Ireland

Made under section 3 of the European Communities Act 1972 to give further effect to the EU AI Act, these Regulations designate national competent authorities, market surveillance authorities and notifying authorities for the purposes of that Act. The European Union (Artificial Intelligence) (Designation) (Amendment) Regulations 2026, given under Official Seal on 31 July 2026, substituted regulation 3 and replaced the Schedule with three Schedules.

Regulation 3, as substituted, designates each market surveillance authority named in Schedule 1 as the national competent authority for the purposes of Article 70(1), for its own point of Section A of Annex I to the AI Act. Schedule 1 names the Health and Safety Authority, the Competition and Consumer Protection Commission, the Marine Survey Office, the Commission for Communications Regulation, the Commission for Railway Regulation and the Health Products Regulatory Authority.

Oifig IS na hÉireann is designated as a market surveillance authority for the purposes of Article 70(1). Coimisiún na Meán is the market surveillance authority for Article 50, insofar as that Article relates to providers or deployers of AI systems, where the provider or deployer is an intermediary service, an audiovisual media service, a sound broadcasting service, a relevant designated online service or a hosting service.

The Central Bank of Ireland is the market surveillance authority for Article 74(6), insofar as that paragraph applies to the placing on the market, putting into service or use of a high-risk AI system by a regulated financial service provider in direct connection with the provision of financial services. The Data Protection Commission is the market surveillance authority for Article 74(8).

Schedule 2 designates, for the points of Annex III it lists, the Data Protection Commission, the Commission for Communications Regulation, the National Transport Authority, the Commission for Regulation of Utilities, the Workplace Relations Commission, the Health Service Executive and the Central Bank of Ireland as market surveillance authorities.

Schedule 3 designates, for the points of Article 5(1) it lists, Coimisiún na Meán, the Central Bank of Ireland, the Data Protection Commission and the Workplace Relations Commission as market surveillance authorities. Regulation 5 designates notifying authorities for the purposes of Article 28. The Irish National Accreditation Board carries out the assessment and monitoring referred to in Article 28(1) in relation to the notifying authorities designated under regulation 5(1)(a), (b) and (d).

Section 42 of the Regulation of Artificial Intelligence Act 2026 designates Oifig IS na hÉireann as the single point of contact for the purposes of Article 70(2) and revokes regulation 6 of these Regulations. The Regulation of Artificial Intelligence Act 2026 came into operation on 31 July 2026, other than paragraphs (a) and (e) of the definition of applicable market surveillance authority in section 78, under the Regulation of Artificial Intelligence Act 2026 (Commencement) Order 2026.

The Regulations create no separate duty on an AI developer or deployer; they identify which State body enforces the AI Act against one.

This Act establishes Oifig IS na hÉireann as an independent statutory body, with its own Board and Chief Executive Officer, to give further effect to the EU AI Act in Ireland. Part 3 gives the Office the single-point-of-contact and AI register functions, lets it establish AI regulatory sandboxes, and creates a real-world testing regime for high-risk AI systems.

Part 4 sets general obligations on the relevant market surveillance authorities designated for the AI Act, including derogation, incident-reporting and complaints-handling duties. Part 5 builds the supervision scheme: authorised officers may serve contravention notices and prohibition notices, and may apply to the District Court for a forfeiture order.

Part 6 builds the adjudication and administrative-fines scheme: an independent adjudicator determines whether an AI Act breach occurred and what administrative fine, if any, to impose, and an adjudication takes effect when the High Court confirms it. An administrative fine otherwise follows the ceiling the AI Act's own Article 99 sets for the type of breach, except that a fine imposed on a public body is capped at EUR 1,000,000 regardless of which Article 99 tier would otherwise apply.

The Act creates criminal offences, with penalties set in Part 7, including for unauthorised disclosure of confidential information, obstructing or giving false information to an authorised officer or adjudicator, and disclosing material relevant to an adjudicator's finding without authorisation.

Parts 8 to 10 amend the Central Bank Act 1942 to give the Central Bank AI Act administrative-sanctioning powers, and make further amendments to the Communications Regulation Act 2002, the Competition and Consumer Protection Act 2014 and the Freedom of Information Act 2014.

Section 2 makes it an offence to distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused. Section 3 separately makes it an offence to record, distribute or publish an intimate image of another person without consent where that act seriously interferes with the other person's peace and privacy or causes alarm, distress or harm.

The Act's definition of 'intimate image' covers any visual representation, made by any means including a photographic, film, video or digital representation, of what is, or purports to be, the person's genitals, buttocks, anal region, or, for a woman, her breasts, of underwear covering those areas, of a nude person, or of a person engaged in sexual activity.

Because the image need only purport to be the person's intimate depiction and may be made by any digital means, the offence reaches a fabricated or digitally altered image of that kind, including an AI-generated or AI-altered synthetic image, and is not limited to a genuine photograph of the person.

A controller must notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No DPA 2018 derogation from this timeline was identified.

The General Data Protection Regulation (GDPR) applies directly in Ireland, and the Data Protection Act 2018 (DPA 2018), No. 7 of 2018, gives it domestic effect: Part 3 supplies Ireland's national derogations and exemptions, Part 2 establishes the Data Protection Commission (DPC) as supervisory authority, and Part 6 supplies the enforcement architecture; Part 5 transposes the Law Enforcement Directive and is not the GDPR regime.

Because most large United States technology companies base their EU headquarters in Ireland, the DPC is the lead supervisory authority under the GDPR one-stop-shop mechanism for most of their cross-border processing, which makes Irish enforcement practice a de facto reference point for the whole EU, including on how existing privacy law reaches AI training uses of personal data.

Transferring personal data of a person in Ireland outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.

The DPC additionally operates the one-stop-shop coordination role given Ireland's concentration of EU-headquartered controllers, but this is an institutional and procedural role in cross-border enforcement coordination, not an added transfer restriction.

Section 37 of the Data Protection Act 2018 lets the Minister, in the absence of an adequacy decision under Article 45, make regulations restricting the transfer of categories of personal data to a third country or an international organisation for important reasons of public policy.

General Data Protection Regulation (GDPR) Article 22 gives a person in Ireland the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Section 57 of the Data Protection Act 2018 is Ireland's Article 22(2)(b) law: a solely automated decision authorised or required by an enactment may be made where it grants the person's request, or where the controller lets the person make representations, request human intervention and appeal, and tells them in writing what it did.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Ireland can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. The Data Protection Act 2018 narrows these rights in two ways that reach a private controller.

Section 61 restricts access, rectification, restriction and objection, and for archiving in the public interest also notification and portability, where exercising them would make archiving, scientific or historical research, or statistics impossible or seriously impair it. Section 60(3) restricts the rights in Articles 12 to 22 to the extent necessary for a legal claim or legal proceedings, or where the data are an opinion about the person given in confidence.

A health services provider treating a patient must forward the personal health data it considers relevant, necessary and proportionate to another provider also treating the patient, for integrated care and continuity of care. The data must be forwarded in a digital format that uses the standards in the guidelines and within the period the guidelines specify.

A patient may ask a health services provider in writing to furnish a copy of the patient's personal health data to another provider of the patient. The provider must furnish the copy free of charge as soon as practicable and within one month of receiving the notice. The Executive must give the patient, an appropriate person, a treating provider and its own staff or agents doing necessary maintenance and verification access to an Electronic Health Record.

The Executive must provide measures for a patient to request rectification of information in the patient's Electronic Health Record. A patient or an appropriate person may restrict access by health services providers to all or part of the patient's Electronic Health Record. The Executive must make available without delay and free of charge information about any access to the patient's Electronic Health Record. No order appointing the day on which sections 7, 8 and 13 to 15 come into operation has been located.

The DPC is Ireland's supervisory authority, established under Part 2 of the DPA 2018 and enforcing under Part 6, with General Data Protection Regulation (GDPR) Article 83 administrative fines. Article 82 arms an individual with a direct private right of action.

Section 117 of the DPA 2018 lets a data subject bring a data protection action for an injunction, a declaration or compensation for damage in the District Court, the Circuit Court or the High Court, the compensation recoverable in each of the two lower courts being capped at the limit of that court's jurisdiction in tort. A not-for-profit body mandated by a data subject can bring a data protection action on the data subject's behalf under Section 117(7) of the DPA 2018 and Article 80(1).

The Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 lets a body designated a qualified entity by the Minister for Enterprise, Trade and Employment bring representative actions covering DPA 2018 claims, and the Minister reviews a designation at least once every five years and may revoke it.

A controller that processes personal data for health research in Ireland must ensure that the suitable and specific safeguards listed in Regulation 3(1) of the Health Research Regulations 2018 are taken. Those safeguards include ethical approval of the health research by a research ethics committee. Those safeguards include controls to log whether and by whom the personal data have been consulted, altered, disclosed or erased.

Where the controller's assessment of the research indicates a high risk to the rights and freedoms of individuals, the safeguards include a data protection impact assessment. Subject to Regulations 3A and 3B, the controller must obtain the data subject's explicit consent, record and retain it, and give the data subject a copy, before the health research begins.

The explicit consent requirement does not apply to a retrospective chart review study that a research ethics committee has approved and stated in writing to be low risk to the rights and freedoms of individuals.

A controller proposing to process personal data for health research that began on or after 8 August 2018 may apply to the Committee for a declaration where the public interest in carrying out the research significantly outweighs the public interest in requiring the data subject's explicit consent.

General Data Protection Regulation (GDPR) Article 9(1) governs special categories of personal data, biometric data among them.

The DPA 2018 defines special categories of personal data as personal data revealing the racial or ethnic origin of the data subject, the political opinions or the religious or philosophical beliefs of the data subject, or whether the data subject is a member of a trade union, genetic data, biometric data for the purposes of uniquely identifying an individual, data concerning health, or personal data concerning an individual's sex life or sexual orientation.

Section 46 addresses processing special category data, including biometric data, in the employment and social-welfare context: the processing is lawful where it is necessary for exercising or performing a right or obligation conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law (the GDPR Article 9(2)(b) condition), with suitable and specific measures safeguarding the data subject.

No dedicated Irish provision on voiceprint capture, retention, or destruction specifically was found; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.

Section 2 makes it an offence to intentionally access an information system without lawful authority or reasonable excuse by infringing a security measure. Section 3 criminalises intentionally hindering or interrupting the functioning of an information system without lawful authority. Section 4 criminalises intentionally deleting, damaging, altering or suppressing data on an information system without lawful authority.

Section 5 criminalises intentionally intercepting a non-public transmission of data to, from or within an information system, without lawful authority. Section 6 criminalises producing, selling, procuring, importing, distributing or otherwise making available a computer programme, password, code or similar data designed for committing any of the section 2 to 5 offences.

Because section 2's trigger is infringing a security measure, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of that offence; no reported Irish case has tested the point. The Act repealed the earlier 'unauthorised accessing of data' offence at section 5 of the Criminal Damage Act 1991. That earlier offence rested on operating a computer with intent to access data, rather than on defeating a security measure.

A consumer contract is any contract between a consumer and a trader. A consumer is an individual acting for purposes that are wholly or mainly outside that individual's trade, business, craft or profession. A consumer contract is not excluded from Part 6 by reason only that a term has been individually negotiated between the trader and the consumer, or that the consumer does not pay a price under the contract. An unfair term of a consumer contract is not binding on the consumer.

If a consumer contract is capable of continuing in existence without the unfair term, it continues to bind the parties. A term of a consumer contract is unfair if, contrary to the requirement of good faith, it causes a significant imbalance in the parties' rights and obligations under the contract to the detriment of the consumer. On an application by an authorised body, the court may declare that a term of a consumer contract is unfair and prohibit the use of that term or similar terms.

Where, after an authorised body publishes an order or notice about a term, a trader enters into a consumer contract containing that term or seeks to rely on it, the trader commits an offence. A person who commits an offence under the Act is liable on summary conviction to a class A fine or imprisonment for up to 12 months, or both, and on conviction on indictment to a fine of up to EUR 60,000 or imprisonment for up to 18 months, or both. The Act, other than section 161, came into operation on 29 November 2022.

An electronic contract is not denied legal effect, validity or enforceability solely on the grounds that it is wholly or partly in electronic form, or has been concluded wholly or partly by way of an electronic communication.

In the formation of a contract, an offer, acceptance of an offer or any related communication (including any subsequent amendment, cancellation or revocation of the offer or acceptance of the offer) may, unless otherwise agreed by the parties, be communicated by means of an electronic communication. The Act came into operation on 20 September 2000.

The 2021 Regulations added a new section 53B to the Copyright and Related Rights Act 2000: where a rightholder has not expressly reserved, in an appropriate manner, the use of a work for reproduction or extraction for the purposes of text and data mining, a person who has lawful access to the work may reproduce it for that purpose, and may retain the reproduction for as long as necessary for the mining.

The section named the author until Statutory Instrument 469 of 2026, made on 9 September 2026, substituted 'a rightholder' for 'an author' in section 53B(1) and (3). A reservation is made in an appropriate manner where it is machine-readable, for content made publicly available online, including in the metadata or terms and conditions of a website or service, and, for content not made publicly available online, where it is clearly communicated to all persons with lawful access.

The Regulations also amended the pre-existing research and non-commercial text-and-data-mining exception at section 53A by inserting new subsections requiring that a copy made under it be stored securely and permitting it to be retained for the purposes of research, including for verification of research results, and by providing that any contractual provision contrary to the section is unenforceable. A parallel exception for computer programs was inserted at section 82(3)-(5). A parallel exception for subject matter protected by related rights was inserted after section 225A as section 225AA.

Part V of the Copyright and Related Rights Act 2000 confers a property right, the database right, on a database in which there has been a substantial investment in obtaining, verifying or presenting its contents, whether or not the database or any of its contents is itself a copyright work. 'Extraction' means the permanent or temporary transfer of all or a substantial part of the database's contents to another medium.

'Re-utilisation' means making those contents available to the public by any means, and 'substantial' is judged by quantity or quality or a combination of both. The right expires 15 years from the end of the calendar year the database was completed, or from the end of the calendar year it was first lawfully re-utilised if that comes later, and a substantial change to the database's contents amounting to a substantial new investment qualifies the resulting database for its own fresh term. The right exists independently of any copyright in the database's underlying contents.

The Regulations came into operation on 9 June 2018. The Regulations were made for the purpose of giving effect to Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016.

The acquisition of a trade secret without the consent of the trade secret holder is unlawful whenever carried out by unauthorized access to, appropriation of, or copying of any documents, objects, materials, substances or electronic files, lawfully under the control of the holder, containing the trade secret or from which it can be deduced.

The acquisition is also unlawful whenever carried out by any other conduct that, under the circumstances, is considered contrary to proper commercial practice. The use or disclosure of a trade secret without the holder's consent is unlawful where the person acquired it unlawfully, is in breach of a confidentiality agreement or other duty not to disclose it, or is in breach of a contractual or other duty to limit its use.

The acquisition of a trade secret is considered lawful when it is obtained by observation, study, disassembly or testing of a product or object that has been made available to the public. The court must dismiss an application under the Regulations where it is satisfied that the alleged acquisition, use or disclosure was carried out for exercising the right to freedom of expression and information.

Where the court finds on the merits that a trade secret was unlawfully acquired, used or disclosed, it may order the cessation or prohibition of the use or disclosure of the trade secret. The court must order an infringer who knew or ought to have known of the unlawful conduct to pay the holder damages appropriate to the actual prejudice suffered.

A person who contravenes or fails to comply with a measure adopted under Regulation 10, 11, 12 or 14 commits an offence, punishable on conviction on indictment by a fine of up to EUR 50,000 or imprisonment of up to 3 years, or both.

Radio equipment in a class or category specified by a Commission delegated act under Article 44 of the Radio Equipment Directive, for the purposes of Article 3(3), must comply with the essential requirements in Article 3(3)(a) to (i) that the delegated act requires, while it is in force (regulation 4(5)). A person may make radio equipment available on the market, or put it into service, only if it complies with the Regulations (regulation 4(3) and (4)).

The Commission for Communications Regulation is designated as the competent authority (regulation 9). A person who commits an offence under the Regulations is liable on summary conviction to a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment to a fine of up to 500,000 euro or imprisonment for up to 2 years or both (regulation 58). The Regulations were made on 20 January 2026 (the closing formula) and revoke the Regulations of 2017 (regulation 61).

The Central Bank of Ireland is designated as the competent authority in the State for Articles 26(9) and 32(5) of the DORA Regulation (regulation 4). The Bank has all the powers necessary for its functions and duties under the DORA Regulation (regulation 5).

For a contravention of the DORA Regulation the Bank may order the person to cease and desist, order the cessation of a practice, adopt measures including pecuniary measures to ensure financial entities continue to comply, and issue public notices naming the person and the breach, and it may apply the sanctions to members of the management body (regulation 6). Any decision taken or sanction imposed is an appealable decision under Part VIIA of the Central Bank Act 1942 (regulation 7). The DORA Regulation and these Regulations do not apply to credit unions until 17 January 2028 (regulation 3).

Regulation 2 requires the management company of a UCITS fund to have control and safeguard arrangements for electronic data processing, including for network and information systems set up and managed in accordance with the DORA Regulation (Regulation (EU) 2022/2554). Regulation 3 requires the Central Bank to require an alternative investment fund manager to have the same arrangements for network and information systems.

Regulation 4 requires credit institutions and investment firms to have contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, established, managed and tested in accordance with Article 11 of the DORA Regulation. Regulation 6 requires an insurance or reinsurance undertaking to set up and manage network and information systems in accordance with the DORA Regulation. The Regulations came into operation on 17 January 2025.

Regulation 17 requires a designated operator of essential services (an undertaking the Minister or the Central Bank of Ireland designates in a sector listed in Schedule 1 other than banking and financial market infrastructure, which Regulation 3(2) excludes) to take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems it uses and to prevent or minimise the impact of an incident on the continuity of its service.

Regulation 21 imposes the equivalent duty on a relevant digital service provider, an online marketplace, online search engine or cloud computing service under Schedule 2, and additionally requires it to take into account the security of its systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.

These Regulations transpose the original NIS Directive (Directive (EU) 2016/1148) and, according to the National Cyber Security Centre, remain in full effect pending the National Cyber Security Bill's transposition of its successor, NIS2, and cover the most critical operators in the State in the meantime.

Regulation 18 requires a designated operator of essential services to notify the State's computer security incident response team (CSIRT), without delay and in any event not later than 72 hours after becoming aware, of an incident with a significant impact on the continuity of an essential service it provides, including an incident affecting a third-party digital service provider it relies on, and to notify the CSIRT again once the incident is resolved.

Regulation 22 imposes the equivalent duty on a relevant digital service provider for an incident with a substantial impact on a service listed in Schedule 2. The CSIRT is the unit of the Department of Communications, Climate Action and Environment known as the computer security incident response team, which Regulation 10 designates.

Regulation 6 requires the competent authority and the single point of contact to cooperate with the Data Protection Commission where a notified incident also compromises personal data, a duty distinct from the breach-notification duty General Data Protection Regulation (GDPR) itself imposes on a controller.

Section 147(1) provides that a licensee shall not advertise relevant content, or cause a person to advertise relevant content on the licensee's behalf, by electronic communication to another person unless the intended recipient has given consent to receiving advertising from the licensee by means of that electronic communication, the service provides an easily accessible mechanism to enable the recipient to stop receiving such advertising from the licensee, and the licensee complies with any applicable regulations.

Section 147(4) defines electronic communication as any electronic communication (including by telephone, text message or e-mail) other than an audiovisual on-demand media service, an on-demand sound service, a social media service, a video-sharing platform service or a broadcasting service.

Section 147(2) provides that a licensee shall not be taken to have contravened subsection (1) where, as part of the content shown to an intended recipient by an electronic communication, a logo, trademark, emblem or marketing image of the licensee displayed at a sporting event is visible, or details of the sponsorship by the licensee of a sporting event are visible or audible.

Section 147(3) provides that subsection (1) shall not apply to advertising by electronic communication by a licensee of a gambling licence for a charitable or philanthropic purpose provided that the advertising does not include the name or trading name, or the logo, trademark, emblem or marketing image, of a licensee of a Business to Consumer gambling licence or a Business to Business gambling licensee.

Section 146(1) provides, subject to subsection (2), that a licensee shall not enter into an arrangement with another person for the purposes of advertising relevant content to a third party on a social media service or a video-sharing platform service unless the terms of the arrangement ensure the advertising is provided only to an intended recipient who has an account with that other person and has subscribed to the licensee's account on that service, and in accordance with the applicable regulations.

Section 146(2) disapplies subsection (1) for an arrangement entered into by a licensee of a gambling licence for a charitable or philanthropic purpose where the arrangement ensures that the advertising does not include the name or trading name, or the logo, trademark, emblem or marketing image, of a licensee of a Business to Consumer gambling licence or a Business to Business gambling licensee.

Relevant content means, in relation to advertising, a relevant gambling activity or, in the case of a Business to Consumer gambling licence, the licensee of that gambling licence. A licensee is a person who is the holder of a gambling licence which is, for the time being, in force. A relevant obligation includes an obligation, however described, imposed on a licensee under the Act or any regulations made under it.

Section 206(1) provides that the financial penalty imposed as an administrative sanction on a licensee shall not exceed €20,000,000 or, if greater, 10 per cent of the turnover of the licensee in the financial year preceding the date of the decision as to contravention or in any year in which the acts occasioning the sanction occurred. No order appointing the day on which sections 146 and 147 come into operation has been located.

Regulation 13(1) requires a natural person's prior consent before sending an unsolicited communication for direct marketing by automated calling machine, facsimile machine, or electronic mail, a term the Regulations define to include an SMS message. Regulation 13(2) excludes from that consent duty an email sent to an address that reasonably appears to be used mainly for the recipient's own commercial or official activity, where the message relates solely to that activity.

Regulations 13(3) and (4) instead let a recipient who is not a natural person, such as a company, object after the fact rather than requiring prior consent: for email, only by notifying the sender that it does not consent, and for automated calling and fax communications, by that notification or through the National Directory Database's opt-out record. Regulation 13(7) extends the consent duty to an SMS sent for a non-marketing purpose that itself contains direct-marketing information.

Regulation 13(10) requires a direct-marketing call to include the caller's name and, if applicable, the name of the person on whose behalf it is made, an automated-calling or fax communication to include the name, address and telephone number of the sender and, if applicable, of the person on whose behalf it is sent, and an email to include a valid address at which the sender may be contacted.

Regulation 13(11) lets a seller market its own similar products to an existing customer without fresh consent if it gave a free opt-out at collection and offers one in every later message, where the sale occurred, or the details were last used for marketing by email, within the preceding 12 months.

Regulation 13(12) bars a marketing email that disguises or conceals the sender's identity, lacks a valid address to stop future messages, encourages recipients to visit websites, or otherwise contravenes Regulation 8 of the Electronic Commerce Regulations 2003.

Regulation 5(3) bars using an electronic communications network to store information, or gain access to information already stored, in a subscriber's or user's terminal equipment, unless the subscriber or user has consented and has first been given clear and comprehensive information, prominently displayed and easily accessible, about the purposes of the processing, in accordance with the Data Protection Acts.

Regulation 5(4) lets that consent be given, where technically possible and effective, through browser settings or another technological application. Regulation 5(5) exempts storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary to provide an information society service the subscriber or user explicitly requested.

A breach of regulation 5 is not itself an offence: the Data Protection Commission instead investigates and may serve an enforcement notice, and only a failure to comply with that notice is an offence.

Section 98(1) makes it an offence to intercept, attempt to intercept, authorise or permit another person to intercept, or do anything that will enable interception of, a telecommunications message being transmitted by the telecommunications company, or to disclose or use information from a message so intercepted, subject to investigatory, ministerial-directed and operating-duty exceptions in section 98(2).

Section 13(3) of the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 substituted the section's definition of "intercept": listening to, or recording by any means, a telecommunications message in the course of its transmission, but the definition does not include such listening or recording where either the person on whose behalf the message is transmitted or the person intended to receive it has consented, so one party's own consent to its own recording of a call is enough to take that recording outside the offence.

Section 13(2) of the 1993 Act separately makes it an offence for a company employee to disclose information about a person's use of telecommunications services outside listed exceptions (the customer's own consent, crime prevention, a court order, State security, civil proceedings, or an internal duty to disclose), tightening how a company employee handles the same information the interception offence protects.

Regulation 5(1), without prejudice to the separate telecommunications-interception offence in section 98 of the Postal and Telecommunications Services Act 1983 (as amended), prohibits the listening, tapping, storage or other kind of interception or surveillance of a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised for a purpose under Article 15(1) of the ePrivacy Directive.

Regulation 5(2) takes outside that prohibition the technical storage necessary to convey a communication, and any legally authorised recording of a communication carried out in the course of lawful business practice to provide evidence of a commercial transaction or other business communication; the Regulations' own text states no further condition, such as telling the parties in advance, on that business-recording exception.

A breach of regulation 5 is not itself an offence: the Data Protection Commission instead investigates and may serve an enforcement notice, and only a failure to comply with that notice is an offence.

Regulation 13(5) bars an unsolicited telephone call for direct marketing to any subscriber or user who has told the caller not to call or whose line is recorded on the National Directory Database's opt-out record, so a live call to a number other than a mobile needs no prior consent unless the called line has already opted out.

Regulation 13(6) requires the called subscriber's or user's prior consent, or recorded consent in the National Directory Database, before an automated calling machine or telephone call markets to their mobile telephone.

Regulation 13(8) lets a subscriber or user register an objection, or a request to be recorded in the National Directory Database, free of charge, and regulation 13(9) means a caller does not contravene the National Directory Database opt-out rule by calling within 28 days after a request or notification is received and recorded in the Database.

Section 45(3) of the Defamation Act 2009, inserted by section 22 of the Defamation (Amendment) Act 2026, lets the Circuit Court make an identification order requiring a relevant intermediary service provider to provide the applicant with such relevant information as the court may specify. Relevant information, in relation to an anonymous publisher, means information as to the identity, address or other contact information of the anonymous publisher.

A relevant intermediary service provider is an intermediary service provider that provides the intermediary service by means of which the statement is published, or caused to be published, by the anonymous publisher. An intermediary service means a mere conduit, caching or hosting service that is an information society service.

The court may make the order only where it is satisfied that a statement was published on an information society service by means of an intermediary service provider by an anonymous publisher whose identity is unknown to the applicant.

The court must also be satisfied that the applicant's defamation claim against the anonymous publisher is likely to succeed at trial, that the relevant information is necessary to enable the applicant to bring defamation proceedings, that it is likely to be in the possession of the provider, and that the applicant has no other practicable means of obtaining it.

The court may make the order only where it considers that it is in the interests of justice and that the interests favouring disclosure outweigh those against, and may attach conditions, including terms restricting the use of the information disclosed to the bringing of defamation proceedings against the anonymous publisher. An application must be made in good faith and on notice to the relevant intermediary service provider concerned.

The court may order the applicant to pay any or all of the costs of the relevant intermediary service provider in relation to an application and the costs resulting from the making of any identification order.

Regulation 18 defines an online content-sharing service provider as a provider of an information society service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organises and promotes for profit-making purposes.

The definition does not include, among others, not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and -sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that allow users to upload content for their own use.

Regulation 19(2) provides that an online content-sharing service provider shall not perform an act of communication or making available to the public without first obtaining an authorisation from the rightholders, which may be obtained by means such as concluding a licensing agreement where those rightholders are willing to do so.

Regulation 19(3) provides that an authorisation obtained by the provider also covers acts carried out by users when those users are not acting on a commercial basis or where their activity does not generate significant revenues. Regulation 19(4)(a) provides that, when a provider performs such an act in accordance with the Regulations, the limitation of liability established in section 40 of the Copyright and Related Rights Act 2000 shall not apply to the situations covered by the Regulations.

Regulation 20(1) makes the provider liable for unauthorised acts of communication to the public if no authorisation is granted, unless it demonstrates that it made best efforts to obtain an authorisation, made best efforts to ensure the unavailability of specific works for which the rightholders have provided relevant and necessary information, and acted expeditiously on a sufficiently substantiated notice to disable access to or remove the notified works and made best efforts to prevent their future uploads.

Regulation 20(3) provides that a new provider whose services have been available to the public in the European Union for less than 3 years and whose annual turnover is below EUR 10 million shall only be obliged to comply with subparagraph (a) of paragraph (2) and to act expeditiously, upon receiving a sufficiently substantiated notice, to disable access to or remove the notified works.

Regulation 20(4) provides that where the average number of monthly unique visitors of such a new provider exceeds 5 million, calculated on the basis of the previous calendar year, it shall also demonstrate that it has made best efforts to prevent further uploads of the notified works for which the rightholders have provided relevant and necessary information.

Regulation 21(1) provides that the cooperation between a provider and a rightholder shall not result in the prevention of the availability of a work uploaded by users which does not infringe copyright and related rights, including where it is covered by an exception or limitation. Regulation 21(3) provides that the application of Part 5 shall not be construed as imposing any general monitoring obligation.

Regulation 22(1) requires a provider to give a rightholder, at his or her request, adequate information on the functioning of its practices with regard to the cooperation referred to in Regulation 21. Regulation 22(2) requires a provider that has concluded a licensing agreement with a rightholder to provide the rightholder, at his or her request, with sufficiently specific information on the use of content covered by the agreement, subject to paragraph (4).

Regulation 23(1) requires a provider to put in place an effective and expeditious complaint and redress mechanism that is available to users of its services in the event of disputes over the disabling of access to, or the removal of, uploaded works or other subject matter. Regulation 23(3) requires complaints to be processed without undue delay, with decisions to disable access to or remove uploaded content subject to human review.

Regulation 23(4) requires a provider to inform its users, in its terms and conditions, that they can use works and other subject matter under exceptions or limitations to copyright and related rights provided for in European Union law. Regulation 24 provides that, without prejudice to judicial remedies, disputes under Part 5 may be submitted to a mediator in accordance with the Mediation Act 2017 or, where appropriate, to an arbitrator in accordance with the Arbitration Act 2010.

Section 139ZG(1) of the Broadcasting Act 2009 defines a contravention to include an infringement by a hosting service provider of Article 3(3) or (6), Article 4(2) or (7), Article 5(1), (2), (3), (5) or (6), Article 6, Article 7, Article 10, Article 11, Article 14(5), Article 15(1) or Article 17 of the Terrorist Content Online Regulation.

The Act defines the Terrorist Content Online Regulation as Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2021 on addressing the dissemination of terrorist content online.

Section 139ZW(1AA) provides that, for a contravention within paragraph (ba) that amounts to, or is a result of, a systematic or persistent failure to comply with obligations under Article 3(3), an administrative financial sanction of up to 4 per cent of the global turnover of the inquiry subject in the financial year preceding the decision may be imposed.

Section 139ZW(3A) requires the Commission, in setting the amount for such a contravention, to have regard to all relevant circumstances, including the nature, gravity and duration of the contravention, whether it was intentional or negligent, previous contraventions by the hosting service provider, its financial strength and its degree of fault.

Section 139ZGA lets the Commission by written notice require a person to provide it with information relating to whether the person is a hosting service provider, or is a hosting service provider that is, or has been, exposed to terrorist content. The person shall comply with the notice within 20 working days of the date of the notice or within such further period as may be agreed in writing before the expiry of the 20 days between the Commission and the person concerned.

Where the person fails to comply, the Commission may apply to a judge of the District Court assigned to the Dublin Metropolitan District for an order directing the person to provide the information requested in the notice.

Regulation 3 designates Coimisiún na Meán, for the purposes of Article 12(1)(c) of Regulation (EU) 2021/784, as the competent authority that is competent to oversee the implementation of specific measures pursuant to Article 5 of Regulation (EU) 2021/784. Regulation 4 requires Coimisiún na Meán to carry out those functions in an objective and non-discriminatory manner, while fully respecting fundamental rights, and independently.

Regulation 5 requires Coimisiún na Meán, before 1 March each year, to provide the Minister for Justice with the relevant information required to be forwarded to the Commission of the European Union pursuant to Article 21 of Regulation (EU) 2021/784.

Regulation 3 designates Coimisiún na Meán, for the purposes of Article 12(1)(d) of Regulation (EU) 2021/784, as the competent authority that is competent to impose penalties pursuant to Article 18 of Regulation (EU) 2021/784. Regulation 4 requires Coimisiún na Meán to carry out those functions in an objective and non-discriminatory manner, in a manner separate and distinct from its functions under Statutory Instrument No. 545 of 2023 and independently, while fully respecting fundamental rights.

Regulation 5 requires Coimisiún na Meán, before 1 March each year, to provide the Minister for Justice with the relevant information required to be forwarded to the Commission of the European Union pursuant to Article 21 of Regulation (EU) 2021/784.

Regulation 3 designates the Garda Commissioner, for the purposes of Article 12(1)(b), as the competent authority to scrutinise removal orders pursuant to Article 4 of Regulation (EU) 2021/784. Regulation 4 requires the Garda Commissioner to carry out those functions in an objective and non-discriminatory manner, while fully respecting fundamental rights, and independently.

Regulation 5 requires the Garda Commissioner, before 1 March each year, to provide the Minister for Justice, Home Affairs and Migration with the information the Commissioner has in that capacity that is required to be forwarded to the Commission of the European Union pursuant to Article 21. The Regulations contain no commencement provision of their own. They were made on 24 July 2025.

Section 16(3) of the Interpretation Act 2005, subject to its subsection (4), provides that every provision of a statutory instrument comes into operation at the end of the day before the day on which the instrument is made.

Section 44 designates the Competition and Consumer Protection Commission, for the purposes of Article 49(1), as the competent authority in respect of Articles 30, 31 and 32 of the Digital Services Regulation.

A relevant provider is a provider of an online platform whose main establishment is located in the State, one to which Article 13(1) applies and whose legal representative resides or is established in the State, or one to which Article 13(1) applies that has failed to designate a legal representative.

Section 67(1) provides that an administrative financial sanction for an infringement of Article 30, 31 or 32 shall not exceed 6 per cent of the annual turnover of the inquiry subject in the financial year preceding the decision. Section 67(2) limits the sanction to one per cent of annual income or turnover for the matters in paragraph (b) of that definition, which include obstructing or misleading an authorised officer in a Digital Services investigation.

Section 74 limits the daily payment penalty for failing to comply with a notice to end a contravention to 5 per cent of the provider's average daily turnover in the preceding financial year for each day the failure continues. Section 77 lets the Commission, in the circumstances that section sets out, apply to the High Court for an order requiring a relevant provider to block access in the State to an intermediary service.

Section 78 lets an authorised officer serve a compliance notice on a relevant provider that has infringed Article 30, 31 or 32. A provider may appeal a compliance notice to the District Court not later than 14 days after service of the notice. A provider that fails to comply with a compliance notice by the due date commits an offence punishable on summary conviction by a class B fine or imprisonment for a term not exceeding 6 months or both.

Failure without reasonable excuse to comply with a notice requiring interim measures under section 54, or with a notice to end a contravention under section 73, is a category 1 offence. A category 1 offence under Part 3 is punishable on summary conviction by a class A fine or imprisonment for a term not exceeding 12 months or both, and on conviction on indictment by a fine not exceeding €500,000 or imprisonment for a term not exceeding 10 years or both.

Section 79 lets the Commission enter into a written commitment agreement with a relevant provider to address any issue relating to compliance with Article 30, 31 or 32. Section 45A, inserted by the Digital Services (Levy) Act 2024, lets the Commission make an order imposing a levy on consumer online platform providers. In that section consumer online platform providers means providers of online platforms allowing consumers to conclude distance contracts with traders.

A levy order is to provide for requirements on providers subject to the levy to keep relevant records and to make them available to the Commission. Section 45B makes it a category 2 offence to provide the Commission, in purported compliance with a requirement imposed by or under a levy order, with information that the person knows to be false or misleading.

A category 2 offence under Part 3 is punishable on summary conviction by a class A fine or imprisonment for a term not exceeding 12 months or both, and on conviction on indictment by a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

Section 7(6) of the Broadcasting Act 2009, inserted by section 8 of the Act, designates Coimisiún na Meán (the Commission) as the Digital Services Coordinator and as the competent authority for the Digital Services Regulation other than for Articles 30, 31 and 32. Section 15 defines a contravention to include an infringement by a relevant intermediary service provider of any of the designated provisions of the Digital Services Regulation.

A designated provision is any provision of the Regulation other than Article 30, 31 or 32 or Section 5 of Chapter III. A relevant intermediary service provider is one whose main establishment is located in the State, one to which Article 13(1) applies and whose legal representative resides or is established in the State, or one to which Article 13(1) applies that has failed to designate a legal representative.

Section 32 provides that an administrative financial sanction for such an infringement shall not exceed 6 per cent of the turnover of the inquiry subject in the financial year preceding the date of the decision to impose it. Section 32 provides that the limit is one per cent of the income or turnover of the inquiry subject for a contravention within paragraph (c) of that definition.

Section 19 makes a person liable to an administrative financial sanction if, in the course of a Digital Services investigation, the person obstructs an authorised officer, fails to comply with an officer's requirement, or gives the officer information that is false or misleading in a material respect.

Section 139ZK(8B) provides that a person other than the inquiry subject may be sanctioned for such an act or omission only if, before it occurred, an authorised officer gave the person written notice, in reasonable time, of all relevant information about the exercise of the power or the request or requirement, including the time to comply, the maximum amount of the sanction and the effect of section 139ZS(2).

Section 21 inserts section 139ZLA, under which a daily payment penalty imposed to enforce an authorised officer's demands in a Digital Services investigation may not exceed, for each day the failure continues, 5 per cent of the person's average daily income or turnover in the preceding financial year.

Section 21 also inserts section 139ZLB, under which the Commission may, where there is prima facie evidence of a continuing infringement that gives rise to a risk of serious harm before a decision could be made, require the inquiry subject by written notice to take measures that would avoid or reduce that risk. Failure without reasonable excuse to comply with such a notice is a category 1 offence.

A category 1 offence is punishable on summary conviction by a class A fine or imprisonment for a term not exceeding 12 months or both, and on conviction on indictment by a fine not exceeding €500,000 or imprisonment for a term not exceeding 10 years or both.

Section 37 inserts section 139ZZBA, under which the daily payment penalty for failing to comply with a notice to end a contravention may not exceed, for each day the failure continues, 5 per cent of the provider's average daily turnover in the preceding financial year.

Section 38 inserts section 139ZZCB, under which the Commission may apply to the High Court for an order requiring a relevant intermediary service provider to block access in the State to an intermediary service provided by another provider. The court may make that order only if, among other conditions, the infringement is continuing and entails a criminal offence involving a threat to the life or safety of persons.

An access blocking order has effect for a period of not more than 28 days, which the High Court may allow the Commission to extend for further periods of not more than 28 days. Section 40 inserts section 139ZZGA, under which a compliance notice may be served on a relevant intermediary service provider for an infringement of Articles 11, 12, 13(4), 14(1), (2), (5) and (6), 15(1), 16(1), 21(1) and (4), 24(2), 25 and 26(1)(a), (b), (c) and (d) of the Digital Services Regulation.

A provider may appeal a compliance notice to the District Court not later than 14 days after service of the notice. A provider that fails to comply with a compliance notice by the due date commits an offence punishable on summary conviction by a class B fine or imprisonment for a term not exceeding 6 months or both.

Section 40 also inserts section 139ZZGB, under which the Commission may at any time enter into a written commitment agreement with a relevant intermediary service provider to address any issue relating to compliance with the designated provisions. A provider that fails to comply with a commitment agreement may be liable to an administrative financial sanction.

Section 190 of the Broadcasting Act 2009, inserted by section 41, lets the Commission award status as a trusted flagger to an entity established in the State that meets the conditions in Article 22(2). Section 187(7) of that Act requires a provider of a very large online platform or a very large online search engine to provide access to data to a vetted researcher where the Commission has issued a reasoned request under Article 40(4) for that researcher.

Section 201 of that Act lets a person complain to the Commission that an intermediary service provider has failed to comply with a provision of the Digital Services Regulation. Section 5 revokes regulations 15 to 18 of Statutory Instrument No. 68 of 2003, the European Communities (Directive 2000/31/EC) Regulations 2003.

Regulations 16, 17 and 18 of that instrument had provided that an intermediary service provider is not liable for information it transmits as a mere conduit, caches, or stores at the request of a recipient of its service, on the conditions they stated. Section 21 of the Broadcasting Act 2009 lets the Commission make an order imposing a levy on intermediary service providers and hosting service providers, among others.

Regulation 5 designates An Coimisiún Toghcháin, for the purposes of Article 22(9), as the national contact point for the purposes of all aspects of the Political Advertising Regulation, which is Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Regulation 6(1) designates An Coimisiún Toghcháin, subject to paragraph (2) and Regulation 31, as the competent authority for the purposes of Articles 21(4) and 22(3) and (4).

Regulation 6(2) designates Coimisiún na Meán, for the purposes of Article 22(3) and (4), as the competent authority to supervise the compliance of providers of intermediary services, providers of audiovisual media services, providers of a sound broadcasting service, providers of designated relevant online services and hosting service providers with the obligations in Articles 7 to 17 that apply to them.

Regulation 31 designates the Data Protection Commission, for the purposes of Article 22(1), as the competent authority in respect of Articles 18 and 19, other than insofar as those Articles apply to Regulation (EU) 2018/1725. Regulation 4 provides that the relevant provisions of the Regulations, other than Regulation 3 and Regulation 4, do not apply to an infringement committed during the grace period, which runs from and including 10 October 2025 to and including 31 October 2025.

Regulation 16 lets the competent authority serve a compliance notice on a relevant sponsor or provider, for the purposes of Article 22(5) and (6), on or after the day a decision that the relevant infringement was committed takes effect. A sponsor or provider on whom a compliance notice was served may, within 28 days from the date on which the notice was served, appeal to a judge of the District Court against a decision or direction in the notice.

A sponsor or provider that fails to comply with a compliance notice commits an offence punishable on summary conviction by a class A fine or imprisonment for a term not exceeding 12 months or both, and on conviction on indictment by a fine not exceeding €50,000 or imprisonment for a term not exceeding three years or both.

Regulation 23(1) provides that an administrative financial penalty, other than a periodic one, shall not exceed the maximum amounts specified in Article 25(2), and that a periodic administrative financial penalty shall not exceed a maximum of €1,000 for each day or part of a day on which the relevant infringement is continued.

Regulation 33 requires a political advertising publisher required to prepare a management report to make the information included in that report by virtue of Article 14(1) available to An Coimisiún Toghcháin within the 28 days immediately following the inclusion of that information in the report. Regulation 36 repeals section 140 of the Electoral Act 1992 and Part 4 of the Electoral Reform Act 2022.

Section 1.5 of the Code provides that the entirety of the Code is binding for the video-sharing platform services regulated by the Code. Section 2.2 provides that the Code applies to all video-sharing platform services which are under the jurisdiction of the State within the meaning of Section 2B of the Act, being services within the category of relevant online services designated by the Commission.

Section 9.1 provides that, pursuant to Section 139Q of the Act, a failure by a video-sharing platform service to comply with the Code shall be a contravention for the purposes of Part 8B of the Act.

Section 12.1 requires a video-sharing platform service provider to include in the terms and conditions and related obligations of the service restrictions that preclude users from uploading or sharing restricted video content and restricted indissociable user-generated content as the Code defines them.

Restricted video content includes video content by which a person bullies or humiliates another person, promotes or encourages behaviour that characterises a feeding or eating disorder, promotes or encourages self-harm or suicide, or makes available knowledge of methods of self-harm or suicide, where the content meets the risk test.

The risk test is content that gives rise to any risk to a person's life or to a risk of significant harm to a person's physical or mental health, where the harm is reasonably foreseeable. Restricted video content also includes video content containing incitement to violence or hatred directed against a group of persons or a member of a group based on any of the grounds referred to in Article 21 of the Charter of Fundamental Rights of the European Union.

Restricted video content also includes video content the dissemination of which constitutes a public provocation to commit a terrorist offence, an offence concerning child pornography as the Code words it, or an offence concerning racism and xenophobia.

Section 12.6 requires the provider to apply the terms and conditions that give effect to section 12 of the Code and, where appropriate and after having issued a prior warning, to suspend for a reasonable period of time the provision of its services to users that it has determined to have frequently infringed them.

Section 12.9 provides that sections 12.6, 12.7 and 12.8 apply only insofar as the consequences for the user are not covered by measures adopted pursuant to Articles 23 and 35(1)(b) of Regulation (EU) 2022/2065. Section 15.1 requires the provider to establish and operate transparent and user-friendly mechanisms for users to report or flag restricted video content and restricted indissociable user-generated content, among other categories.

Section 15.2 requires the provider to establish and operate systems by which it explains to users what effect has been given to the reporting and flagging of content, for example the removal of such content.

Section 15.3 requires the provider, when informing a notifier of its decision about reported or flagged content, to tell the notifier that they can use the provider's complaint handling procedures if they are dissatisfied and to provide clear and transparent information about complaint handling systems to users.

Section 16.1 requires the provider to establish and operate transparent, easy-to-use and effective procedures for the handling and resolution of complaints made by users in relation to the implementation of measures relating to age assurance, content rating, parental controls and reporting and flagging. Section 16.4 requires the provider to handle complaints in a diligent, timely, non-discriminatory and effective manner.

Section 17.3 requires the provider, pursuant to Section 139K(6) of the Act, to provide a report to the Commission, every 3 months or at such other intervals as the Commission specifies, on its handling of communications from users raising complaints or other matters.

Sections 11 to 17 of Part B of the Code apply from the date the Commission determined for the application of Part B. Section 139ZG(1) of the Broadcasting Act 2009 includes in the definition of contravention a failure to comply with an online safety code.

Section 139ZW(1) of that Act provides that, where the inquiry subject is not an individual, an administrative financial sanction for such a contravention shall not exceed €20,000,000 or, if greater, 10 per cent of the relevant turnover of the inquiry subject in the financial year preceding the date of the decision to impose it.

Section 2(1) of the Act makes the producer liable in damages in tort for damage caused wholly or partly by a defect in his product. The Department of Enterprise, Tourism and Employment describes the main effect of the Act as introducing into Irish law the principle of strict or no fault liability.

Section 2(2) makes liable as producer the manufacturer of a finished product, of a raw material and of a component part, a person who held himself out as the producer by putting his name or trade mark on the product, and a person who imported the product into a Member State from outside the European Communities in order to supply it in the course of business.

A supplier is liable as the producer if the producer cannot by taking reasonable steps be identified, the injured person asks the supplier to identify the persons named in section 2(2) within a reasonable time after the damage and when it is not reasonably practicable for the injured person to identify all of them, and the supplier fails within a reasonable time to comply or to identify the person who supplied the product to it.

Section 1(1) defines a product as all movables, including primary agricultural products that have not undergone initial processing, and as including electricity where damage is caused by a failure in its generation. The definition of product was substituted from December 4, 2000 by the European Communities (Liability For Defective Products) Regulations 2000. Section 1(3) requires a court to construe the Act so as to give effect to the Council Directive.

The injured person must prove the damage, the defect and the causal relationship between the defect and the damage. A product is defective if it fails to provide the safety which a person is entitled to expect, taking all circumstances into account, including its presentation, the use to which it could reasonably be expected to be put and the time when it was put into circulation.

A product is not considered defective for the sole reason that a better product is subsequently put into circulation. It is a defense under section 6(a) that the producer did not put the product into circulation. It is a defense under section 6(b) that, having regard to the circumstances, the defect probably did not exist when the producer put the product into circulation or came into being afterwards.

It is a defense under section 6(d) that the defect is due to compliance by the product with a requirement imposed by or under an enactment or a requirement of the law of the European Communities. It is a defense under section 6(e) that the state of scientific and technical knowledge when the producer put the product into circulation was not such as to enable the existence of the defect to be discovered.

It is a defense under section 6(f) for the manufacturer of a component or the producer of a raw material that the defect is attributable entirely to the design of the product it was fitted in or to the instructions of that product's manufacturer.

Damage means death or personal injury, or loss of, damage to or destruction of an item of property other than the defective product itself that is of a type ordinarily intended for private use or consumption and was used by the injured person mainly for private use or consumption. Where damages for loss of or damage to property would not exceed £350, none are awarded, and where they exceed that amount only the excess is awarded.

An action for damages must be brought within three years of the later of the date the cause of action accrued and the date the plaintiff became aware, or should reasonably have become aware, of the damage, the defect and the identity of the producer. The right of action is extinguished ten years after the producer put the actual product that caused the damage into circulation, unless the injured person has instituted proceedings against the producer in the meantime.

Where two or more persons are liable for the same damage, they are liable jointly and severally as concurrent wrongdoers. The producer's liability is not reduced when damage is caused both by a defect in a product and by the act or omission of a third party. Where damage is caused partly by a defect and partly by the fault of the injured person, the contributory negligence provisions of the Civil Liability Act 1961 apply as if the defect were due to the fault of every person liable for it.

The producer's liability to an injured person cannot be limited or excluded by any term of contract, by any notice or by any other provision. The Act does not affect any rights an injured person may have under any enactment or under any rule of law. The Act does not apply to a product put into circulation within the territory of any Member State before its commencement. The Act came into operation on December 16, 1991.

The Rules apply to television broadcasters under the jurisdiction of the State, and give effect to Article 7 of the Audiovisual Media Services Directive for them.

Rule 12 sets, for each named television service, the percentage of its output that must carry subtitling, Irish Sign Language and audio description in each of 2025, 2026 and 2027; RTÉ 1, for example, must subtitle 96% of its output in every one of those years, and RTÉ 1 and 2 must carry Irish Sign Language on 6% of output in 2025, 8% in 2026 and 10% in 2027.

Rule 13 requires every broadcaster to meet the quality standards in Appendix 2 so far as practicable, to make emergency information accessible to persons with disabilities, to list and promote its access services, to consult access users at least once a year, to agree an annual accessibility action plan with the Commission and publish it on its website in an accessible format, to report annually, and to nominate an Access Liaison Officer.

A failure to comply with the Rules is a contravention for the purposes of Part 8B of the Broadcasting Act 2009. Section 46O(11) of the Broadcasting Act 2009 makes a failure to comply with a media service rule a contravention for the purposes of Part 8B, under which Coimisiún na Meán may impose an administrative financial sanction. A decision that a contravention has been committed, or to impose a sanction, does not take effect unless a court confirms it.

Regulation 3(2) applies the Regulations to services provided to consumers on or after 28 June 2025: electronic communications services other than machine-to-machine transmission services, services providing access to audiovisual media services, specified elements of air, bus, rail and waterborne passenger transport services (websites, mobile applications, electronic tickets and ticketing services, transport service information and interactive self-service terminals), the interactive self-service terminals of urban, suburban and regional transport services, consumer banking services, e-books and dedicated software, and e-commerce services.

Regulations 5(3) and 14 give effect to Articles 4(3) and 13 of Directive (EU) 2019/882, under which service providers shall ensure that they design and provide services in accordance with the accessibility requirements of the Directive, and Regulation 5(4) gives effect to Article 4(5), which exempts microenterprises providing services from the service requirements and any obligations relating to compliance with them.

A service provider is any natural or legal person who provides a service on the Union market or makes offers to provide such a service to consumers in the Union, and a publisher or other economic operator involved in the distribution of e-books and dedicated software is considered a service provider in relation to them.

E-commerce services are services provided at a distance, through websites and mobile device-based services by electronic means and at the individual request of a consumer with a view to concluding a consumer contract. Consumer banking services are credit agreements, specified investment services, payment services, services linked to the payment account and electronic money provided to consumers.

Regulation 5(1) allows an economic operator to provide a service only if it complies with the accessibility requirements the Regulations specify for it, subject to Regulation 15. Services must meet Part 4 of Schedule 1 and, other than urban, suburban and regional transport services, Part 3 of Schedule 1.

Part 3 of Schedule 1 requires websites, including the related online applications, and mobile device-based services, including mobile applications, to be accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust.

Part 4 of Schedule 1 requires e-commerce services to provide information on the accessibility of the products and services being sold when the responsible economic operator provides it, and to make identification, security and payment functionality, identification methods, electronic signatures and payment services perceivable, operable, understandable and robust.

Part 4 of Schedule 1 requires consumer banking services to provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and to keep information understandable without exceeding level B2 of the Council of Europe's Common European Framework of Reference for Languages. Regulation 5(4) disapplies the service requirements of Regulation 5(3) and Regulation 14 to a service provided by a microenterprise.

Regulation 14(1) requires a service provider to ensure that a service it provides is designed and provided in accordance with the applicable accessibility requirements. Before providing a service, a service provider must prepare the information Schedule 3 sets out on how the service meets the applicable accessibility requirements, make it available to the public in writing and in oral format, and keep it for as long as the service is in operation.

Regulation 3(4) takes out of the Regulations pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services if essential information is provided in an accessible digital manner for maps intended for navigational use, third-party content that is neither funded, developed by nor under the control of the economic operator, and archive content that is not updated or edited on or after 28 June 2025.

Regulation 6(1) deems a service that complies with the accessible-information requirements of an instrument listed in Regulation 6(3) to comply with the corresponding requirements of the Regulations.

Where the Regulations provide for a requirement additional to those of an instrument listed in Regulation 6(3), the additional requirement applies in full; the instruments listed are the European passenger rights Regulations (EC) No 261/2004 and No 1107/2006 and (EU) 2021/782, No 1177/2010 and No 181/2011, and the European Communities (Interoperability of the Rail System) Regulations 2011.

Services in conformity with harmonised standards whose references have been published in the Official Journal of the European Union are presumed to be in conformity with the applicable accessibility requirements in so far as those standards cover them. Services in conformity with technical specifications are presumed to conform in the same way, in so far as those specifications cover the requirements.

Where the requirements of Parts 1 to 6 of Schedule 1 do not address a function of a service, Part 7 of Schedule 1 requires it to be made accessible by complying with functional performance criteria, among them providing at least one mode of operation that does not require vision.

Regulation 38 lets a service provider keep providing its services using products which were lawfully used by it to provide similar services before 28 June 2030, lets service contracts agreed before 28 June 2025 continue without alteration until they expire but no longer than 5 years from that date, and lets self-service terminals lawfully used before 28 June 2025 stay in use until the end of their economically useful life, but no longer than 20 years after their entry into use.

Regulation 3(6) limits the transport service information element of Regulation 3(2)(c)(iv), so far as it concerns information screens, to interactive screens located within the territory of the Union. Regulation 3(5) provides that the Regulations are without prejudice to the Marrakesh Treaty Regulations 2018 and to Regulation (EU) 2017/1563. Regulation 5(6) requires the market surveillance authority to provide guidelines and tools to microenterprises.

A person who fails to comply with Regulation 5(1) or Regulation 24(3) commits an offence, punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000.

Regulation 5(1) allows an economic operator to place a product on the market only if it complies with the accessibility requirements the Regulations specify for it, subject to Regulation 15. Regulation 8 gives effect to Article 7 of Directive (EU) 2019/882, under which manufacturers placing their products on the market shall ensure that the products have been designed and manufactured in accordance with the applicable accessibility requirements of the Directive.

Products must meet Part 1 of Schedule 1 and, unless they are self-service terminals, Part 2 of Schedule 1.

Regulation 3(1) applies the Regulations to products placed on the market on or after 28 June 2025: consumer general purpose computer hardware systems and their operating systems, payment terminals, automated teller machines, ticketing machines, check-in machines, interactive self-service terminals providing information, consumer terminal equipment with interactive computing capability used for electronic communications services or for accessing audiovisual media services, and e-readers.

Interactive self-service terminals providing information are covered unless they are installed as integrated parts of vehicles, aircrafts, ships or rolling stock. Regulation 8(1) requires a manufacturer to ensure that a product it places on the market has been designed and manufactured in accordance with the applicable accessibility requirements.

Before placing a product on the market, a manufacturer must draw up the technical documentation, carry out the conformity assessment procedure in Schedule 2, draw up an EU declaration of conformity and affix the CE marking. The conformity assessment procedure in Schedule 2 is internal production control, by which the manufacturer ensures and declares on its sole responsibility that the product satisfies the requirements of the Regulations.

A manufacturer must keep the technical documentation and the EU declaration of conformity for 5 years after the product has been placed on the market. A manufacturer that considers or has reason to believe that a product is not in conformity must immediately take the corrective measures needed or, if appropriate, withdraw the product, and must inform the competent national authorities and keep a register of non-complying products and related complaints.

A mandate appointing an authorised representative cannot include the duties in Regulation 8(1) and (2)(a). An authorised representative performs only the tasks specified in the mandate it receives from the manufacturer.

Regulation 9(4) requires the mandate to permit the authorised representative to keep the EU declaration of conformity and technical documentation at the disposal of the market surveillance authority for 5 years, to provide information on a reasoned request and to cooperate on action to eliminate non-compliance.

Regulation 17(1) requires the EU declaration of conformity to state that fulfilment of the applicable accessibility requirements has been demonstrated, to have the model structure in Schedule 5, to be continuously updated and, when the product is placed or made available on the market in the State, to be translated into both the Irish and English languages or the English language only.

Regulation 17(6) provides that the requirements on technical documentation do not operate to impose an undue burden on a microenterprise or on small and medium-sized enterprises. Products in conformity with harmonised standards whose references have been published in the Official Journal of the European Union are presumed to be in conformity with the applicable accessibility requirements in so far as those standards cover them.

Products in conformity with technical specifications are presumed to conform in the same way, in so far as those specifications cover the requirements.

A person who fails to comply with Regulation 5(1), Regulation 17 or paragraphs (1) to (4) of Regulation 19, or who affixes a CE marking that does not conform to the Regulations, commits an offence, punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000.

Regulation 11(1) requires a distributor to act with due care in relation to the requirements of the Regulations when making a product available on the market. Regulation 11 gives effect to Article 10 of Directive (EU) 2019/882, under which distributors making a product available on the market shall act with due care in relation to the requirements of the Directive.

Before making a product available, a distributor must verify that it bears the CE marking, is accompanied by the documents Regulation 8 specifies and by instructions and safety information in a language easily understood by consumers and other end-users, and that the manufacturer and the importer have complied with the requirements specified in Regulations 8(2)(d) and (e) and 10(2)(f).

A distributor that considers or has reason to believe that a product is not in conformity must not make it available until it has been brought into conformity, and must inform the manufacturer or the importer and the market surveillance authority.

A distributor that has made a product available and considers or has reason to believe that it is not in conformity must take the corrective measures needed or, if appropriate, withdraw it, and must immediately inform the competent national authorities of the Member States where it made the product available.

Regulation 12 treats an importer or distributor as a manufacturer, subject to the manufacturer's duties under Regulation 8, where it places a product on the market under its own name or trade mark or modifies a product already placed on the market in such a way that compliance may be affected.

A person who fails to comply with Regulation 21(2), the duty to cooperate fully with the market surveillance authority in an evaluation, commits an offence, punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000.

Regulation 10(1) requires an importer to place on the market only products that comply with the applicable accessibility requirements. Regulation 10 gives effect to Article 9 of Directive (EU) 2019/882, under which importers shall place only compliant products on the market.

Before placing a product on the market, an importer must ensure that the manufacturer has drawn up the technical documentation and carried out the conformity assessment procedure, that the product bears the CE marking and is accompanied by the documents Regulation 8 requires, and that the importer's name, trade name or trade mark and address are indicated on it.

An importer that considers or has reason to believe that a product is not in conformity must not place it on the market until it has been brought into conformity, and must inform the manufacturer and the market surveillance authority. An importer must keep a copy of the EU declaration of conformity at the disposal of the market surveillance authority for 5 years after the product has been placed on the market.

Regulation 12 treats an importer or distributor as a manufacturer, subject to the manufacturer's duties under Regulation 8, where it places a product on the market under its own name or trade mark or modifies a product already placed on the market in such a way that compliance may be affected.

A person who fails to comply with Regulation 5(1) or Regulation 21(2) commits an offence, punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000.

Regulation 4(3) makes each compliance authority responsible for checking compliance of the service for which it is the compliance authority. These provisions give effect to Articles 19 to 23, 29 and 30 of Directive (EU) 2019/882, which require adequate and effective means to ensure compliance, including provisions whereby a consumer may take action before the courts, and penalties that are effective, proportionate and dissuasive.

Regulation 4(4) requires the National Disability Authority to advise a relevant authority on matters related to the accessibility requirements. Where the market surveillance authority has sufficient reason to believe that a product does not comply, it evaluates the product and, if it finds non-compliance, directs the economic operator to take all appropriate corrective action within the period it specifies.

If the economic operator fails to take adequate corrective action within that period, the authority directs it to withdraw the product from the market. If adequate corrective action is still not taken, the authority takes provisional measures to prohibit or restrict the product being made available on the market in the State, or to withdraw it from that market.

Where the CE marking is missing or wrongly affixed, the EU declaration of conformity is missing or incorrect, the technical documentation is unavailable or incomplete, or the identification particulars are absent, false or incomplete, the authority directs the economic operator to end the non-compliance and may then restrict or prohibit the product being made available in the State or withdraw it.

Where a relevant compliance authority finds that a service does not comply, it directs the economic operator to take all appropriate corrective action to bring the service into compliance within the period it specifies. Before giving a direction, a relevant authority must give the economic operator notice of the proposal and allow it 14 days from receipt to make written representations.

An economic operator to which a direction has been given must comply within the period specified and notify the authority in writing no later than 7 days after that period ends. An economic operator that is the subject of a direction or measure may appeal to the District Court by written notice lodged not later than 14 days from the date the direction was given or the notice of the measure was served.

An appeal does not suspend the direction or measure, but the District Court may suspend it on application until the appeal is determined or withdrawn. The measures that may be appealed are the provisional measures under Regulation 21(7) and the measures under Regulations 21(12), 22(1)(a) and 23(3). A relevant authority may apply to the Circuit Court for an order directing compliance where an economic operator has not complied with a direction.

A consumer who believes that an economic operator has failed or is failing to comply with a requirement of the Regulations may apply to the Circuit Court for an order directing compliance. On a consumer's application the court may declare that the economic operator has failed to comply, require compliance in the manner and within the period it specifies, and impose other conditions.

A public body or private association, organisation or other legal entity with a legitimate interest in ensuring that the Regulations are complied with may, with the consumer's approval, engage on behalf of or in support of a consumer who makes such an application. A relevant authority may appoint persons to be authorised officers for the purposes of ensuring compliance with the Regulations.

An authorised officer may, where necessary and justified, enter any premises or place where there are reasonable grounds to believe that an activity relating to the manufacture, import or distribution of a product, or the provision of a service, to which the Regulations apply is or has been carried on or that records of it are kept, and search and inspect the premises or place and any products, records or services found there.

An authorised officer needs the occupier's consent or a District Court warrant to enter a private dwelling.

Regulation 32 makes it an offence to fail to comply with Regulation 5(1), paragraph (4) or (9) of Regulation 15, Regulation 17, Regulation 21(2) or Regulation 24(3), to fail to comply with paragraphs (1) to (4) of Regulation 19 or affix a non-conforming CE marking, to fail to comply with a direction within the period specified, and to fail without reasonable excuse to comply with an order under Regulation 29 or 30.

Regulation 31(13) provides that a person shall not obstruct or interfere with an authorised officer, without reasonable excuse fail to comply with a request from an authorised officer, or make a statement to the officer which the person knows is false or misleading.

It is an offence to contravene a requirement of Regulation 31(13), and an offence to furnish information to a relevant authority, in purported compliance with a requirement under the Regulations, that the person knows or ought reasonably to know is false or misleading in a material respect.

An offence under the Regulations is punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000. In imposing a penalty the court must have regard to the seriousness of the failure, the number of units of products or services to which it related and the number of persons affected.

A director, manager, secretary or other officer of a body corporate commits the offence as well as the body where it was committed with that person's consent, connivance or approval or is attributable to that person's wilful neglect. It is a defence for the person charged to prove that the person exercised due diligence and took all reasonable precautions to avoid the commission of the offence.

Summary proceedings may be brought by the Competition and Consumer Protection Commission, the Commission for Communications Regulation, the Central Bank of Ireland, the National Transport Authority, the Irish Aviation Authority or Coimisiún na Meán, each for the functions it exercises under the Regulations.

Regulations 29, 30 and 32 do not apply to procurement procedures subject to the European Union (Award of Public Authority Contracts) Regulations 2016 or the European Union (Award of Contracts by Utility Undertakings) Regulations 2016. Regulation 41 includes among the functions of a relevant authority the consideration of complaints that a product, service or economic operator has not complied with the Regulations.

A complaint about a product is considered by the market surveillance authority, and a complaint about a service by the relevant compliance authority.

Regulation 15(1) applies the accessibility requirements only to the extent that compliance does not require a significant change that results in the fundamental alteration of the basic nature of the product or service, or result in a disproportionate burden on the economic operator.

Regulation 15 gives effect to Article 14 of Directive (EU) 2019/882, under which the accessibility requirements apply only to the extent that compliance does not require a fundamental alteration or impose a disproportionate burden. An economic operator may rely on Regulation 15(1) only where it has carried out an assessment whose result is that compliance would introduce a fundamental alteration of the basic nature of the product or service or impose a disproportionate burden.

The assessment of disproportionate burden must be based on the criteria in Schedule 4. Schedule 4 sets as one criterion the ratio of the net costs of compliance with accessibility requirements to the overall costs of manufacturing, distributing or importing the product or providing the service. Schedule 4 sets as another criterion the ratio of the net costs of compliance with accessibility requirements to the net turnover of the economic operator.

An economic operator that relies on Regulation 15(1) must document the assessment, keep a written record of its relevant results for 5 years after the product was last made available or the service last provided, and give a copy to the market surveillance authority for a product or the relevant compliance authority for a service on request. Regulation 15(5) disapplies the documentation duty in Regulation 15(4) to a microenterprise that deals with products.

A service provider that relies on the disproportionate-burden limit must renew the assessment for each category or type of service when the service offered is altered or the relevant compliance authority asks, and in any event at least every 5 years. An economic operator that receives funding, public or private, from sources other than its own resources for the purpose of improving accessibility cannot rely on the disproportionate-burden limit.

An economic operator that places a product on the market or provides a service in the State and relies on Regulation 15(1) must inform the market surveillance authority or the relevant compliance authority, and Regulation 15(10) disapplies that duty to microenterprises.

Regulation 20(2) requires the market surveillance authority, where an economic operator has relied on Regulation 15, to check that the assessment was conducted, review it and its results, including the correct use of the Schedule 4 criteria, and check compliance with the applicable accessibility requirements. Regulation 24(2) imposes the same checks on the relevant compliance authority for a service.

A person who fails to comply with paragraph (4) or (9) of Regulation 15 commits an offence, punishable on summary conviction by a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment by a fine of up to EUR 60,000 or imprisonment for up to 18 months or both. A class A fine is a fine not exceeding EUR 5,000.

Regulation 93(6)(a) requires a provider of number-based interpersonal communications services that let end-users call a number to ensure that end-users with disabilities can enjoy access to emergency services through emergency communications equivalent to that enjoyed by other end-users, in accordance with any requirement of law for accessibility for products or services.

Regulation 87(4) requires the information a provider of publicly available electronic communications services gives a consumer before the consumer is bound by a contract to be provided, on request, in an accessible format for end-users with disabilities, subject to any requirement of law for accessibility for products or services. The Commission for Communications Regulation may specify requirements to ensure that providers comply with that duty.

Regulation 88(1) requires providers of internet access services or publicly available interpersonal communications services that make the provision of those services subject to terms and conditions to publish the information in Schedule 8 that is pertinent to them in a clear, comprehensive, machine-readable manner and in an accessible format for end-users with disabilities, subject to any requirement of law for accessibility for products or services.

Schedule 8 includes details of products and services specifically designed for end-users with disabilities.

Regulation 94(1) requires the Commission for Communications Regulation to specify requirements for providers of publicly available electronic communications services so that end-users with disabilities have access to the service, including the related contractual information, equivalent to that enjoyed by the majority of end-users, and benefit from the choice of undertakings and services available to the majority of end-users.

Requirements the Commission specified under Regulation 17 of the universal service regulations and in force when Regulation 94 commenced are deemed to be requirements under Regulation 94. A provider that fails to comply with Regulation 93 commits an offence and is liable on summary conviction to a class A fine, and it is a defence for the provider charged to show that it took all reasonable steps and exercised due diligence to avoid committing the offence.

A provider that fails to provide the contract information in accordance with Regulation 87 or to comply with a requirement imposed under Regulation 87(5), or fails to publish the information required under Regulation 88(1), also commits an offence liable on summary conviction to a class A fine, with the same due-diligence defence. A class A fine is a fine not exceeding EUR 5,000.

The Rules apply to media service providers providing audiovisual on-demand media services under the jurisdiction of the State, and give effect to Article 7 of the Audiovisual Media Services Directive for them. Rule 16.1 requires each provider to take proportionate measures to make its programmes continuously and progressively more accessible to persons with disabilities through subtitling, captioning, sign language and audio description.

Rules 16.2 and 16.3 require an accessibility action plan agreed with the Commission, the first within six months of publication and annually after that. Rule 16.8 requires emergency information to be accessible to persons with disabilities. A failure to comply with the Rules is a contravention for the purposes of Part 8B of the Broadcasting Act 2009.

Section 46O(11) of the Broadcasting Act 2009 makes a failure to comply with a media service rule a contravention for the purposes of Part 8B. A decision that a contravention has been committed, or to impose a sanction, does not take effect unless a court confirms it.

Section 5(1) provides that a person shall not discriminate in disposing of goods to the public generally or a section of the public or in providing a service, whether the disposal or provision is for consideration or otherwise.

The Act defines a service as a service or facility of any nature which is available to the public generally or a section of the public, and the definition includes facilities for banking, insurance, grants, loans, credit or financing, entertainment, recreation or refreshment, cultural activities, and transport or travel.

Section 4(1) provides that discrimination includes a refusal or failure by the provider of a service to do all that is reasonable to accommodate the needs of a person with a disability by providing special treatment or facilities, if without them it would be impossible or unduly difficult for the person to avail of the service.

Under section 4(2), a refusal or failure to provide the special treatment or facilities is not deemed reasonable unless providing them would give rise to a cost, other than a nominal cost, to the provider of the service.

A person who claims that prohibited conduct has been directed against them may seek redress by referring the case to the Director of the Workplace Relations Commission, who may order compensation of up to the maximum the District Court could award in civil cases in contract, or an order that a specified person take a specified course of action (sections 21(1) and 27).

Regulation 67(4) requires that, for procurement intended for use by natural persons, whether the general public or staff of the contracting entity, the technical specifications be drawn up, except in duly justified cases, so as to take into account accessibility criteria for persons with disabilities or design for all users. Regulation 67(5) requires the technical specifications to be defined by reference to any mandatory accessibility requirements that a legal act of the European Union adopts.

Regulation 25(1) of the European Union (Accessibility Requirements of Products and Services) Regulations 2023 makes the accessibility requirements in Schedule 1 to those Regulations mandatory accessibility requirements for the purposes of Regulation 67(5).

Regulation 42(4) requires that, for procurement intended for use by natural persons, whether the general public or staff of the contracting authority, the technical specifications be drawn up, except in duly justified cases, so as to take into account accessibility criteria for persons with disabilities or design for all users.

Regulation 42(5) requires the technical specifications to be defined by reference to any mandatory accessibility requirements that a legal act of the European Union adopts. Regulation 25(1) of the European Union (Accessibility Requirements of Products and Services) Regulations 2023 makes the accessibility requirements in Schedule 1 to those Regulations mandatory accessibility requirements for the purposes of Regulation 42(5).

Requires designated video sharing platforms that allow pornography or gratuitous violence to implement effective age assurance so children are not normally able to access that content. The designated services include Facebook, Instagram, YouTube, TikTok, X, LinkedIn, Pinterest, Tumblr and Udemy. Coimisiún na Meán has stated that self declaration alone does not satisfy the requirement, though it has not mandated one specific verification method.

General child safety provisions under Part A of the Code took effect on 19 November 2024, and the Part B age assurance obligations became binding on 21 July 2025.

Sets 16 as Ireland's digital age of consent under Article 8 of the General Data Protection Regulation (GDPR), the minimum age at which a child can consent to the processing of personal data in the context of an information society service offered directly to the child, including registering for a social media account. For children under 16, consent must be given or authorised by a parent or guardian. This is a data protection consent rule rather than a mandated identity verification requirement.

Established Coimisiún na Meán (the Media Commission). Dissolved the Broadcasting Authority of Ireland and transferred its functions to Coimisiún na Meán. Gave the Commission power to make online safety codes to be applied to designated online services, to protect users from harmful online content. Requires the Commission to designate the video sharing platform services whose provider is under the jurisdiction of the State. A provider's failure to comply with an online safety code that applies to its service is a contravention.

Regulation 13 applies the reproduction and making-available rights in sections 37, 39 and 40 of the Copyright and Related Rights Act 2000 to publishers of press publications established in the State for the online use of their press publications by information society service providers. The right does not reach private or non-commercial use of a press publication by an individual user, acts of hyperlinking, or the use of individual words or very short extracts of a press publication.

It lasts two years, running from 1 January of the year following the year the press publication was published. Regulation 13(6) provides that paragraph (5), the two-year term, shall not apply to a press publication first published before 6 June 2019. Article 15(4) of Directive (EU) 2019/790, which the Regulation gives effect to, states that carve-out differently: it provides that paragraph 1, the right itself, does not apply to press publications first published before 6 June 2019.

Authors of works incorporated in a press publication are entitled to an appropriate share of the revenues the publisher receives for the publication's online use. A dispute under the Regulation may be submitted to a mediator under the Mediation Act 2017 without prejudice to judicial remedies.