Start with approved and informal tools, including AI features inside existing software. Record the exact task, supplier, version, affected people and whether outputs influence decisions.

• Review prohibited practices and the transparency duties that apply now.
• Check the supplier’s intended use and instructions against your actual workflow.
• Prepare the people who use or oversee the system; agree how to challenge an output and escalate an incident.
• For a potentially high-risk use, obtain a documented assessment and prepare for the applicable date and transition.

First deliverable: one completed inventory row and an accountable owner.

Map the system you place on the market or put into service under your name. Distinguish system-provider responsibilities from any separate GPAI-model responsibilities. Rebranding or changing a system can alter your role.

• Describe the intended purpose and record your classification rationale.
• Identify the applicable requirements, date, documentation and conformity route.
• Collect evaluation evidence and define change control, user information, oversight and post-market responsibilities.
• For a GPAI model, review the model-specific rules and voluntary Code of Practice.

First deliverable: a responsibility map linking your team, model supplier, integrators and customers.

Ask for evidence about the specific product and intended use. A supplier’s marketing claim is not a substitute for your own documented decision.

• Use the supplier questionnaire before a pilot or renewal.
• Check data use, confidentiality, testing, incident contacts and notice of material changes.
• Agree which party supplies documentation and supports transparency and human oversight.
• Review your role again if you import, distribute, rebrand or change the intended purpose.

First deliverable: a list of unanswered questions, each with an owner and due date.

This is a suggested work plan, not a statutory timetable.

1. Week 1: identify AI uses, appoint owners and flag uses needing immediate review.
2. Week 2: gather supplier evidence; review purpose, data and affected people with relevant specialists.
3. Week 3: run practical learning sessions using your own tools and failure examples.
4. Week 4: record decisions, restrictions and follow-up dates. Review the plan when tools or purposes change.

Small size does not create a blanket exemption. Use the official Irish support routes to find assistance appropriate to your organisation.

General-purpose AI models can support many different downstream systems. Model-provider rules and the rules for a particular deployed system address different responsibilities.

The GPAI Code of Practice is a voluntary route covering transparency, copyright, and safety and security. Its safety and security chapter concerns providers of GPAI models with systemic risk.

Practical next step: ask the supplier which model/version is used, what documentation is available and how changes are communicated. Do not assume that using an API automatically makes you a GPAI-model provider.

Sources: GPAI Code of Practice · Definitions.

For a potentially high-risk system, plan the applicable provider or deployer work ahead of its application date. The exact obligations depend on role and use.

• Document purpose, classification, evaluation and relevant supplier information.
• Assign human oversight, operational monitoring and escalation responsibilities.
• Check whether a fundamental-rights impact assessment is required for the particular deployer and use.
• Review data-protection duties separately; a GDPR assessment and an AI Act assessment are not interchangeable.

Sources: Deployer obligations · Fundamental-rights assessment · Amended provisions.

No. The templates and readiness review help organise work. They do not determine your legal position or certify a system. AI literacy does not require a particular certificate.

Sources: AI literacy Q&A.

No. Assess its intended purpose, your role, the relevant legal conditions and the people affected. One product may be used in very different ways.

Sources: Classification rules · Amendments.

No. Other provisions already apply. Check current duties and the specific transition for each system rather than relying on one general deadline.

Sources: Official timeline.

No. The Act is legislation. Voluntary commitments and codes can support preparation or compliance work but do not replace applicable legal obligations.

Sources: Commission AI Act overview.

Check the date and status of each source. Read the published regulation together with amendments, then relevant official guidance. Some explorer pages explicitly flag amendments still to be incorporated. Seek qualified advice where interpretation affects a decision.

Sources: Original regulation · July 2026 amendment.