Ireland

Made under section 3 of the European Communities Act 1972 to give further effect to the EU AI Act, these Regulations designate the Minister for Enterprise, Tourism and Employment as a national competent authority for the purposes of Article 70(1) and as the single point of contact for the purposes of Article 70(2).

They designate the Central Bank of Ireland as market surveillance authority for the purposes of Article 74(6) and the Data Protection Commission as market surveillance authority for the purposes of Article 74(8).

A schedule designates further sectoral market surveillance authorities, including the Health and Safety Authority, the Competition and Consumer Protection Commission, the Commission for Communications Regulation, the Commission for Railway Regulation, the Marine Survey Office and the Health Products Regulatory Authority, against the relevant points of Section A of Annex I to the AI Act, and designates notifying authorities for the purposes of Article 28.

The Regulations create no separate duty on an AI developer or deployer; they identify which State body enforces the AI Act against one.

Section 2 makes it an offence to distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused. Section 3 separately makes it an offence to record, distribute or publish an intimate image of another person without consent where that act seriously interferes with the other person's peace and privacy or causes alarm, distress or harm.

The Act's definition of 'intimate image' covers any visual representation, made by any means including a photographic, film, video or digital representation, of what is, or purports to be, the person's genitals, buttocks, anal region, or, for a woman, her breasts, of underwear covering those areas, of a nude person, or of a person engaged in sexual activity.

Because the image need only purport to be the person's intimate depiction and may be made by any digital means, the offence reaches a fabricated or digitally altered image of that kind, including an AI-generated or AI-altered synthetic image, and is not limited to a genuine photograph of the person.

A controller must notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No DPA 2018 derogation from this timeline was identified.

The DPC's July 2024 guidance applies Ireland's existing General Data Protection Regulation (GDPR) and Data Protection Act 2018 duties, lawful basis before collecting personal data for AI training, data minimization, honoring access, rectification and erasure requests where feasible against a trained model, and data protection impact assessments for higher-risk processing, to the specific context of building and operating Large Language Models and other AI systems.

The guidance states directly that publicly accessible personal data still falls within the scope of the GDPR, and that a controller assessing necessity and proportionality for AI training must account for the purposes for which people made their personal data publicly accessible in the first place, not only for the fact of public accessibility.

This interprets Ireland's existing personal-data duties in an AI training context; it does not itself create a duty that attaches because a system is an AI system. The guidance does not itself distinguish a public-sector from a private-sector controller, but GDPR Article 4(7) defines a controller to include a public authority or body on the same footing as a natural or legal person, so the duties it applies to AI training bind either kind alike.

The DPC has since opened a formal inquiry into X Internet Unlimited Company's processing of EU/EEA users' publicly-accessible posts to train the Grok large language models (LLMs). It also engaged with Meta over its plans to train a generative AI model on public Facebook and Instagram content, leading Meta to pause and later revise the rollout.

And it has stated of LinkedIn's AI training that it has not approved or found compliant LinkedIn's use of members' personal data for that purpose, though LinkedIn's added measures have addressed its concerns enough that no further regulatory intervention is planned for now.

The General Data Protection Regulation (GDPR) applies directly in Ireland, and the Data Protection Act 2018 (DPA 2018), No. 7 of 2018, gives it domestic effect: Part 3 supplies Ireland's national derogations and exemptions, Part 2 establishes the Data Protection Commission (DPC) as supervisory authority, and Part 6 supplies the enforcement architecture; Part 5 transposes the Law Enforcement Directive and is not the GDPR regime.

Because most large United States technology companies base their EU headquarters in Ireland, the DPC is the lead supervisory authority under the GDPR one-stop-shop mechanism for most of their cross-border processing, which makes Irish enforcement practice a de facto reference point for the whole EU, including on how existing privacy law reaches AI training uses of personal data.

Transferring personal data of a person in Ireland outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.

The DPC additionally operates the one-stop-shop coordination role given Ireland's concentration of EU-headquartered controllers, but this is an institutional and procedural role in cross-border enforcement coordination, not an added transfer restriction. No DPA 2018-specific derogation on outbound transfers was identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing that produces legal or similarly significant effects, which the DPA 2018 gives domestic effect to with the DPC as enforcement authority. Where an automated decision is permitted, on contract necessity, legal authorization, or explicit consent, the controller must implement human-intervention, point-of-view, and contest safeguards.

Sections 41 to 43 of the DPA 2018 narrow specific data-subject rights, including the Article 22 adjacent rights of access, rectification, restriction and objection, for archiving in the public interest, scientific or historical research, or statistical purposes where exercising the right would render the purpose impossible or seriously impair it.

The DPC is Ireland's supervisory authority, established under Part 2 of the DPA 2018 and enforcing under Part 6, with General Data Protection Regulation (GDPR) Article 83 administrative fines. Article 82 arms an individual with a direct private right of action, and Section 117 DPA 2018 specifies that the civil action for material or non-material damage, including distress, is brought in the Circuit Court or the High Court.

Ireland's own collective-redress channel is limited: a not-for-profit body can act on a data subject's authorised behalf under Article 80(1), and the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 lets a body designated a qualified entity by the Minister for Enterprise, Trade and Employment bring representative actions covering DPA 2018 claims, a designation reviewed at least every five years and revocable.

General Data Protection Regulation (GDPR) Article 9(1) governs biometric data as a special category, and the DPA 2018 explicitly lists biometric data among the special categories it elaborates on.

Section 46 addresses processing special category data, including biometric data, in the employment and social-welfare context: the processing is lawful where it is necessary for exercising or performing a right or obligation conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law (the GDPR Article 9(2)(b) condition), with suitable and specific measures safeguarding the data subject.

No dedicated Irish provision on voiceprint capture, retention, or destruction specifically was found; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.

Section 2 makes it an offence to intentionally access an information system without lawful authority or reasonable excuse by infringing a security measure. Sections 3 and 4 separately criminalise intentionally hindering or interrupting the functioning of an information system, or intentionally deleting, damaging, altering or suppressing data on it, without lawful authority.

Section 5 criminalises intentionally intercepting a non-public transmission of data to, from or within an information system, without lawful authority. Section 6 criminalises producing, selling, procuring, importing, distributing or otherwise making available a computer programme, password, code or similar data designed for committing any of the section 2 to 5 offences.

Because section 2's trigger is infringing a security measure, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of that offence; no reported Irish case has tested the point. The Act repealed the earlier, narrower 'unauthorised accessing of data' offence at section 5 of the Criminal Damage Act 1991, which had rested on operating a computer with intent to access data rather than on defeating a security measure.

The 2021 Regulations added a new section 53B to the Copyright and Related Rights Act 2000: where an author has not expressly reserved, in an appropriate manner, the use of a work for reproduction or extraction for the purposes of text and data mining, a person who has lawful access to the work may reproduce it for that purpose, and may retain the reproduction for as long as necessary for the mining.

A reservation is made in an appropriate manner where it is machine-readable, for content made publicly available online, including in the metadata or terms and conditions of a website or service, or otherwise clearly communicated to persons with lawful access.

The Regulations also amended the pre-existing research and non-commercial text-and-data-mining exception at section 53A by inserting new subsections requiring that a copy made under it be stored securely and retained only as necessary for scientific research, including for verification, and by providing that any contractual provision contrary to the section is unenforceable. A parallel exception for computer programs was inserted at section 82(3)-(5). A parallel exception for subject matter protected by related rights was inserted after section 225A as section 225AA.

Part V of the Copyright and Related Rights Act 2000 confers a property right, the database right, on a database in which there has been a substantial investment in obtaining, verifying or presenting its contents, whether or not the database or any of its contents is itself a copyright work. 'Extraction' means the permanent or temporary transfer of all or a substantial part of the database's contents to another medium.

'Re-utilisation' means making those contents available to the public by any means, and 'substantial' is judged by quantity or quality or a combination of both. The right expires 15 years from the end of the calendar year the database was completed, or from the end of the calendar year it was first lawfully re-utilised if that comes later, and a substantial change to the database's contents amounting to a substantial new investment qualifies the resulting database for its own fresh term. The right exists independently of any copyright in the database's underlying contents.

Regulation 17 requires a designated operator of essential services (an undertaking the Minister or the Central Bank of Ireland designates in the energy, transport, banking, financial market infrastructure, health, drinking water supply and distribution, or digital infrastructure sectors listed in Schedule 1) to take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems it uses and to prevent or minimise the impact of an incident on the continuity of its service.

Regulation 21 imposes the equivalent duty on a relevant digital service provider, an online marketplace, online search engine or cloud computing service under Schedule 2, and additionally requires it to take into account the security of its systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.

These Regulations transpose the original NIS Directive (Directive (EU) 2016/1148) and, according to the National Cyber Security Centre, remain in full effect pending the National Cyber Security Bill's transposition of its successor, NIS2, and cover the most critical operators in the State in the meantime.

Regulation 18 requires a designated operator of essential services to notify the State's CSIRT, without delay and in any event not later than 72 hours after becoming aware, of an incident with a significant impact on the continuity of an essential service it provides, including an incident affecting a third-party digital service provider it relies on, and to notify the CSIRT again once the incident is resolved.

Regulation 22 imposes the equivalent duty on a relevant digital service provider for an incident with a substantial impact on a service listed in Schedule 2. The CSIRT is the unit of the State's cybersecurity department that Regulation 10 designates.

Regulation 6 requires the competent authority, the CSIRT and the single point of contact to cooperate with the Data Protection Commission where a notified incident also compromises personal data, a duty distinct from the breach-notification duty General Data Protection Regulation (GDPR) itself imposes on a controller.

Requires designated video sharing platforms, including Facebook, Instagram, YouTube, TikTok, X, LinkedIn, Pinterest, Tumblr and Udemy, that allow pornography or gratuitous violence to implement effective age assurance so children are not normally able to access that content. Coimisiún na Meán has stated that self declaration alone does not satisfy the requirement, though it has not mandated one specific verification method.

General child safety provisions under Part A of the Code took effect on 19 November 2024, and the Part B age assurance obligations became binding on 21 July 2025.

Sets 16 as Ireland's digital age of consent under Article 8 of the General Data Protection Regulation (GDPR), the minimum age at which a child can consent to the processing of personal data in the context of an information society service offered directly to the child, including registering for a social media account. For children under 16, consent must be given or authorised by a parent or guardian. This is a data protection consent rule rather than a mandated identity verification requirement.

Dissolved the Broadcasting Authority of Ireland and established Coimisiún na Meán (the Media Commission), giving it power to designate video sharing platforms with an establishment in Ireland and to adopt legally binding online safety codes, including rules protecting minors from harmful content.

Regulation 13 applies the reproduction and making-available rights in sections 37, 39 and 40 of the Copyright and Related Rights Act 2000 to publishers of press publications established in the State for the online use of their press publications by information society service providers. The right does not reach private or non-commercial use of a press publication by an individual user, acts of hyperlinking, or the use of individual words or very short extracts of a press publication.

It lasts two years, running from 1 January of the year following the year the press publication was published. It does not reach a press publication first published before 6 June 2019. Authors of works incorporated in a press publication are entitled to an appropriate share of the revenues the publisher receives for the publication's online use. A dispute under the Regulation may be submitted to a mediator under the Mediation Act 2017 without prejudice to judicial remedies.