AI and data protection in Ireland

Most AI governance work in Ireland starts with data protection. The GDPR and the Data Protection Act 2018 apply to any AI system that processes personal data, whether in training, in the prompts staff type or in the outputs it produces, and the Data Protection Commission (DPC) supervises them. Since 2 August 2026 the EU AI Act has applied in general as well. This guide sets out what the DPC expects of organisations using AI, as of October 2026, and how it fits with the AI Act.

What the DPC has said

The DPC’s guidance, AI, Large Language Models and Data Protection, was published on 18 July 2024. It is short and practical, and it is addressed to two audiences. The first is organisations that use AI products as controllers. The second is the designers, developers and providers of those products.

For organisations using AI, the guidance asks for seven things.

• Assess the risk first. Consider a formal risk assessment before using an AI product. Establish what personal data it uses, where that data goes and whether the provider keeps or reuses it.
• Protect what staff put in. Personal data employees enter into a third-party tool can create security and data protection risks, so understand how the provider safeguards it.
• Be able to honour rights. Make sure you can locate, provide or delete an individual’s personal data held within the AI system.
• Check the outputs. Inaccurate or biased outputs used without critical human analysis or intervention can create automated decision-making risks.
• Set retention rules. Without a retention schedule, you risk breaching the storage limitation principle.
• Watch for memorisation. Models can reproduce training data, which can expose personal data you did not intend to process.
• Guard what you publish. Consider whether personal data on your website could be collected for AI training without the knowledge or expectation of the people concerned.

For providers the guidance stresses that publicly accessible personal data is still personal data, that reusing it for training needs a lawful basis, and that a data protection impact assessment may be required. It also asks providers to consider whether a non-AI approach would achieve the same purpose with less risk.

Turning the guidance into practice

The DPC’s list rests on knowing what AI is in use. Most organisations underestimate this, because AI arrives inside tools staff already have as well as through new purchases. A short shadow AI review usually finds more than the procurement list shows.

For each tool, the DPC’s questions become a set of records. What personal data it touches, and whose. Whether the provider is a processor or acts as a controller in its own right, and whether it uses customer inputs to train its models. Where the data is stored and for how long. How an access or erasure request would be met. And who reviews outputs before they affect a person.

Two policies do most of the work at the staff level. An acceptable use policy says which tools staff may use and what data they may enter, and guardrails enforce it at the point of use. Contract terms with AI vendors then cover training on your data, retention, sub-processors and incident notification, as set out in vendor AI risk management.

Automated decisions

Where an AI system makes decisions about people without meaningful human involvement, GDPR Article 22 applies. A person has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, unless an exception applies, and even then they are entitled to human intervention, to express their point of view and to contest the decision. Articles 13 to 15 add a duty to give meaningful information about the logic involved.

The DPC’s point about outputs used without critical human analysis matters here. A person who simply approves what the system recommends does not take a decision out of Article 22. Human review has to be real, with the authority and information to change the outcome.

How the AI Act fits

The EU AI Act adds obligations that turn on the role an organisation plays and the risk tier of the system. From 2 December 2027, deployers of high-risk systems listed in Annex III must use them according to the instructions, assign human oversight, monitor them and keep logs, and some deployers must carry out a fundamental rights impact assessment. Transparency duties under Article 50, such as telling people they are interacting with an AI system, have applied since 2 August 2026.

In Ireland the AI Act is supervised under the Regulation of Artificial Intelligence Act 2026, with sectoral regulators acting as market surveillance authorities and the AI Office of Ireland coordinating them. The work overlaps heavily with data protection. A DPIA and a fundamental rights impact assessment draw on the same description of the system, the people affected and the controls in place, so most organisations build them from one record.

Where Aicura fits

Aicura supports this work. Discovery finds the AI tools in use and the AI register records each one with the personal data it touches, its vendor and its owner. Assessments hold the risk and impact work for each system, guardrails apply your acceptable use rules to live traffic, and oversight records where a person reviews decisions. The Essentials plan adds assessment against the EU AI Act, and Pro adds the DPC’s AI guidance and data protection authority and AI Act serious-incident notifications. It supports the work and the decisions stay with you.