Kay Murphy, founder of AI advisory practice Kamu, cuts through the confusion about what the EU AI Act actually asks of an Irish SME, and what to do about it.
If you half-follow the technology news, you may have picked up two things about the EU AI Act this summer: that a major deadline landed on the 2nd of August, and that the rules have been delayed. Confusingly for some, both are true, and this has resulted in many business owners giving up trying to follow it.
So let me try to untangle it, because the practical picture for a small or medium Irish business is far more manageable than the headlines suggest. Some of the Act already applies to you.
“For most Irish SMEs, the AI Act asks for awareness, honesty and a bit of housekeeping rather than deep technical work or an army of consultants”
One new piece arrived this month which is why you will have so much recent coverage over the past week or so. But the heaviest part has recently been pushed out to the end of 2027. Knowing what is happening when will help businesses see what will apply to them, and when.
First, the shape of the thing
The AI Act is the EU’s rulebook for artificial intelligence. It came into force in August 2024 and applies in phases over several years. The important design feature for a smaller business: it is risk-based. AI uses are sorted into four tiers, from a short list of banned practices at the top, through high-risk uses like CV screening and credit scoring, down to a transparency tier for things like chatbots, and finally a minimal-risk tier at the bottom.
The reassuring message for SME business owners is that most AI systems, and most everyday business use of AI, sit in that bottom tier and carry no new obligations under the Act at all.
Using an AI assistant to draft emails, summarise documents or analyse your sales data doesn’t put you in the regulator’s sights. The Act was written to target specific risks and not to start regulating every single spreadsheet with a smart feature.
What already applies to you
There are already two things that are live as of February 2025:
The first is the list of prohibited practices: social scoring, exploiting vulnerable groups, scraping facial images at scale, and similar. For the overwhelming majority of Irish SMEs these are things you were never going to do anyway, so I wouldn’t lose sleep over them.
The second is the sleeper obligation: AI literacy. The Act requires that businesses using AI ensure their staff have a sufficient level of AI literacy for how they’re using it. Read that again, because it applies now, and it applies to deployers as well as developers… which is to say, if your team uses AI tools at work, this means you. It doesn’t mean that everyone in your team requires a diploma: it asks that people understand what the tools can do, where they go wrong, and how to use them appropriately in your context. A few hours of structured training covers a great deal of it, and there are many free and low-cost options, including the ‘Introduction to AI’ course from CeADAR (https://ceadar.ie/), Ireland’s centre for applied AI.
What arrived on 2 August 2026
This month, the transparency rules took effect. In plain terms: if you use a chatbot to deal with customers, it has to be clear they’re talking to a machine. If you publish AI-generated content in certain contexts, particularly anything that could mislead, like realistic synthetic images or deepfakes, it needs to be identifiable as AI-generated. Essentially it means showing honesty about when AI is in the room. For most SMEs this is a labelling and disclosure exercise, but it does need doing if you have a customer-facing bot or publish AI-generated material.
What got delayed, and why that’s a trap
The heavyweight part of the Act covers high-risk uses: AI used in recruitment and CV screening, credit scoring, education, essential services and similar areas with real consequences for people’s lives. Those obligations were initially meant to apply from the 2nd of August just gone. However, in June, the EU formally adopted a package called the Digital Omnibus which pushed that deadline out: standalone high-risk systems now have until December 2027, and AI embedded in regulated products until August 2028.
The trap that a business owner could fall into is hearing the word ‘delayed’ and filing the whole Act under ‘ignore for now.’ This recent delay applies only to the high-risk tier: the literacy obligation, the prohibitions and the new transparency rules are already live. And if your business does use AI in hiring, lending or similar decisions, or you’re building a product that does, I’d recommend treating the extra time as a gift rather than a reprieve: the homework on risk management, documentation and human oversight is substantial, and December 2027 will arrive faster than it appears.
Who is in charge, and what it costs to get wrong
Ireland has opted for a distributed model: existing regulators, including the Data Protection Commission and the Central Bank, supervise the Act in their own sectors, with a new AI Office of Ireland acting as central coordinator and single point of contact. The maximum penalties are serious, running up to €35 million or 7% of worldwide turnover for the gravest breaches, though there’s a provision worth knowing for SMEs: the applicable cap is the lower of the two amounts rather than the higher. The design intent is proportionate enforcement rather than making examples of small firms, and my honest read is that a business making a reasonable, documented effort has little to fear.
Five things to do this month
- Map every AI tool: Make a list of every AI tool your business actually uses, including any unofficial ones your team has adopted. You cannot assess what you haven’t mapped, and the list is typically longer than the owner expects.
- Run the free checker: Run your uses through the EU’s free Compliance Checker on the AI Act Service Desk. It’s an interactive tool that tells you which obligations, if any, apply to you. Twenty minutes, and for many SMEs the answer will be genuinely calming. Save this link and continue to check as you adopt new tools.
- Sort AI literacy: Book structured training for anyone using AI in their role, keep a record that you did it, and refresh it as the tools change.
- Check your disclosures: If you have a customer-facing chatbot or publish AI-generated content, check your disclosures now, because this is the piece that became live this month.
- Start high-risk prep now: If anything in your business touches hiring, credit, or other consequential decisions about people, start the high-risk preparation this year rather than delaying it to 2027.
My overall read: for most Irish SMEs, the AI Act asks for awareness, honesty and a bit of housekeeping rather than deep technical work or an army of consultants. And for the businesses that do the simple things now, not only will they be robustly compliant, but they will also know how AI is being used inside their own company, which is knowledge that will pay for itself regardless of what any regulator ever asks.
👉 No tech background needed to bring your business into the AI age! Secure your scholarship to complete the certification at no cost. Apply now and get started!
-
Bank of Ireland is welcoming new customers every day – funding investments, working capital and expansions across multiple sectors. To learn more, click here
-
For support in challenging times, click here
-
Listen to the ThinkBusiness Podcast for business insights and inspiration. All episodes are here. You can also listen to the Podcast on:
-
Spotify
-
SoundCloud
-
Apple
