Makes insurance decisions, in Ireland

Disability Act 2005 (No. 14 of 2005), Part 4, ss. 41 and 42 · Read the law's page

• Do not process genetic data in Ireland in relation to a person's employment, a policy of insurance or life assurance, a policy of health insurance or health-related insurance, an occupational pension, a retirement annuity contract or other pension arrangement, or the mortgaging of property.
• Do not carry out genetic testing on a person in Ireland unless the testing is not prohibited by law and you have the person's consent to the processing of the genetic data the testing will produce, obtained in accordance with the GDPR.
• Before you process genetic data in Ireland, take all reasonable steps to give the data subject all appropriate information about the purpose and possible outcomes of the processing and any potential implications for the data subject's health that may become known as a result.

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57 · Read the law's page

• Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.
• Do not subject a person in Ireland to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Ireland on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Ireland of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Online Safety and Media Regulation Act 2022 (No. 41 of 2022); Online Safety Code (Coimisiun na Mean, October 2024)

• If you operate a video-sharing platform or other online service designated under the Online Safety Code, include in your terms and conditions measures protecting children and the public from harmful content.
• If you operate a video-sharing platform or other online service designated under the Online Safety Code, assess and mitigate the risks posed by your content-delivery and recommendation mechanisms.
• Do not rely on simple self-declaration for age verification.

Digital Services Act 2024 (No. 2 of 2024), giving effect to Regulation (EU) 2022/2065; Coimisiun na Mean as lead national authority

• Conduct an annual systemic-risk assessment of your algorithmic recommendation, content-moderation, and advertising systems if you operate a very large online platform or very large online search engine.
• Implement risk-mitigation measures for those systems if you operate a very large online platform or very large online search engine.
• Offer users at least one recommendation-system option not based on profiling if you operate a very large online platform.
• Disclose your recommendation-system parameters to users if you operate a very large online platform.

Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) · Read the law's page

• Comply with information requests, contravention notices and prohibition notices issued by an authorised officer of a relevant market surveillance authority in respect of an AI system you provide or deploy (Part 5).
• Do not knowingly give false or misleading information to an adjudicator, or disclose confidential material relevant to an adjudicator's finding without authorisation (ss. 95, 104).

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Ireland as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users they are interacting with an AI system before the interaction begins.
• Mark generative AI outputs in machine-readable form as artificially generated.