The EU AI Act for small Irish and UK businesses: what actually applies to you
Sources re-checked 26 September 2026. What follows is general information, not legal advice.
A small Irish or UK business asking about the EU AI Act usually asks three questions. Does it apply to me? What goes on my website? What happens if I do nothing? The pages below answer those, then cover the rest: who is a provider and who is a deployer, which duties began on 2 August 2026, how to word a disclosure that would stand up, what to keep in your records, and what a business of one or two people can ignore. Each legal statement and date below carries a primary source and the date it was checked.
What the Act is, and what it leaves out
Regulation (EU) 2024/1689 is the AI Act. It was published in the Official Journal on 12 July 2024, entered into force on 1 August 2024, and applies from 2 August 2026, apart from the earlier and later dates listed in Article 113. The text this guide quotes is the one on Regulation (EU) 2024/1689 on EUR-Lex.
It is a product-safety law, not a ban on the technology. The Commission describes it as "the first-ever comprehensive legal framework on AI worldwide" and splits systems into four risk levels: unacceptable risk, which is banned; high risk; limited risk, which carries transparency duties; and minimal risk, which carries no new duties. That language is on the Commission's European Commission AI Act page (checked 26 September 2026).
Most coverage concerns banned practices a normal trading business never touches, or high-risk systems that are largely a regulated-sector matter. The transparency layer is what reaches an ordinary small business. The exclusions carry the same weight, because that is where bad advice starts.
Personal, non-professional use is outside it
Article 3(4) has a deployer using an AI system "under its authority except where the AI system is used in the course of a personal non-professional activity". A chatbot used to draft a birthday speech is not regulated. The same chatbot answering customers is.
Military, defence and national security use are outside it
Article 2(3) states that the Regulation "does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes".
No change to Great Britain duties on its own
UK owners misread this both ways. There is no UK AI Act, and the House of Commons Library briefing AI regulation in the UK states that "the UK does not have any AI-specific regulation or legislation covering AI as a technology". A Leeds shop selling only to Leeds customers is not caught.
The Act still reaches across borders. Article 2(1)(c) covers providers and deployers outside the Union "where the output produced by the AI system is used in the Union". A UK widget answering a Dublin customer produces output used in the Union, and the transparency duties follow it.
Registration is not required for most businesses
Article 49 makes the provider of an Annex III high-risk system register itself and the system, and makes public authority deployers register their use. A two-person web shop is neither.
What was checked, and how far this guide reaches
The articles read were the operative ones in the Official Journal text on EUR-Lex: Articles 2, 3, 4, 49, 50, 62, 63, 99 and 113. On the Commission site: the AI Act policy page, the pages on the Article 50 transparency guidelines and the Code of Practice on Transparency of AI-generated Content, and the news item on the AI Omnibus entering into force. For Ireland, the Regulation of Artificial Intelligence Act 2026 in enacted form. For the UK, the House of Commons Library briefing; for data protection, the Data Protection Commission's AI guidance and the EDPB's Opinion 28/2024.
Dates. Checking happened on 25 and 26 September 2026. Each source at the end lists its own publication date next to the date it was checked.
Limits. No specific system was assessed here, and none of it replaces a solicitor reading your terms of business. The Commission's Article 50 guidelines were not read paragraph by paragraph, since they are interpretive and not binding. The Act is still being amended, Ireland's secondary legislation is incomplete, and where a widely repeated claim could not be confirmed in a primary source the guide says so instead of repeating it.
The four roles: provider, deployer, importer, distributor
Four roles decide almost everything else in the Act.
Provider
The definition in Article 3(3) reads: "'provider' means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge".
"Under its own name or trademark" is the phrase that catches small businesses. Take an off-the-shelf model, wrap it in your own interface, put your brand on it and show it to customers, and you can be a provider even though you trained nothing. White-labelling is how many small Irish and UK businesses take on heavier duties by accident.
Deployer
The text of Article 3(4): "'deployer' means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". Most small businesses sit here. The status is light: a handful of duties, mostly transparency, and no conformity assessment, technical documentation or CE marking.
Importer and distributor
Article 3(6) provides: "'importer' means a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country". Resell a US-built AI product under the US vendor's brand into Ireland and you are an importer. Buy a subscription and use it yourself and you are not.
Article 3(7) says: "'distributor' means a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market". A reseller with a catalogue of AI tools is a distributor. A business that uses one of those tools is not.
Article 3(8) defines "operator" as "a provider, product manufacturer, deployer, authorised representative, importer or distributor". The penalties article means every one of them when it uses the word operator, which is why the same fine tiers reach a one-person business as reach a large vendor.
A simple test. Did you build or brand the AI capability? Provider. Do you only use it, under a supplier's name? Deployer. Do you buy abroad and resell here under the foreign brand? Importer. Do you list it for others? Distributor.
Which duties already apply and which dates matter
Dates are the worst-reported part of the AI Act. Article 113 provides that the Regulation "shall apply from 2 August 2026", with three exceptions: Chapters I and II apply from 2 February 2025; Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Article 6(1) applies from 2 August 2027.
The Commission's implementation timeline on the AI Act Service Desk states that it "takes into account the AI Act amendments introduced by Digital Omnibus on AI". Checked 26 September 2026, it lists the dates below.
- 1 August 2024. Entry into force.
- 2 February 2025. General provisions, definitions and AI literacy apply, along with the prohibitions.
- 2 August 2025. General-purpose AI rules apply and governance must be in place. Member States must name national competent authorities and pass national penalty laws.
- 2 August 2026. "The majority of rules of the AI Act come into force and enforcement starts for applicable rules." It adds that the Article 50 transparency rules begin, innovation support measures begin, and enforcement begins at national and EU level for general-purpose AI models, prohibitions, transparency rules and AI literacy.
- 2 December 2026. A new set of prohibitions, and the Article 50(2) transition. The Commission's own wording: prohibitions "for AI systems generating non-consensual sexual deepfakes and child sexual abuse material, start to apply", and the "transitional deadline for certain providers of AI systems, including GPAI systems, generating synthetic content, that were already placed on the market before 02 Aug 2026, to comply with Article 50(2)".
- 2 August 2027. Member States should have at least one AI regulatory sandbox running per country.
- 2 December 2027. Rules for high-risk AI systems listed in Annex III apply. The date moved from 2 August 2026.
- 2 August 2028. Rules for high-risk AI embedded in products covered by Annex I apply.
Two of those dates mislead. The first is 2 August 2026, which is not the day the Act starts but the day the bulk of it starts, with much having started earlier. The second is 2 December 2026, which brings one new prohibition and one transition deadline, not a second general deadline.
The Commission's news item AI Omnibus enters into force, published 27 July 2026, states that "On 27 July 2026, the AI Omnibus enters into force across the EU, bringing extended timelines to administrative simplification." It records that Annex III high-risk rules apply from 2 December 2027 and Annex I rules from 2 August 2028, and that some SME-only measures now cover small mid-cap companies. A compliance note written in 2025 saying high-risk obligations arrive on 2 August 2026 is out of date, though nothing reaching an ordinary small business moved later.
A small Irish or UK business only needs a few dates: Article 50 from 2 August 2026, Article 4 literacy since 2 February 2025, and the 2 December 2026 marking transition, but only if you sell a synthetic content generator placed on the market before 2 August 2026. The rest belongs to someone else.
What a website owner has to disclose
Article 50 speaks to two groups, providers and deployers, which is why so much online advice contradicts itself. Paragraph 1 puts a duty on providers of systems that interact directly with people. Paragraph 2 makes providers of synthetic content systems mark that content in machine-readable form. Paragraph 3 covers deployers of emotion recognition or biometric categorisation systems. Paragraph 4 covers deployers of deepfakes, and deployers who publish AI-generated text on matters of public interest. Paragraph 5 requires the information "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure".
AI chat widget
Article 50(1) requires that people "are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect". The duty sits on the provider, so your vendor's implementation carries it. Your own job is to check that the disclosure appears before the customer's first message and is not buried in a footer. A widget that opens with a greeting and no mention of AI, where a customer could reasonably think they are talking to your staff, is a problem even where the vendor's contract says compliance is theirs.
AI-generated images
Article 50(2) requires providers of systems "generating synthetic audio, image, video or text content" to ensure "that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated". That is a vendor duty, and it is why the Commission built the Code of Practice on Transparency of AI-generated Content, published 10 June 2026. The Code splits into Section 1 for providers on marking and Section 2 for deployers on labelling deepfakes and AI-generated text.
A visible duty falls on you in two cases. Where the image is a deepfake, Article 50(4) applies to you as deployer and you "shall disclose that the content has been artificially generated or manipulated". If your product photos are AI renders of items you do not hold, a label is the approach that survives a complaint.
AI-ranked search
Usually a non-event. A search that ranks your own catalogue is not, on the face of the Act, subject to an Article 50 disclosure. Article 50(1) concerns systems that interact directly with natural persons, and a box returning ranked products is a tool, not a conversation. It becomes a problem when the box generates answers instead of listing products, because that output is synthetic text. Our advice, and it is advice and not law: label it.
AI receptionist or voice assistant
A voice agent answering your phone is an AI system built to interact directly with natural persons, so Article 50(1) applies to its provider. A plainly synthetic voice has some latitude. A voice that sounds like a person and does not identify itself has none. Where callers are analysed for emotion, Article 50(3) requires you to inform the people exposed to it. Where calls are recorded and transcribed by AI, your GDPR duties for call recording sit on top. Ireland's Data Protection Commission sets out the link in its DPC guidance on AI, large language models and data protection, published 18 July 2024.
Wording the disclosure: examples to copy
Article 50 prescribes no wording. It prescribes a standard: "clear and distinguishable", delivered "at the latest at the time of the first interaction or exposure". Anything that meets those tests and tells the truth will do. Replace the brackets.
The chat widget opening line
You are chatting with an automated assistant. It answers instantly and it can be wrong. Type "human" at any time to reach a person, or email [email address].
The line names the assistant as automated and offers a route to a human in the same breath.
Full-page disclosure for an AI-heavy site
How we use AI on this site Our chat assistant is automated. It is powered by a third-party AI service and it can make mistakes. If you need a person, email [email address] and we will reply within [timeframe]. Some product images are generated or edited with AI. Where an image is AI generated, we say so on the product page. We use AI to help draft some product descriptions. A member of our team reviews and edits every description before publication, and we take responsibility for what is published. Last updated: [date]
It names who is responsible for published content and rules out the two things customers worry about most: automated decisions and pricing.
Image label for an AI-generated product visual
AI generated image. This is a digital render, not a photograph of stock we hold.
It answers the question the customer is already asking: whether the thing on screen exists.
The voice assistant opening line
You have reached [business name]. This call is handled by an automated assistant. Say "person" at any time and I will pass you to a member of the team.
It is given before any interaction, and it avoids the phrase "virtual assistant", which people do not reliably read as "AI".
Public-interest text or an AI-generated article
This article was drafted with the assistance of AI and reviewed and edited by [name or role], who is responsible for its content.
For AI-generated text, Article 50(4) lifts the disclosure duty where "the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content".
Three ways to get this wrong. Putting the disclosure in a privacy policy and nowhere else fails the Article 50(5) timing test. Using a phrase that means AI to you but not to a customer, such as "powered by our smart assistant", misses. And disclosing only after the customer has been chatting for a minute is late by the text of Article 50(5).
The chatbot transparency duty, in detail
The chatbot is where most small businesses meet the AI Act first, so Article 50(1) repays close reading. The duty is on providers and requires that AI systems "intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system". Article 50(5) sets the timing, and requires the information to "conform to the applicable accessibility requirements".
Both carve-outs are narrower than people assume. The obviousness test asks what a "reasonably well-informed, observant and circumspect" person would conclude, and a website chat widget is not obviously AI, because plenty of sites use staffed live chat with a typed greeting. The other covers systems authorised by law for criminal investigation.
The accessibility point is easy to miss. Where the chatbot is the only route to a human and a screen reader cannot use it, both the disclosure and the service fail. A phone number and an email address as alternatives cost nothing.
If you built the chatbot yourself on a third-party model and put your own name on it, Article 3(3) makes you the provider, and the Article 50(1) design duty is yours, not your supplier's.
Marking AI-generated content and the 2 December 2026 change
Article 50(2) is a provider duty. Providers of systems "generating synthetic audio, image, video or text content" must "ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated". Those technical solutions must be effective, interoperable and reliable so far as technically feasible, under the same paragraph. That weighing takes in the type of content, the cost of implementation and the generally acknowledged state of the art, with carve-outs for assistive standard editing and for uses authorised by law for criminal investigation.
Read as a website owner, the conclusion is straightforward. You cannot mark output in a machine-readable format yourself, and nobody expects you to. The marking happens inside the generating tool. Your job is to buy tools that do it and to ask vendor question three below, so that "our tool marks its output" is written down where you can find it.
The 2 December 2026 change is transitional: it is the "transitional deadline for certain providers of AI systems, including GPAI systems, generating synthetic content, that were already placed on the market before 02 Aug 2026, to comply with Article 50(2)". If you use a content tool, this changes nothing. If you sell a synthetic content generator placed on the market before 2 August 2026, this is your deadline. Also landing that day is the new Omnibus prohibition on systems generating non-consensual intimate content or child sexual abuse material.
Record keeping and logging: what to keep, and why
Record keeping under the Act is mostly aimed at providers of high-risk systems. A deployer of a low-risk system has no specific logging duty, and anyone selling a seventeen-column AI register on the claim that the regulation requires it deserves scepticism.
Three records are worth keeping anyway. First: which AI tools you use, and for what. One page listing each tool, its vendor, its use, and the staff member who owns it. Twenty minutes of work, and the document a customer, a regulator or an insurer would ask for. Second: what your vendors say about transparency and marking. File the statement that the system identifies itself as AI and that its output carries machine-readable marking. Where the contract and help centre say nothing, keep the email where you asked and the reply. Third: when a disclosure changed. If you add a chat widget, change it, or label an image, note the date.
One duty from elsewhere does bite. Where you process personal data through an AI system, GDPR accountability applies, and the DPC's guidance states that where outcomes of AI processing "might affect the rights and freedoms of data subjects" you must have "appropriate personal data governance, design, policy and decision-making controls in place in accordance with GDPR accountability requirements". Article 12 automatic logging applies only to providers of high-risk systems, which this guide assumes you are not.
Staff training and a written AI policy
Article 4 has applied since 2 February 2025 and is short. Providers and deployers "shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The standard is "best extent", not certification, and it covers the people who operate AI systems on your behalf. That includes staff who use an AI writing tool to answer customers, as well as staff who administer a system.
One article works in your favour. Article 62 requires Member States to run awareness raising and training activities on the Regulation for SMEs and to provide channels for advice. Ireland is doing this through the AI Office of Ireland, and the Commission's AI Act Service Desk is the other free route.
What belongs in a one-page AI policy
No policy is required. Keeping one is still the cheapest way to make Article 4 real, and it takes an hour.
- The AI tools approved for use, by name.
- What never goes into them: customer personal data, pricing, contracts, and anything confidential.
- Which outputs a person must check before they go out.
- Which disclosures appear on the website, and who checks they are still true.
- Who owns each AI tool, so a change of staff leaves nothing unmanaged.
- What to do when a tool gets something wrong, and who to tell.
- The review date on the policy.
Train the team on it once, note the date, and repeat annually. That is a proportionate response to Article 4 for a business of two to twenty people, and it holds up in a way that "we all know how to use ChatGPT" does not.
Procurement: questions for an AI vendor before signing
Much of the practical compliance sits upstream, with the vendor. That only works if you ask, and keep the answer.
- Does your system count as high-risk under Annex III of Regulation (EU) 2024/1689, and if so, what documentation do you give deployers?
- Where in the interface does your system tell end users they are interacting with an AI system?
- Does your system mark generated content in a machine-readable format for Article 50(2), and do you follow the Code of Practice on Transparency of AI-generated Content?
- Do you process our customers' personal data, and if so, where, for how long, and on what legal basis? Would you sign a data processing agreement?
- Can we switch off your use of our data to train models, in writing?
- If we white-label your product under our own name, do you remain the provider, or does part of that duty move to us?
- What happens to our data and our customers' data on exit, and how do we get it out?
- What is your incident process when your model produces harmful or unlawful output on our site?
- Which sub-processors do you use, and will you warn us before you change them?
- Do you hold a certification or audit report we can show to a customer or an insurer?
Question six is the important one. Rebrand a vendor's assistant as your own and you may be a provider under Article 3(3), with the vendor's compliance programme not covering you. Get that answer in writing before signing, because it decides which side of the line you stand on. Two smaller points. An AI Act claim in a sales deck is worth nothing; ask for it in the contract or an email you keep. And a vendor who says the Act does not apply because they are a US company gives an incomplete answer, since Article 2(1)(a) covers providers placing systems on the Union market "irrespective of whether those providers are established or located within the Union or in a third country".
Penalties and who enforces them in Ireland
Article 99 sets the ceilings. For the Article 5 prohibitions, Article 99(3) allows "administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". Article 99(4) covers a list of operator duties. That list explicitly includes, at point (g), "transparency obligations for providers and deployers pursuant to Article 50", at a ceiling of "EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". Article 99(5) covers supplying incorrect or misleading information to a competent authority: EUR 7 500 000 or 1 per cent of worldwide annual turnover. A broken AI disclosure sits in the middle tier, before any discount.
Two limits matter more to a small business than the headline figures. Article 99(6) states that "In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower." An SME faces the lower figure. And Article 99(1) requires penalties to be "effective, proportionate and dissuasive" and to "take into account the interests of SMEs, including start-ups, and their economic viability", with warnings and non-monetary measures expressly contemplated.
What Ireland has actually put in place
Ireland enacted its own framework on 21 July 2026. The Regulation of Artificial Intelligence Act 2026 is Act 31 of 2026, and it sets up a body called Oifig IS na hEireann, the AI Office of Ireland. The Oireachtas record shows the Bill completing Seanad stages on 15 July 2026 and being signed into law on 21 July 2026.
On fines, the Irish Act adopts the Article 99 ceilings instead of inventing lower ones. Section 105 provides that a fine for breach of the Article 5 prohibitions "shall not exceed the limits referred to in Article 99(3)", and for the Article 99(4) provisions "shall not exceed the limits referred to in that paragraph". Section 105(5) adds two cases: for a public body the cap is EUR 1,000,000, and for an undertaking within Article 99(6), meaning an SME, the fine "shall not exceed the amount referred to in that Article", which is the lower figure.
Section 122 is the provision to know. In proceedings for an offence under section 121 of that Act, "it shall be a defence for a person against whom such proceedings are brought to show that he or she made all reasonable efforts to ensure compliance". That is the legal reason this guide keeps telling you to write things down. A dated policy, a vendor email and a note of when a disclosure went live are what "all reasonable efforts" looks like.
Ireland runs a distributed model, not a single AI regulator. S.I. No. 366/2025 designates the Minister for Enterprise, Tourism and Employment as a national competent authority under Article 70(1), the Central Bank of Ireland as market surveillance authority under Article 74(6), and the Data Protection Commission as market surveillance authority under Article 74(8). The AI Office of Ireland describes itself as "the national authority responsible for coordinating the implementation of the EU AI Act". The Department said when publishing the Bill that the Bill "does not add to the obligations placed on regulated entities by the EU Regulation", so Irish law supplies enforcement machinery, not a second layer of duties.
What a one-person business can safely ignore
High-risk obligations, unless you build or supply a system in one of the Annex III areas. Those areas cover matters such as biometrics, critical infrastructure, education, employment, essential services, law enforcement and migration. Selling craft supplies online is not one of them. Annex I product rules arrive on 2 August 2028 and are also not yours.
Registration in the EU database, unless you are a provider of an Annex III high-risk system or a public authority deploying one.
Conformity assessment, CE marking and technical documentation, unless you provide a high-risk system.
The 7 per cent figure as usually quoted. Article 99(6) makes an SME face the lower of the two amounts, and Article 99(1) requires the assessment to weigh your economic viability.
Three things stay on your list. Article 4 AI literacy, in force since 2 February 2025, which costs one short policy and one training session. The Article 50(1) disclosure on any AI system that interacts with your customers. And the Article 50(4) deepfake disclosure if you publish synthetic images or video of people, places or products.
A sole trader with a brochure website, no chat widget and no AI-generated imagery stands, on 26 September 2026, in this position: the AI Act asks nothing specific of that website, and Article 4 asks you to know enough about the AI you use elsewhere to use it sensibly.
A worked example: a two-person web shop in Leitrim
The business below is invented and written to be concrete. Any resemblance to a real Leitrim company is coincidence.
Carrick Craft Supplies is a two-person online shop selling craft materials in Ireland and the UK. The site runs on a hosted platform, and four AI tools were added over the past year: a chat widget from a third-party vendor shown under the vendor's brand, an image generator for product visuals, an AI drafting tool for product descriptions, and a site search that lists products.
Their role. The chat widget carries the vendor's brand and was never rebranded, so under Article 3(3) they are not the provider. The widget is used in the course of business, so under Article 3(4) they are a deployer. Had they wrapped the same widget in their own shop branding and called it "Ask Carrick", they would have moved into provider territory and picked up the Article 50(1) design duty themselves. The procurement questions above would have told them that before they signed.
The chat widget. Article 50(1) puts the duty on the vendor, and Article 50(5) requires disclosure "at the latest at the time of the first interaction". Pointing at a privacy policy does not satisfy that. So they open their own site on a phone, start a chat, and confirm an automated-assistant line appears before they type. It did not. They sent the vendor a screenshot and added their own one-line notice in the widget welcome text. Two fixes, ten minutes.
Product images. They generate lifestyle images of finished projects. These are not deepfakes of an identifiable person, place or product, so Article 50(4) is not triggered. The generator is the provider for Article 50(2) marking, and the shop has asked in writing whether output carries machine-readable marking, keeping the reply on file. Separately, as a commercial choice and not a legal requirement, they label mood-board images as "digital render", because a customer who thinks a render is real stock is a refund waiting to happen.
Product descriptions. AI drafts them and one owner edits every one before publication. Article 50(4) applies a text disclosure duty to AI-generated text "published with the purpose of informing the public on matters of public interest" and exempts it where the content "has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility". Craft supply listings are not matters of public interest, which leaves the duty untriggered.
Search, records and training. Their search box lists products and does not write answers, so no Article 50 disclosure attaches. The register is one page: the four tools, the vendor, the responsible person and the use. They put it, plus the seven-line AI policy above, in the shared handbook, and dated it after a thirty-minute session together. That is their Article 4 response.
What they did not do. No register was filed, because Article 49 does not reach a deployer of a low-risk system. No conformity assessment was commissioned, no AI governance tool bought, no data protection officer appointed. Total cost: roughly three hours of the two owners' time and one email to a vendor. Hold onto that number when someone quotes a four-figure readiness project.
A 12-month compliance calendar
Dated from October 2026, on the assumption that 2 August 2026 has passed and you are catching up, not planning ahead.
- October 2026. Write the one-page AI register. On a phone, open your own site and confirm the chat disclosure appears before the first message.
- November 2026. Send the ten vendor questions and file the replies. Label every AI-generated image that could be mistaken for a photograph of real stock.
- 2 December 2026. Put this date in the diary and act on it. It brings the new prohibition on non-consensual sexual deepfakes and child sexual abuse material, together with the Article 50(2) transition deadline for synthetic content generators already on the market before 2 August 2026. Ask your content vendor whether they have shipped marking.
- January 2027. Write the staff AI policy, run the training, and put a date on it.
- February 2027. Re-test the chatbot disclosure on mobile and with a screen reader. Confirm a route to a human exists.
- March 2027. Review every AI-assisted product description for accuracy, and check that image labelling is still followed.
- April 2027. Confirm vendor data processing agreements and sub-processor lists are current, and that your data is not used for model training.
- May 2027. Re-test on-site search. If it now generates answers instead of listing products, treat it as a disclosure case.
- June 2027. Refresh the AI register. Remove tools you no longer use, because a register of dead tools reads as neglect, not care.
- July 2027. Check for further AI Act amendments and for Irish secondary legislation under the Act of 2026.
- 2 August 2027. The sandbox milestone. Confirm that nothing in it changes your position, and that the Article 6(1) date in Article 113 has not moved again.
- September 2027. Annual review. Re-check this guide against the EUR-Lex text and the Commission's timeline, and update the policy date.
Printable checklist
- [ ] I know which AI tools my business uses, and who owns each.
- [ ] My chat or voice assistant announces it is automated before the customer's first message.
- [ ] My site offers a route to a human that does not rely on the AI tool working.
- [ ] I have asked every AI vendor, in writing, whether its output is marked as AI-generated.
- [ ] I have asked every vendor whether white-labelling would make me the provider.
- [ ] AI-generated images that could be mistaken for real stock carry a label on the page.
- [ ] I publish no synthetic images of real identifiable people without disclosure.
- [ ] Every piece of published AI-drafted text has a named person responsible for it.
- [ ] A data processing agreement exists with every vendor that touches customer personal data.
- [ ] I know whether my vendor trains models on my data, in writing.
- [ ] A one-page AI policy exists, and my team has been trained on it.
- [ ] The policy and the training note both carry dates.
- [ ] 2 December 2026 is in the diary.
- [ ] I have noted that Annex III high-risk rules apply from 2 December 2027, and that they are not mine.
- [ ] I have bought no compliance product that a primary source does not require.
For a second opinion on the website answers before you print it, the free check at the Rennwick AI Act check covers the disclosure questions and nothing else. Our what we do page sets out the work we take on, the shop holds the fixed-price packs, and you can reach us through contact. Existing pieces on this and neighbouring subjects sit in insights, our data handling is set out in the privacy policy, and if your site already has an AI feature with no disclosure, the AI Act fix service is the shortest route to putting that right.
What this means for you
Where a customer talks to software on your site, say so. For most small websites that is the whole of the Act's practical reach. It costs a sentence, and it has applied since 2 August 2026.
Your vendors carry the weight, so ask them in writing. The Act pushes marking duties upstream. Your protection against holding the problem yourself is a dated email in which the vendor said it handles marking and identifies itself as AI.
Do the small things that build a defence. Article 4 literacy, a one-page register, a one-page policy with a date on it. Ireland's Act of 2026 gives a statutory defence for "all reasonable efforts", and these are what reasonable efforts look like.
Do not buy the big things. As a deployer of a low-risk system, nobody should be selling you a conformity assessment, a registration service or a governance platform. If someone is, ask which article requires it, and for the paragraph reference.
What we do not know
Several widely repeated claims about the AI Act could not be confirmed in a primary source.
A widely repeated date we could not confirm. Some commentary states that all high-risk obligations were postponed to August 2027. The Commission's timeline and the AI Omnibus material say otherwise: the Annex III date is 2 December 2027 and the Annex I date is 2 August 2028. No primary source was found for a single 2027 date, so it is not repeated here.
A document number we could not verify. Secondary commentary gives the Commission's Article 50 guidelines the number C(2026) 5054 final. The Commission's own publication page for those guidelines, checked 26 September 2026, does not print a document number, so the number stands as unconfirmed and only the publication page and its 20 July 2026 date are cited.
Which authority handles what, in practice. S.I. No. 366/2025 names the Minister, the Central Bank and the Data Protection Commission, and the Act of 2026 adds the AI Office of Ireland and refers throughout to "relevant competent authorities". Ireland has published no single consolidated statement of which authority supervises which obligation, so the practical division of labour is still settling.
Things still moving. The Act has already been amended once through the AI Omnibus, and a further Digital Omnibus proposal is in train that could change timing again. Ireland's secondary legislation is incomplete, so enforcement will sharpen during 2027. The standard for machine-readable marking is not settled, and the Code of Practice is voluntary. The UK position could also change quickly. The Commons Library briefing says the UK has no AI-specific legislation, but a bill could come at short notice.
Sources
Every source below was checked on 26 September 2026. Any publication date given is the date shown on the source.
- Regulation (EU) 2024/1689 on EUR-Lex, Official Journal, published 12 July 2024. Articles 2, 3, 4, 49, 50, 62, 63, 99 and 113 are quoted from it here.
- European Commission: regulatory framework for AI. Source of the four risk levels.
- European Commission: guidelines on transparency obligations for providers and deployers of AI systems, dated 20 July 2026.
- European Commission: AI Omnibus enters into force, published 27 July 2026. Carries the Annex III and Annex I dates and the new deepfake prohibition.
- European Commission: Code of Practice on Transparency of AI-generated Content, issued 10 June 2026.
- AI Act Service Desk: implementation timeline. Lists the milestones from 1 August 2024 to 2 August 2028.
- AI Act Service Desk: Article 50. Used to cross-check the Article 50 structure.
- Data Protection Commission: AI, Large Language Models and Data Protection, dated 18 July 2024.
- European Data Protection Board: Opinion 28/2024, adopted on 18 December 2024.
- Houses of the Oireachtas: Regulation of Artificial Intelligence Act 2026 (Act 31 of 2026), enacted on 21 July 2026.
- Regulation of Artificial Intelligence Act 2026, enacted text. Sections 105 and 122 cover fines and the defence.
- Irish Statute Book: S.I. No. 366/2025, European Union (Artificial Intelligence) (Designation) Regulations 2025. Names the designated competent and market surveillance authorities.
- Department of Enterprise, Tourism and Employment: press release on the Bill, dated 17 June 2026.
- AI Office of Ireland, the official national authority site.
- Irish Statute Book: Regulation of Artificial Intelligence Act 2026, section 9. Sets out the functions of the Office.
- House of Commons Library: AI regulation in the UK, the briefing CBP-10003.
- European Commission: Digital Omnibus on AI regulation proposal.
Revision log
v1.0, 26 September 2026. First publication. This guide consolidates three earlier Rennwick articles on the AI Act deadline for websites, AI disclosure wording, and the AI Act for Irish small businesses, with every legal claim re-checked against the primary sources listed above. It replaces those articles, which were written before the AI Omnibus entered into force and before Ireland's Regulation of Artificial Intelligence Act 2026 was signed.
This guide is general information about Regulation (EU) 2024/1689 and related Irish law, not legal advice. It does not replace advice on your own circumstances. Last checked 26 September 2026.