The EU AI Act's Practical Implications for Irish Firms: Q1 2026 Actions

AI is entering every workflow in much the same manner as the internet did, often under the radar with take up across firms uneven but at the same time, suddenly, it's everywhere.

Shadow AI is the quietest way a firm can take on the biggest risk through tools that are adopted or used informally. This could be a browser plug in, a free chatbots, a quick document summarisation or contract review. All of these uses are operating outside procurement, outside IT management and outside any defensible supervision. In that environment client data can be copied into systems you haven't assessed, stored under terms you haven't read and processed in ways you can't later reconstruct. This means that privilege hygiene frays, GDPR exposure increases and the firm's ability to demonstrate competence and control is in question.

The EU AI Act is built to shut down that casual, unmanaged posture by pushing organisations toward inventory, governance, human oversight and evidence. The express purpose of this is so that AI use becomes auditable and accountable rather than invisible and improvisational. This risk based regulatory framework for artificial intelligence classifies AI systems by the level of harm they can cause and then attaches obligations accordingly ranging from outright prohibitions for certain unacceptable practices to heavy compliance duties for high-risk systems to targeted transparency rules for AI that interacts with people or generates content. Lighter requirements apply for lower risk tools, but these too are heavily regulated now.

The Act entered into force on 1 August 2024 but it applies in phases. The general provisions, including AI literacy expectations, applied from 2 February 2025. 2 August 2025 saw key governance provisions and the rules for general purpose AI (GPAI) kick in and from 2 August 2026 the Act becomes broadly applicable across the regime. The Service Desk notes a full roll out foreseen by 2 August 2027.

Because that timetable is already running, Irish firms should treat 2026 readiness as a systems and evidence project. Inventory every AI use case including free tools built into other software. tighten procurement so no one introduces shadow AI, define permitted uses and red lines by practice area and build auditable supervision around training records, review checklists, escalation paths and incident logs. The AI Act adds an accountability layer that clients, insurers, regulators and increasingly clients will expect you to demonstrate in a concrete, reviewable form.

This supply chain framing means that law firms can be any of the following, depending on what you deploy:

Deployers: you use an AI tool in your practice (drafting, summarising, due diligence, intake bots).

Providers: you put an AI system "into service" under your name. For example, a client-facing chatbot embedded on your website, an AI contract review product sold to SMEs, or an internal system you materially modify and roll out across offices.

Importers/distributors: if you resell or package tools, especially under your brand.

That role shift changes the question from if AI is allowed to exactly what obligations attach to your role in the chain.

It's worth noting that over 2025 there were competing signals around implementation dates with some voices pushing for delays. The Commission at points insisted the schedule would proceed while proposals and media reporting raised the possibility of pushing parts of the "high risk" regime out.

If you run a law firm you need to behave as though the published timetable is real and build your AI programme now to put governance in place. Lock down procurement, train people to competence and start generating evidence of oversight.

The AI Act is, at its core, a risk regime. That is something that should feel familiar to Irish solicitors who already practise inside risk frameworks every day. The AI Act simply applies that same discipline to software that can influence decisions, shape behaviour and produce outputs with the persuasive sheen of authority. In broad terms, it draws four lines and it helps to picture them in concrete practice terms.

At one end sit prohibited or "unacceptable risk" practices. These are defined as systems designed to manipulate behaviour in ways that cause harm for example social scoring style profiling and certain forms of workplace emotion inference. These are all things most solicitors are not building but that can still arrive quietly through third-party HR, marketing, or analytics tools.

Next are "high risk" systems, where the law expects a full compliance architecture – documented risk management, strong data governance, technical documentation, logging, testing and meaningful human oversight. This would apply, as an example, to AI used in recruitment and performance management or systems that materially influence access to essential services. Any area where bias, opacity and error can translate into real world disadvantage.

Separate again are transparency triggers. These are uses where people are interacting with AI, for example a client facing intake chatbot on your website or receiving AI generated content that could be mistaken for human output. All of these uses require clear signalling and careful handling of what is being generated and why.

Everything else sits in a lighter touch category. These could be your drafting assistants, summarisation tools and extraction workflows. The danger with uses in this category is that they might become the basis for advice. For solicitors, the dividing line is ultimately evidential – can you show that AI in your practice is bounded to appropriate tasks, supervised by competent humans and controlled with the same discipline you would demand of any other high consequence system handling client rights, client money or client trust?

Particularly important for Irish solicitors is that the law defines legal advice broadly as advice on applying law "to any particular circumstances" of a person.

And that can be where AI risk becomes practice risk. If a tool generates outputs that look like advice, then a firm's exposure becomes about competence and standard of care, supervision and delegation, transparency to clients, confidentiality and privilege hygiene, complaints and professional discipline exposure. And that's before even considering data protection.

This is exactly why the recently published Law Society of Ireland guidance is so welcome. It highlights useful tasks for AI such as summaries, checklists, administrative support to a degree and warns against relying on LLMs for legal advice, document review or citations without robust verification and controls.

What Changes Inside A Firm: Five Shifts the AI Act Accelerates

1) AI literacy becomes an enforceable expectation.

The AI Act's first phase explicitly includes AI literacy obligations. This essentially means that your staff must understand enough to use AI responsibly and recognise risk.

In a firm context that means you need:

• a baseline training module for all staff – what AI is, what it isn't, hallucinations, confidentiality, verification etc
• role-specific training
• recorded completion and refreshers – audit trail

2) Procurement becomes compliance

The fastest way to fail the next two years is not malicious AI. It's ad hoc tool adoption.

Again, this something that can happen very easily in a firm that has not implemented proper AI management. It could be something as simple as a solicitor installing an AI browser plugin or a team buying AI minutes on a corporate card. Someone uploads documents to a free tier product that trains on inputs. Any of these situations means that you now have:

• client confidentiality risk
• GDPR exposure
• professional conduct risk
• and depending on the tool and use case, AI Act obligations you didn't realise you triggered

This is why firms need to treat AI like with the same degree of oversight as they do with cloud services, document management and practice management systems. As with these systems usage needs to be controlled, approved and logged.

3) Use of AI becomes a disclosure question

Even if you never touch a high-risk use case, transparency expectations are tightening. The Act includes transparency obligations for certain categories of AI systems and AI generated content with key provisions applying from 2 August 2026.

For solicitors, the client expectation curve may move faster than the statute. Some clients will imminently start to ask if their data was used to train anything, if their document was drafted with AI, if so, who checked it, can you evidence the checks?

You will also need to be ready for questionnaires from institutional clients, insurer questions and potential disputes where tool use becomes relevant to standard of care arguments.