The law: AI rules in Ireland and the EU

Some things in this lesson are law. Some are advice. We say which is which.

The EU has one main law on AI. It is called the AI Act. Its full name is Regulation (EU) 2024/1689. A regulation applies directly in every EU country.

A new EU law changed parts of the AI Act. It has been in force since 27 July 2026. We quote the AI Act with that change.

This lesson explains what the texts say. It is not legal advice.

The AI Act is Regulation (EU) 2024/1689 of 13 June 2024. Its last article ends: “This Regulation shall be binding in its entirety and directly applicable in all Member States.”

Regulation (EU) 2026/1744 of 8 July 2026, called the Digital Omnibus on AI, amends it. It was published in the Official Journal on 24 July 2026. It says: “This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union”. That is 27 July 2026.

We quote the consolidated text of 27 July 2026, which EUR-Lex lists as current, and we read it on 3 October 2026. That text says it is “meant purely as a documentation tool and has no legal effect”. So we also matched each quote against the Official Journal text it comes from. EUR-Lex refused our scripted requests, so we read the consolidated text and the Official Journal acts from the EU Publications Office. The latest consolidated version we could reach is dated 27 July 2026. A later one may exist.

Some AI uses are banned in the EU. One ban matters a lot for school and work.

The EU bans AI that infers a person’s emotions from their body data, such as their face. This holds at work or in education. A camera that reads faces to guess if someone is angry is an example.

The European Commission says reading emotions from written text alone is not covered. Its guidance is not law.

There is one exception. The ban does not cover medical or safety reasons.

This ban has applied since 2 February 2025. The law lists other bans too. The Deep text names them.

Article 5(1)(f) prohibits: “the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;”. Chapters I and II apply “from 2 February 2025”, so this ban has applied since that date.

Article 3(39) defines an emotion recognition system as one “for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data”. Article 3(34) says biometric data is personal data from technical processing of a person’s physical, physiological or behavioural characteristics, “such as facial images”. Recital (18) lists emotions such as “happiness, sadness, anger, surprise, disgust, embarrassment, excitement, shame, contempt, satisfaction and amusement”. It says the notion “does not include physical states, such as pain or fatigue”. A recital explains the law. The articles are the rules.

The Commission’s guidelines on prohibited practices (paragraphs 250 to 266) say that emotion recognition covers inference from biometric data, and give an example outside it: emotions read from text alone. The guidelines explain the Commission’s view and are not law.

Recital (44) gives a reason: “There are serious concerns about the scientific basis of AI systems aiming to identify or infer emotions”.

Article 5(1) lists eight bans, points (a) to (h). This is our short list of topics, not the text. Each point has conditions and exceptions that the list leaves out, so read Article 5(1) for its exact scope. For example, (a) and (b) need significant harm or reasonably likely significant harm, and (g) excludes some lawful labelling or filtering of datasets. (a) Manipulative or deceptive techniques that distort behaviour and cause significant harm. (b) Exploiting vulnerabilities because of age, disability or a social or economic situation. (c) Social scoring that leads to unfair treatment. (d) Predicting that a person will commit a crime based solely on profiling or personality traits. (e) Building facial recognition databases by untargeted scraping of images from the internet or CCTV. (f) The ban above. (g) Sorting people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. (h) Real-time remote biometric identification in public spaces for law enforcement, unless strictly necessary for listed aims. The 2026 act added points (ba) and (bb), which concern certain AI-generated sexual material. They apply from 2 December 2026.

Some uses are not banned, but the Act calls them high-risk. They get extra rules.

Annex III is a list at the back of the AI Act. For education, it names four uses.

• AI that decides who gets a place.
• AI that grades learning.
• AI that assesses what level of education a person can get.
• AI that watches for cheating in tests.

Hiring is on the list too. So is AI that filters job applications.

The main extra rules for these uses apply from 2 December 2027. When we checked, on 3 October 2026, that date was still ahead.

Article 6(2) says: “In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.” Annex III point 3, “Education and vocational training”, lists systems “intended to be used” (a) “to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels”; (b) “to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels”; (c) “for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels”; and (d) “for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels”.

Point 4(a), “Employment, workers’ management and access to self-employment”, lists systems “intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”.

Article 113 says Chapter III, Sections 1, 2 and 3, except Article 6(5), apply from “2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III”. For AI in products covered by Annex I, the date is 2 August 2028. Both dates come from the 2026 act. This lesson does not teach what the extra rules are.

Being on the list is not the end. Article 6(3) says an Annex III system “shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making”. One example is a system “intended to perform a narrow procedural task”. But “an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons”. A provider who thinks its system is not high-risk “shall document its assessment before that system is placed on the market or put into service”.

Article 4 is about learning, not banning.

It says people or organisations that make or use AI must take measures to support AI literacy. This is for their staff. It also covers other people who run AI for them.

The law sets no level they must reach. Article 4 says the duty does not require them to guarantee any specific level for any person.

The words changed in July 2026. The old text said to take measures “to ensure, to their best extent, a sufficient level”. The new text says to take measures “to support the development of” AI literacy.

Article 4 has applied since 2 February 2025.

Article 4, as replaced by Article 1, point (5), of Regulation (EU) 2026/1744, and read from the EU Publications Office’s copy on 3 October 2026:

1. “Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

2. “The Commission and the Member States shall support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs, in fulfilling their obligation under paragraph 1 of this Article. For that purpose, the Commission shall publish practical examples of how to comply with that obligation on the single information platform referred to in Article 62(3), point (b).”

3. “The Board shall adopt recommendations, taking into account European competence frameworks, to support the Commission and Member States in the promotion of AI literacy required under paragraph 1, including by setting out common objectives.”

We did not check whether the practical examples or the Board’s recommendations have been published.

The 2024 wording was: “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.” Recital (8) of the 2026 act gives the reason: “a solution imposing stringent obligations to ensure a sufficient level of AI literacy would not be suitable for all types of providers and deployers”.

Article 3(56) defines the term: “‘AI literacy’ means skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause;”.

A provider, under Article 3(3), develops an AI system or has one developed and places it on the market under its own name. A deployer, under Article 3(4), is a body “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”.

Another rule is about labels. Providers of AI systems that create audio, images, video or text must mark most of what they make. Some uses are excluded, such as standard editing help. The mark must be machine-readable, so a computer can detect that an AI made it.

The rule falls on the maker, called the provider. It does not fall on you as an ordinary user. If you build and offer an AI system, you may be a provider.

The AI Act applies in general from 2 August 2026. Providers of such tools already on the market before then have until 2 December 2026 for this rule.

Lesson 4.5 will cover how to check a photo, voice message or video.

Article 50(2): “Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.” The paragraph has exceptions: “This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.”

Article 111, as changed in 2026, says that providers of such systems “that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026”.

Article 50(1) is a separate rule. AI meant to talk with people must be built so that they “are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect”. Article 50(4) has a separate duty for deployers of deep fakes. This lesson does not teach it.

This lesson has an activity. You see eight uses of AI in school and work, one at a time. For each one, you predict an answer: banned, high-risk or allowed.

Then you see the answer, with the article that says so. The article is quoted from EUR-Lex, the EU’s law website.

“Allowed” is our word. It means the use is on neither list. Two of the uses are allowed but carry a rule to be open that AI is involved.

Each use is a short description. A real system’s answer depends on what it is made to do.

The Act has no category named “allowed”. It has banned practices (Article 5), high-risk systems (Article 6 and Annex III), transparency duties (Article 50), and everything else. The activity gives the category that the quoted article gives for the use as described. Annex III says “intended to be used”, so a real system is judged on its intended purpose. Article 6(3) can take some Annex III systems out of high-risk, and a system listed in Annex III that profiles people is always high-risk. The activity quotes each article from the consolidated text of 27 July 2026.

Ireland has its own Act that goes with the EU law. It is the Regulation of Artificial Intelligence Act 2026, dated 21 July 2026.

It sets up a body called Oifig IS na hÉireann. Its website calls it the AI Office of Ireland. The body was set up on 31 July 2026.

Two of its jobs are about learning. It must “promote and foster AI innovation and literacy”. It must also enhance public awareness of how AI systems are used. That includes people’s rights and obligations under the EU law.

We searched the Act’s text on 3 October 2026. The word literacy appears once, in that list of jobs. Article 4 is not mentioned. So the AI literacy duty comes from Article 4 of the EU law. The Irish Act does not mention that article.

The Act is Number 31 of 2026. We quote the enacted text on the Irish Statute Book. We did not find a revised version. Under S.I. No. 403/2026, it came into operation on 31 July 2026, “other than paragraphs (a) and (e) of the definition of “applicable market surveillance authority” in section 78”.

Section 8(1): “There shall stand established on the establishment day a body which shall be known as Oifig IS na hÉireann (in this Act referred to as the “Office”) to perform the functions conferred on it by or under this Act.” S.I. No. 404/2026 appointed 31 July 2026 as the establishment day.

Section 9(1) lists the Office’s functions. Paragraph (c) is “promote and foster AI innovation and literacy,” and paragraph (d) is “enhance public awareness in relation to the use of AI systems and the rights and obligations under the Artificial Intelligence Regulation,”. Paragraph (a) is “coordinate the activities of relevant competent authorities to encourage consistent implementation and supervision of the Artificial Intelligence Regulation”. Section 9(5): “Subject to this Act, the Office shall be independent in the performance of its functions.”

The Office describes itself: “The AI Office of Ireland is an independent statutory body established under the Regulation of Artificial Intelligence Act 2026 and acts as the central coordinating body for the implementation of the EU Artificial Intelligence Act in Ireland.” That is its own statement, read on 3 October 2026.

Not every document about AI is law. In December 2025, Ireland’s Higher Education Authority (HEA) published a framework. It guides colleges as they write their own policies. It is not law.

It does not apply directly to students.

The AI Act sorts AI uses by what they can do to people. People wrote that sorting, so it is a choice too. This site’s line is: “What AI can do is not good or bad by itself. The choices people make in designing and using it carry values.”

Lesson 3.8 will cover the EU expert group’s seven requirements for trustworthy AI. They are guidelines, not law. Lesson 4.2 will cover how to study honestly with AI.

The HEA framework, version 1.0, December 2025, says: “There is no intention to prescribe a uniform set of rules or single model of adoption.” It describes itself as a policy framework that “sets out a values-based orientation that can guide institutions in developing their own policies, practices, and cultures of use”. And: “This framework does not apply directly to students, nor is it intended as guidance for their individual use of AI tools.” It is published under CC BY-SA 4.0, so we cite it and do not adapt it.

Article 6(3) of the AI Act names the harms its high-risk test looks at: “the health, safety or fundamental rights of natural persons”.