AI Office will be statutory independent body
The Government has published an outline of legislation that will implement key elements of the EU’s AI Act.
While the EU law has direct legal effect in member states, national legislation is needed to implement the provisions linked to the supervision and enforcement of those obligations.
The General Scheme of the Regulation of Artificial Intelligence Bill 2026 confirms that Ireland will adopt a distributed model of competent authorities for the AI Act.
This means that established regulatory authorities will supervise their own sectors, with a designated central authority to provide co-ordination and a number of centralised functions.
Statutory independent body
The bill proposes to establish a new statutory independent body – Oifig Intleachta Shaorga na hÉireann, or the AI Office of Ireland – under the remit of the Department of Enterprise, Tourism and Employment, to act as a central co-ordinating authority for implementing and enforcing the EU AI Act in the State.
It also provides for the empowerment of competent authorities, and rules on penalties for infringement of the act.
The Irish Council for Civil Liberties (ICCL) has welcomed the publication, saying that an initial analysis indicated that most of its recommendations had been incorporated into the bill.
It particularly welcomed the plan for the AI Office to be a statutory, independent authority, as well as a proposal to ensure that supervising bodies have “the resources needed to fulfil their mandates".
William Fry partner Barry Scannell says that the publication, the first step in the legislative process, provides the first detailed view of the legislative and regulatory architecture that will govern AI compliance.
In a note on the firm’s website, he points out that the statutory establishment day for the AI Office must occur on or before 1 August this year.
Source code
Scannell describes the enforcement toolkit provided to market-surveillance authorities as “extensive”, with the bill including powers to require documentation, conduct inspections, and obtain product samples.
“Perhaps most concerning for technology providers is the power of the market-surveillance authorities to require access to source code, although it remains unclear whether this includes model parameters, weights and system prompts, which are arguably more critical,” the William Fry lawyer states.
He adds that the scheme frames this as a last resort, available only for high-risk AI systems, where necessary to assess compliance and where other assessment methods have been exhausted.
Risk classifications
Scannell points out that the scheme explicitly empowers authorities to challenge risk classifications.
“Where an authority suspects incorrect self-assessment of a system as falling outside the high-risk category, it may require a formal evaluation, which may result in full high-risk obligations being applied following reclassification,” he says.
Scannell adds that companies should maintain clear records demonstrating why their AI systems do or do not fall within high-risk categories under the EU act.