Ireland

Although currently untested, existing constitutional protections apply to the use of AI. As in the case of other emerging technologies, constitutionally protected rights such as privacy and other fundamental rights will impact on AI.

Right to privacy

Although the Constitution does not explicitly specify a right to privacy, there exists an unenumerated right to privacy under Article 40.3.1 of the Constitution. In McGee v. Attorney General [1974] IR 284, the court recognised a right to privacy as being inherent to every person due to their human personality. Kennedy & Ors v. Ireland [1984] 1 IR 587 confirmed that the right to damages for breaches of the right to privacy may not be limited to claims against the State alone, allowing for claims against others.

The right to privacy is not absolute. Irish case law has established that the right is subject to the constitutional rights of others, to the requirements of public order, public morality, and the common good (for example Ryan v. The Attorney General [1965] 1 IR 294 and Norris v. The Attorney General [1984] 1 IR 36).

Freedom of expression, assembly, and association

The rights to freedom of expression, assembly, and association are protected by Article 40.6.1 of the Constitution. People have the right to express their convictions and opinions, to assemble peaceably and without arms, and to form associations and unions. These freedoms are subject to limitations based on public order and public morality.

The Irish courts, in The Irish Times v. Ireland [1998]1 IR 359, held that this extends to the dissemination of information, as well as the expression of convictions and opinions, and is primarily concerned with public activities. The courts have been reluctant to limit freedom of expression in Ireland (Ryan v. The Attorney General and Norris v. The Attorney General are examples of this).

Article 40.1 contains explicit constitutional protection that all citizens, as human persons, are equal before the law, including a ban on discriminatory behaviour.

These rights should be considered in the use of AI which could (inadvertently) have the effect of creating forms of bias and discrimination.

The European Convention on Human Rights Act 2003 gave full effect in Irish law to the European Convention on Human Rights (ECHR), including Article 8 (right to respect for private and family life); Article 9 (freedom of thought, conscience, and religion); Article 10 (freedom of expression); Article 11 (freedom of assembly and association); and Article 14 (prohibition of discrimination).

The Charter of Fundamental Rights of the European Union is applied in Ireland. It is relevant when the Oireachtas (the national Parliament of Ireland) is implementing or effecting EU law. While not explicitly referred to in the Irish Constitution, Article 29 does reference the primacy of EU law.

Patents in Irish law are governed by the Patents Act 1992 as amended (“the Patents Act”). Under section 9(1), a patent shall be patentable if “it is susceptible of industrial application, is new and involves an inventive step”. However, computer programs are not considered to be an invention under section 9(2), meaning much of the scope for patentability relating to AI is untested under Irish law.

There is no decision that a machine can be classified as an inventor under the Patents Act. “Inventor” is defined as “the actual deviser of an invention”, which appears to leave the question open, however, section 80, relating to co-ownership of patents, refers to co-owners as “two or more persons”. This aligns with the decisions of the European Patent Office (EPO) in J8/20 and J9/20, which concerned an application to designate the AI system called DABUS as an inventor, in which the Legal Appeal Board of the EPO confirmed the EU position under the European Patent Convention (EPC) that an inventor must be a person with legal capacity. Since these decisions, the UK Supreme Court unanimously came to the same conclusion in Thaler v. Comptroller-General of Patents, Designs and Trademarks [2023] UKSC 49; [2024] 2 All ER 527. Without an Irish judgment on this issue, the UK Supreme Court decision has persuasive value in Ireland, not least since the definition of “inventor” in the UK Patents Act 1977 is the same as the Irish definition contained in the Patents Act.

Authorship of AI-generated works has become increasingly relevant due to the rise in popularity of technologies such as ChatGPT, Gemini and Claude.

The Copyright and Related Rights Act 2000 (CRRA) governs copyright in Ireland. It protects copyright in a “computer program” where “a program which is original in that it is the author’s own intellectual creation and includes any design materials used for the preparation of the program”.

Under section 2 of the CRRA, a “computer-generated” work is a work that is generated by a computer in circumstances “where the author of the work is not an individual”. The author of this type of work is the person by whom the arrangements necessary for the creation of the work are undertaken. Section 21(f) states: “In this Act, ‘author’ means the person who creates a work and includes: (f) in the case of a work which is computer-generated, the person by whom the arrangements necessary for the creation of the work are undertaken”. This legislation was clearly not designed to deal with the AI-generated works which we have today.

The CRRA appears to derive from the idea of a legal entity model, i.e. one that implies the existence of natural persons behind a legal entity instructing it, although it could have been trying to capture the concept of a machine authoring a work as opposed to a human. This approach of attributing authorship to the individual responsible for facilitating the creation of a work could serve as a means of copyrighting AI-generated works. However, as AI becomes more advanced, issues may arise where robots, acting autonomously, are not acting on the instructions of humans. This could make section 21(f) difficult to reconcile with the concept of machine learning. An absence of case law means that the legislation has yet to be tested.

This Irish provision is seen as lying outside the EU’s copyright acquis, which generally takes an anthropocentric approach to authorship, requiring human involvement for copyright to vest in a work.

Noting this distinction, in its 2025 paper on the impact of AI on Ireland’s creative sector (the working group for which was chaired by Dr. Barry Scannell, a co-author of this chapter), the Government-appointed AI Advisory Council recommended replacing this provision with a specific human authorship requirement to align more closely with the EU approach. In place of this provision, the AI Advisory Council recommended introducing a new right specifically for AI-generated works. Similar in style to a database right, this sui generis right would be designed to protect the investment and effort in creating AI-generated content instead of connecting such works which require traditional elements of “creativity”.

Text and data mining

Text and data mining (TDM) is an automated process that selects and analyses large amounts of data for purposes such as extraction, pattern recognition, and semantic analysis. It is vital in the sourcing, compiling and use of the enormous datasets which are used to train AI models. Article 4 of Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market (CDSM Directive) deals with commercial TDM. It was transposed into Irish law by Regulation 4 of S.I. No. 567/2021 — European Union (Copyright and Related Rights in the Digital Single Market) Regulations 2021 (Irish CDSMD Regulations). The CDSM Directive provides that the reproduction of copyright works for TDM, even if for commercial purposes, does not need the authorisation of the rights holder if the rights in those works have not been expressly reserved “in an appropriate manner” against this use. The “appropriate manner” includes, for online works, metadata and terms and conditions for a website or a service, and if not available online, must be communicated to any individual who has lawful access to the work.

The text of the TDM exception diverges between the Irish CDSMD Regulations and the CDSM Directive. Regulation 4 of the Irish CDSMD Regulations provides for “authors” to expressly reserve the use of their work for TDM purposes, whereas the CDSM Directive provides for “rights holders” to expressly reserve the use of their work for TDM purposes. This could lead to legal ambiguity in the future since “rights holders” is a more encompassing term, and includes, for example, a scenario where a company would own a copyrighted work that a contractor created — the company would be the rights holder, and the contractor would be the author. Under Regulation 4 of the Irish CDSMD Regulations, only the author can reserve their rights against TDM, not new downstream rights holders. The authors of this chapter understand that, at the time of writing, Irish legislation is imminent which will address this issue.

Due to the difficulties in patenting abstract ideas, trade secrets have become increasingly important in protecting the IP of AI systems and AI-generated works. Since acquiring meaningful patents on AI systems is not straightforward, some companies are using trade secret protection to protect their AI-related IP. Trade secrets are governed by common law and the European Union (Protection of Trade Secrets) Regulations 2018, whose provisions mirror the definition of “trade secret” contained in the equivalent EU Directive (2016/943). Under Irish law, in order for an algorithm to be classified as a trade secret, there are three essential criteria:

• it must be actually secret;
• it must have actual or potential commercial value; and
• there must be reasonable efforts made to keep it a secret.

Trade secrets may become increasingly important, due to the commonly held position that AI-generated works do not attract copyright protection. If AI-generated works cannot be protected by copyright, trade secrets could be utilised to prevent disclosure of elements, such as source code, that were created by AI.

No seminal AI-related IP cases have yet been adjudicated in the Irish courts. That said, Irish entities already sit at the centre of major European litigation that is likely to shape how Irish practitioners advise on AI training and AI outputs.

Google Ireland Limited is the defendant in Like Company v. Google Ireland Limited (Case C-250/25), a request for a preliminary ruling lodged on 3 April 2025 by the Budapest Környéki Törvényszék (Hungary). The dispute is brought by Like Company, a Hungarian press publisher, and concerns allegations that Google’s generative AI chatbot (widely reported as Gemini, formerly Bard) reproduced and made available protected press content. The reference raises questions that go to the core of EU copyright doctrine in an AI setting, including whether model training and/or generated outputs involve acts of reproduction and communication to the public, and how the CDSM Directive regime on press publishers’ rights and text and data mining exceptions applies in practice. 

Secondly, OpenAI Ireland has been sued in the Munich Regional Court in proceedings brought by GEMA (Case 42 O 14139/24). In a first-instance decision of 11 November 2025, the court largely upheld GEMA’s claims for injunctive relief, information and damages, in a case focused on ChatGPT outputs that reproduced substantial parts of protected song lyrics in response to straightforward prompts. While not an Irish decision, the judgment is an important European marker for rights holders pursuing claims based on memorisation and verbatim reproduction in AI outputs, with direct relevance to Irish risk assessments and contracting.

Ireland’s domestic law features legislation that is core to the use and application of AI, the Data Protection Act 2018 (DPA 2018). In addition, the European Communities (Electronic Communications Network and Services) (Privacy and Electronic Communications) Regulations 2011 provides for data privacy in electronic communications. The DPA 2018 implemented certain procedural and discretionary national matters in accordance with the derogations of the General Data Protection Regulation (GDPR).

Several provisions of the GDPR apply to the governance of AI in Ireland. Article 35 requires those processing personal data “using new technologies” to carry out a data protection impact assessment where that processing is “likely to result in a high-risk to the rights and freedoms of natural persons”. Those developing AI systems to process personal data are likely to need to conduct data protection impact assessments.

While the CDSM Directive and the Irish CDSMD Regulations allow for exceptions for reproduction for TDM purposes, the legislation specifically disallows the processing of personal data unless it complies with the GDPR.

There is a right of individuals not to be subject to a decision based solely on automated processing (Article 22), including “profiling”. Similarly, the overarching principle of transparency (Article 5), obliges controllers to be clear about the processing of personal data undertaken. Also, controllers must adhere to the GDPR’s concepts of privacy by default and privacy by design when deploying new technologies (Article 25).

Irish context

The GDPR allows for derogations to be made by EU Member States. Irish law may restrict the scope of data subjects’ rights and controllers’ related obligations in Articles 12 to 22, 34, and 5 (as it relates to the rights and obligations in Articles 12 to 22) of the GDPR in certain circumstances. The DPA 2018 provides that this can be done when processing personal data for archiving in the public interest, scientific or historical research, or statistical purposes (section 61) or where processing for purely journalistic purposes or academic, artistic, or literary expression (section 43).

Further, Article 8 of the GDPR provides that countries must set a minimum age at which online service providers can rely on a child’s own consent to process their personal data. The DPA 2018 sets the age of this digital consent at 16. This means that companies deploying AI algorithms may need to obtain the consent of a child’s parent or guardian in order to rely on consent as the legal basis for processing a child’s personal data where that child is under the age of 16. The protection of children’s data has become a priority for the Data Protection Commission of Ireland (DPC). As such, deployers of AI systems will be under increased regulatory scrutiny regarding parental consent and parental controls, age assurance and age verification, children’s privacy, and content regulation for children (including under Ireland’s Online Safety and Media Regulation Act 2022).

Irish regulatory action

The DPC has taken a lead role in the regulation of AI given its role as lead supervisory authority of many AI developers.

In September 2024, the DPC used its powers under section 134 of the DPA 2018 for the first time, bringing an Irish High Court application against X in relation to its AI tool “Grok”. Section 134 of the DPA 2018 allows the DPC to make an application to the Irish High Court, where it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects for an order requiring a data controller or processor to suspend, restrict or prohibit the processing of personal data. The result of this application was an agreement from X to suspend its processing of certain personal data for the training of Grok on a permanent basis.

In the same month, the DPC issued its first formal referral to the European Data Protection Board (EDPB) under Article 64 of the GDPR seeking clarification on the processing of personal data in the context of AI models. This was also a first for the DPC and resulted in the EDPB’s adoption of Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models in December 2024.

Opinion 28/2024 acknowledges that legitimate interests can, in principle, be relied upon for training AI models using personal data, but only where controllers meet strict criteria (including, demonstrating necessity, carrying out a rigorous balancing exercise, and implementing meaningful safeguards addressing both training data and downstream use). The EDPB also opined that it was possible for a model’s mathematical parameters to store personal data.

Beyond the novel use of its powers under the GDPR and DPA 2018, the DPC has approached concerns regarding AI in a consistent approach with its wider data protection remit, launching inquiries into the processing of personal data by several AI models and engaging with many of the global names in technology who have chosen Ireland as a base of operations (and for whom it acts as lead supervisory authority).

Cementing its leading role with regard to AI, the Government has designated the DPC as both a competent authority and fundamental rights authority under the AI Act.

The EU Digital Reforms Package allows machine learning, AI, and the Internet of Things (IoT) to become more accessible, addressing emerging barriers to publicly funded information, and stimulating digital innovation, especially regarding AI.

Ireland has implemented a suite of legislation that is based on the EU Digital Reforms Package which will facilitate data sharing and will impact public bodies and private companies alike. The Government has implemented the European Union (Open Data and Re-use of Public Sector Information) Regulations 2021 to give effect to the EU Open Data Directive 2019/1024.

Placed on a legislative footing, these regulations impose an obligation on EU Member States to make high-value datasets available for reuse free of charge in machine-readable formats and via APIs and, where relevant, as a bulk download. High-value datasets offer significant benefits for society, the environment, and the economy, as they are suitable for developing applications and value-added services.

The EU’s Data Act came into force on 11 January 2024, with most of its provisions applicable in Ireland since 12 September 2025. The Data Act facilitates more extensive data sharing across the EU, which could be particularly beneficial for Irish small and midsize enterprises (SMEs), as they have improved access to data necessary for business growth and innovation. The requirements of the Data Act also apply in circumstances where, for example, data is derived from IoT devices and is used to train AI systems.

In November 2025, the European Commission adopted a Digital Omnibus proposal which aims to repeal the Open Data Directive and substantially absorb its rules into the Data Act (along with wider targeted amendments across a several pieces of EU legislation, including the GDPR).

The European Health Data Space Regulation (EHDS) will become effective in Ireland from 2027. Irish citizens will have more control over their health data with its enactment. Part of its aim is to foster the development of new AI-based healthcare products and services, which significantly improve patient safety and wellbeing, while preserving privacy and security. 

The GDPR lists certain biometric data as a form of special category of personal data, which is used for the purposes of uniquely identifying an individual. Like all forms of special category personal data, the GDPR is more restrictive about the processing of biometric data. The DPA 2018 does not provide additional restrictions on the processing of biometric data, including voice data and facial recognition data, beyond that of the GDPR.

The Garda Síochána (Recording Devices) Act 2023 provides for smart body-cameras to be worn by an Garda Síochána members in certain circumstances. At the time of writing, the Garda Síochána (Recording Devices) (Amendment) Bill 2025 is at the latter stages of Ireland’s legislative process. The amendments proposed by this bill would facilitate the carrying out of biometric analysis obtained by an Garda Síochána for the purposes of crime prevention and prosecution, protection of the security of the State and the search for missing persons. This could conceivably cover automatic facial recognition, automatic profiling, and tracking of individuals. The power to utilise biometric identification has been expressly provided for in this bill as there was previously no legislative basis within the DPA 2018 for an Garda Síochána to process biometric data.

Under the AI Act, the use of real-time remote biometric identification data in public spaces for law enforcement is prohibited, except for specific necessary objectives. These include:

• targeted searches for victims of abduction, trafficking or sexual exploitation or missing persons;
• the prevention of threats to life, safety or genuine threat of a terrorist attack; or
• to identify suspects of serious crimes.

Outside of these circumstances, AI systems that employ biometric data are considered high-risk under the AI Act.

Noting the various legal and regulatory considerations at play, as well as the Government’s commitment to maintaining public trust in AI within the national AI strategy, the AI Advisory Council has advised that, in legislating for facial recognition in law enforcement, a number of bodies should be consulted, including the DPC, the AI Office and the Irish Human Rights and Equality Commission.

Discrimination in AI can stem from biased training data, skewed algorithms, lack of diversity in data, and the unconscious biases of those implementing and deploying the AI itself. Ireland’s anti-discrimination regime is well established and implements the Equal Treatment Directive 76/207. The Equal Status Acts 2000 – 2018 prohibit discrimination in the provision of goods and services, accommodation and education. This can be used to protect individuals from discrimination in certain instances such as where AI is utilised in the selection of tenants in residential properties, or in the case of applicants for schools and colleges.

In the employment sphere, the Employment Equality Act 1998 was enacted to affirm the European principles of non-discrimination. In Ireland this applies to discrimination on the basis of nine equality grounds which, by law, must be respected in employment and recruitment processes. AI systems are increasingly being adopted by employers in the recruitment process to increase efficiency and reduce costs. However, there is the potential for employees and job applicants to bring a range of claims against employers, where AI has made or influenced a biased or discriminatory decision affecting their employment.

Employee monitoring through the use of AI systems is protected by GDPR transparency requirements. Businesses that have increased their use of monitoring software, allowing employers to view employees’ messages and emails, webcam footage, microphone input and keystrokes, must ensure that they are fully transparent in deploying such AI monitoring software, in order to avoid this level of monitoring being considered a violation of an employee’s right to privacy under the GDPR.

NIS2, DORA and Cyber Resilience Act

AI and cybersecurity must go hand-in-hand as AI is both a new frontier for bad actors to seize and a tool for strengthening cybersecurity measures. Ireland’s cybersecurity framework is driven primarily by EU legislation which includes the NIS2 Directive, the Digital Operational Resilience Act (DORA) and the Cyber Resilience Act (CRA).

The NIS2 Directive took effect on 17 October 2024 across the EU but has yet to be transposed into Irish law. As a result, Ireland is subject to infringement proceedings due to late transposition by the European Commission. The predecessor regime of the NIS2 Directive however (the NIS1 Directive) remains in full effect and covers the most critical operators within the State on an interim basis until transposition, seeking to ensure that critical business operations have robust cybersecurity systems in place. Organisations are encouraged to make use of machine learning or AI systems to enhance their cybersecurity capabilities.

In January 2026, the European Commission proposed a new cybersecurity package to further strengthen the EU’s cybersecurity resilience in the face of growing attacks on essential services and democratic institutions. Within this package, the European Commission is seeking to make targeted amendments to the NIS2 Directive to increase legal clarity, streamline compliance obligations, and modify its scope. This development is expected to further delay Ireland’s formal transposition of the NIS2 Directive.

DORA focuses on addressing digital operational resilience in the financial sector. DORA introduced specific obligations for financial entities and ICT service providers, including establishing a risk management framework and conducting resilience testing. AI could be leveraged in this respect by entities to enhance the detection of cyber threats, automate responses to incidents and improve overall cyber resilience.

The CRA strengthens cybersecurity requirements for hardware and software products with digital elements placed on the EU market and will apply fully from 2027. The CRA’s remit will extend to AI systems that are integrated into products that pose cybersecurity risks.

The development by Anthropic of the Mythos model family, and the establishment of Project Glasswing, has been a paradigm shift in terms of the impact of AI on national cybersecurity considerations – a model deemed so powerful that Anthropic has not released it publicly. Claude Mythos Preview is a general-purpose language model whose cybersecurity capabilities were not explicitly trained but emerged as a downstream consequence of improvements in code reasoning and autonomous operation. In evaluations conducted by the UK AI Security Institute (AISI), Mythos Preview became the first model to complete a 32-step simulated corporate network attack from initial reconnaissance through to full network takeover, a task AISI estimates would require a human professional approximately 20 hours to perform. On expert-level capture-the-flag challenges, which no model could complete before April 2025, Mythos Preview now succeeds 73% of the time.

Under Project Glasswing, Anthropic has committed USD 100 million in model usage credits to enable launch partners and over 40 additional organisations that build or maintain critical software infrastructure to use Mythos Preview for defensive vulnerability detection, black-box binary testing, endpoint security, and penetration testing. The significance for regulators and legislators lies in the dual-use character of these capabilities – the same reasoning that allows Mythos Preview to identify and remediate zero-day vulnerabilities at unprecedented speed also equips it to exploit them. That asymmetry demands a regulatory response that goes well beyond traditional software liability frameworks and engages directly with questions of model access governance, coordinated disclosure obligations, and the adequacy of existing critical infrastructure protection regimes, including NIS2 Directive, in an environment where autonomous offensive cyber capability is no longer theoretical.

Indications of the adaption of Ireland’s regulatory regime to potential market abuses are beginning to become visible. The Competition and Consumer Protection Commission, in a consultation response on Ireland’s AI Strategy published in 2019, stated that, in the case of personalised pricing algorithms, there should be specific information requirements which mirror the European Commission’s New Deal for Consumers, to inform the consumer “that the price of the goods, digital content, digital service or service was personalised on the basis of automated decision-making”. This is reflected in Schedule 3 of the Consumer Rights Act 2022.

The Competition Act 2002 (as amended) (2002 Act) prohibits anti-competitive behaviour by undertakings in Irish law. Section 4 of the 2002 Act is based by analogy on Article 101 of the Treaty on the Functioning of the European Union (TFEU) and is concerned with situations where undertakings come together bilaterally to create anti-competitive agreements, engage in concerted practices or take anti-competitive decisions. Section 5 of the 2002 Act is concerned where an undertaking, acting unilaterally, abuses its dominant position in trade for any goods or services. Section 5 is based on Article 102 of the TFEU. Whether the 2002 Act or the TFEU is invoked is dependent on the territorial impact of the arrangements.

The issue of “algorithmic pricing” (i.e. the automated recalibration of prices based on internal and external factors such as market data or competitors’ prices) may constitute potential anti-competitive behaviour or concerted practices. As it currently stands, if AI is used to conceal or comprise anti-competitive agreements this will fall foul of national legislation in the normal way (i.e. an infringement of section 4).

Much like the DPC’s remit in relation to the interplay between personal data and AI, the Government has appointed the Competition and Consumer Protection Commission as both a competent authority and fundamental rights authority under the AI Act.

Ireland does not formally recognise AI agents as having legal personality, legal capacity, or acting as agents in law. There are no proposals, legislative or otherwise, to change this position. As in all common law jurisdictions, Ireland recognises legal personality for certain non-human actors such as companies, but that recognition is tightly constrained and grounded in statute and long-established doctrine. It does not extend to technology or software systems. Suggestions that AI systems should be afforded legal personhood are legally incoherent and technologically premature. Current AI systems lack anything approaching sentience or consciousness, and for now the debate remains firmly in the realm of science fiction rather than law.

Irish law does, however, contain a narrow accommodation for non-human creation in the context of copyright as discussed above. Under the CRRA, where a work is computer-generated and there is no human author, the author is deemed to be the person who made the necessary arrangements for the creation of the work. This provision was enacted long before modern generative or agentic AI and was not designed with autonomous systems in mind. It nonetheless demonstrates that Irish law has previously grappled with attribution problems arising from automation, albeit in a limited and highly specific context. It does not confer rights or status on the technology itself.

Because AI systems have no legal personality, traditional agency law cannot apply to them. An AI system cannot be an agent in law because it is not a legal person and cannot owe fiduciary duties, form intent, or be bound by authority in the legal sense. This means that attempts to analyse AI agents through orthodox agency doctrine are misplaced. That said, AI systems are increasingly making decisions with legal and economic consequences on behalf of their deployers. The law will therefore look past the software and focus on the humans and organisations behind it.

One likely route for liability is negligent misstatement. If an AI system communicates terms, criteria, or assurances on which a counterparty reasonably relies, and those statements are incorrect due to hallucination or system failure, it could be argued that the deployer has made a negligent misstatement through the system. The analysis would turn on established principles: whether a duty of care arose, whether reliance was reasonable, and whether loss was caused by that reliance.

There is also scope for revisiting ancient doctrines such as non est factum (“it’s not my deed”). Traditionally, this defence applies where a person signs a document without understanding its nature or contents. A deployer might seek to argue that an AI system acted entirely outside its intended design, purpose, or authority, such that the resulting act cannot be attributed to them. This becomes more complex where the system has been jailbroken, manipulated, or coerced by a third party. While untested in this context, the argument highlights the strain that autonomous systems place on existing legal categories.

Negligence principles more generally will be central. Courts will ask who owed a duty of care, whether that duty was breached, and how responsibility should be allocated between developers, deployers, integrators, and users. These questions will increasingly intersect with statutory regimes. The revised Product Liability Directive is particularly significant, as it explicitly brings AI systems within scope. Under that framework, liability may arise on the basis of defect alone, without the need to prove fault, shifting the evidential burden in a way that is highly relevant for AI-driven harm.

In practice, however, the primary risk management tool will be contract rather than common law or statute. Responsibility for AI agents will need to be allocated with precision along the value chain through representations, warranties, limitations of liability, and indemnities. Contractual architecture will be the first and most effective line of defence, reflecting the reality that AI agents are tools whose legal consequences ultimately attach to the humans and entities that design, deploy, and profit from them.

There are no specific regulations at a legislative level relating to agentic AI in Ireland. A number of rules apply to their use however, including general aspects of the AI Act, GDPR, Data Act and wider EU Digital Reforms Package. In particular, the AI Act’s rules on general-purpose AI models and systems are particularly relevant in this regard, along with automated decision-making principles of the GDPR.

As agentic AI develops, a number of industries are taking a keen view as to how its members are deploying and using AI agents in commercial use before adopting any specific rules. Similarly, the Government itself has acknowledged that it is looking at agentic AI in the context of its own guidelines to public sector bodies and intends to update its guidance as the technology develops.

Ireland aligns with the European approach to product liability with regards to AI systems, largely viewing them as products without developed consideration of AI systems as a service.

Liability for defective products is governed in Ireland by the Liability for Defective Products Act 1991 (“the 1991 Act”), which transposed the Product Liability Directive 85/374/EEC (“the Product Liability Directive”). The Product Liability Directive and the 1991 Act establish that where a consumer can prove, in the absence of limited exonerating circumstances, the existence of a defect, resulting damage and a causal link between their damage and the defect, strict liability will be imposed on the manufacturer (or in certain circumstances the importer of the defective product).

While it is broadly accepted that the Product Liability Directive applied in principle to products incorporating AI, it fell short of dealing with the complexity of AI-based products. This changed in December 2024, when Directive (EU) 2024/2853 on liability for defective products (“the Revised Product Liability Directive”) entered into force, including at its core, a recognition that the definition of product had evolved since the Product Liability Directive first became applicable in 1985.

The Revised Product Liability Directive provides for an updated definition of product, to include all types of software including AI systems. Under the framework, a manufacturer is defined broadly in relation to AI systems and covers any AI system provider under the AI Act. The revised Product Liability Directive will only apply to products placed on the market or put into service after 9 December 2026 or at the date for which it is transposed into Irish law (the deadline for Ireland to implement such transposition being the same date).

The core of the Revised Product Liability Directive is that injured parties will not need to prove negligence if they can prove that an AI product was defective as defined in the legislation. Under the revised Product Liability Directive, AI is treated squarely as a product, even where it is delivered as software or through a service model. The Revised Product Liability Directive expressly brings software within scope, including AI systems, machine learning models, and updates. It also captures digital manufacturing files and software-driven functionality. As a result, the traditional distinction between products and services is narrowed for liability purposes. Software delivered as Software as a Service (SaaS) can fall within the regime where the damage arises from the software’s functionality rather than from a purely human service layer.

Pursuant to the Revised Product Liability Directive, injured parties do not need to prove fault. They must show a defect, damage, and a causal link. A defect exists where the product does not provide the safety which a person is entitled to expect, assessed by reference to presentation, reasonably foreseeable use, and the time the product was put into circulation. For AI, this assessment is more complex but not conceptually novel. Issues such as model hallucination, unsafe outputs, biased decision-making, failure to update, or inadequate safeguards can all ground an allegation of defect. Importantly, ongoing learning and post-deployment updates are now explicitly relevant, meaning providers cannot rely on a static conception of safety.

The contractual considerations pertaining to AI are discussed in more detail in Section 10, below. Under Irish common law, principles of misrepresentation, negligent misstatement, and breach of contract will continue to apply in parallel. An AI system that makes assurances or outputs that are relied upon by a counterparty can still ground liability outside the product regime. What the revised Directive does is rebalance the system by lowering evidential barriers and shifting risk upstream. It also weakens arguments that AI is merely a service and therefore outside strict liability. For practical purposes, AI is now treated as a product with service characteristics, and the law responds accordingly.

The net effect is a recalibration of liability rather than a revolution. Irish law already has the conceptual tools to deal with harm caused by technology. The revised Product Liability Directive sharpens those tools, particularly for software and AI, and makes contractual risk allocation indispensable rather than optional. Those who deploy AI without robust contractual protection will be assuming a level of exposure that is no longer theoretical.

As above, a strict liability regime for AI-related harm exists under the Revised Product Liability Directive, due to enter into force from 9 December 2026.

Under the Revised Product Liability Directive, a person is entitled to compensation where they suffer damage caused by a defective product. The burden of proof is on the claimant and requires them to show that the product did not provide the safety they were entitled to expect or that is required under EU or EU Member State law, resulting damage and a causal link between their damage and the defect.

Product safety in Ireland is largely regulated at EU level, with approximately 70% of products on the market covered by EU harmonised law.

For high-risk AI systems, the AI Act itself requires that providers which consider that a high-risk AI system they have placed on the market or put into service is not in conformity with the AI Act must immediately take corrective action to bring the system into conformity, withdraw it, disable it or recall it, as appropriate.

Beyond the AI Act, the EU General Product Safety Regulation, which was transposed into Irish law by the European Union (General Product Safety) Regulations 2024, requires that all consumer products on the EU markets not already covered by existing harmonised law are safe and established specific obligations to ensure this. The AI Act makes clear in its recitals that this includes those AI systems related to products that are not high-risk, and as such acting as a safety net to the AI Act’s requirements. Included in such obligations is a requirement for organisations to take necessary corrective action where they consider or have reason to believe that a product they placed on the market is a dangerous product, including withdrawal or recall as appropriate.

No seminal cases related to AI product liability have yet been adjudicated in the Irish courts.

AI in Ireland is mainly governed by the AI Act. Ireland is one of the first EU Member States to introduce a regulatory framework regarding the designation of competent authorities, namely the European Union (Artificial Intelligence) (Designation) Regulations 2025. Ireland will also establish a national AI Office by 2 August 2026 to serve as Ireland’s central coordinating authority for AI Act implementation.

In June 2026, the Government published the Regulation of Artificial Intelligence Bill 2026 ("the Bill"). The Bill sets out how Ireland plans to regulate AI and implements delegated areas of the AI Act into national legislation, marking a significant step towards domestic transposition. The Bill proposes to assign enforcement responsibilities to 13 existing sectoral regulators designated as Market Surveillance Authorities (MSAs), including the Central Bank, the Data Protection Commission, ComReg, Coimisiún na Meán, and the Competition and Consumer Protection Commission. It also proposes creating a new independent statutory body, the AI Office of Ireland (Oifig IS na hÉireann (OISÉ)), to act as the central coordinator and Single Point of Contact for the European Commission.

It is intended that OISÉ will be empowered to coordinate national reporting, maintain a register of prohibited AI practices and high-risk systems, establish a regulatory sandbox, chair a Cooperation Forum of competent authorities, and issue guidelines, but it will not hold binding directive power over the sectoral regulators and has no sector of direct supervision of its own.

The MSAs themselves would be granted extensive investigative powers aligned with the EU Market Surveillance Regulation, including the authority to enter premises, conduct unannounced inspections, seize documentation, acquire products under cover identity for reverse engineering, and, where other methods have been exhausted, access the source code of high-risk AI systems. The legislation equips these regulators with a strong enforcement toolkit comprising contravention and prohibition notices that can compel operators to remedy breaches, withdraw systems from the market, or cease operations entirely. This would be backed by an administrative sanctions regime capable of imposing fines of up to €35 million or 7% of global turnover for prohibited AI practices, €15 million or 3% for other regulatory obligations, and €7.5 million or 1% for supplying misleading information to competent authorities.

To ensure procedural fairness and constitutional compliance, the Bill separates the investigative function from the sanctioning function through an independent adjudication process. Adjudicators nominated by OISÉ and appointed by the Minister, would enjoy powers equivalent to those of a High Court judge in civil proceedings, and all adjudications would require High Court confirmation before taking effect.

Separately to Ireland’s proposed AI regulation legislation, the Government is reviewing the Protection of Voice and Image Bill 2025 — a Private Member’s Bill which would create a number of criminal offences relating to “deepfakes” where they are made without an individual’s consent.

The regulation of AI is also effected by multiple other pieces of legislation and elements of the EU Digital Reforms Package such as NIS2, DORA, the Cybersecurity Act and the Data Act, which have an impact on AI systems and their component parts.

Another key piece of legislation which governs AI, and in particular recommender systems, which are often driven by AI, is the Digital Services Act (DSA) Regulation 2022/2065. This legislation was implemented in Ireland by the Irish Digital Services Act 2024. Coimisiún na Meán has been appointed as the Digital Services Coordinator and the lead Competent Authority for enforcing the DSA in Ireland. While the DSA primarily focuses on intermediary services and online platforms, it also has implications for AI. The DSA requires Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) to conduct AI-specific risk assessments, to identify and mitigate risks associated with AI technologies used on their platforms. In particular, the regulation of AI recommender systems pursuant to the DSA will be a key component of Ireland’s AI regulation.

The National AI Strategy sets out how Ireland can be an international leader in using AI to benefit the Irish economy and society. In February 2026, the Government published its updated National Digital & AI Strategy, which sets out Ireland's digital and AI ambitions to 2030.

The Government also established an AI Advisory Council, an independent task force to provide expert advice to the Government, with a specific focus on building public trust and promoting the development of trustworthy, person-centred AI. The Advisory Council is made up of 15 members (one of the appointees of which is Dr. Barry Scannell, a co-author of this chapter). Its role includes providing expert guidance, insights, and recommendations on AI in response to specific requests from the Government, as well as developing and delivering its own workplan of advice on issues in AI policy.

Ireland is committed to fostering the growth of its technology sector and the National AI Strategy has set a target for Ireland to have 75% of Irish businesses using AI by 2030. Several goals outlined in the National AI Strategy have been achieved so far:

• Ireland’s “AI Ambassador” was appointed, and an Enterprise Digital Advisory Forum was established which focuses on industry adoption of AI;
• an AI Innovation Hub was established to offer support and services to SMEs such as specialist AI training and project feasibility work;
• Ireland has joined the Global Partnership on AI, which is a multi-stakeholder initiative originating in the Organisation for Economic Co-operation and Development (OECD);
• the National Standards Authority of Ireland (NSAI) has also published the AI Standards and Assurance Roadmap.

In May 2025, the Government published guidelines on the responsible use of AI in the public service.

In January 2026, the Government reacted quickly to a number of media reports indicating the use of generative AI within a large social media service to produce and circulate non-consensual intimate images online. While the creation and dissemination of such images are already protected under Irish law, these protections are not specific to AI and are not specifically addressed by the AI Act. Noting this potential lacuna within the regulation, the AI Advisory Council recommended that the Government uses Ireland’s upcoming EU Presidency to work with other EU Member States to seek the expansion of Article 5 of the AI Act to cover the prohibition of AI practices which allow users to generate non-consensual intimate images and child sex abuse material.