI safety components.
Does this affect a typical Irish SME? Unlikely — this concerns manufacturers of regulated equipment with embedded AI, not typical service businesses.
Dates reflect the EU AI Act (Regulation 2024/1689) and the Digital Omnibus political agreement as understood at the time of writing. Deferred dates are subject to formal adoption and may change. This is not legal advice — please confirm current obligations with qualified legal counsel before relying on any date here.
Taking readiness assessments from Q1 2027 — register your interest now. We look at what you’re actually using, document it, and help you understand exactly where you stand.