EU AI Act: A New Wave of Litigation for Irish Businesses?

The New Digital Rulebook: Navigating the EU AI Act and the Dawn of AI Litigation in Ireland

For the past year, artificial intelligence has transitioned from the realm of science fiction to a daily headline fixture. The public debut of generative AI models like ChatGPT thrust the technology into the mainstream consciousness, but it is the quiet, methodical work in the halls of Brussels that will have the most profound and lasting impact. The conclusion of negotiations on the European Union’s Artificial Intelligence Act represents a landmark moment in technological regulation, a piece of legislation with a global reach comparable only to the General Data Protection Regulation (GDPR). For businesses, legal professionals, and ordinary citizens across Ireland, the AI Act is not merely a distant European directive; it is a new digital rulebook that will reshape industries, define corporate responsibility, and crucially, open new avenues for redress and compensation when autonomous systems cause harm.

The culmination of over three years of intensive drafting, debate, and lobbying, the AI Act is the world’s first comprehensive legal framework for AI. Its ambition is twofold: to foster innovation and bolster Europe’s competitiveness in the global AI race, while simultaneously erecting a robust fortress of safeguards around the health, safety, and fundamental rights of its citizens. These rights, enshrined in the European Charter of Fundamental Rights, encompass everything from democracy and the rule of law to environmental protection. The Act seeks to weave a thread of trustworthiness and human-centricity into the very fabric of AI development and deployment. However, as with any legislation of this magnitude, the devil resides in the detail, and the practicalities of its implementation in Ireland will present both significant challenges and novel opportunities, particularly within the sphere of litigation and personal compensation.

Defining the Indefinable: What Constitutes AI?

One of the most fundamental challenges the Act grapples with is the deceptively simple question: what is artificial intelligence? Even among computer scientists and engineers, a consensus remains elusive. The drafters of the Act have attempted to cast a wide net, defining an AI system as one “that is designed to operate with elements of autonomy and that, based on machine and/or human-provided data and inputs, infers how to achieve a given set of objectives using machine learning and/or logic- and knowledge-based approaches, and produces system-generated outputs such as content (generative AI systems), predictions, recommendations or decisions, influencing the environments with which the AI system interacts”.

This definition has been criticised for its breadth, potentially capturing technologies that many would not consider to be true AI. The European Commission has acknowledged this ambiguity and has pledged to issue further guidelines to clarify its practical application. For an Irish business, from a FinTech start-up in Dublin’s Silicon Docks to a traditional manufacturing firm in the Midlands, this definitional grey area is the first hurdle. Determining whether the new predictive maintenance software on the factory floor or the automated customer service chatbot on a website falls within the Act’s scope is a critical first step, as the answer dictates the compliance journey that follows. The line between a complex automated system and a regulated AI system can be blurry, and misclassification could prove to be a costly mistake.

The Pyramid of Peril: A Risk-Based Regulatory Approach

At the heart of the AI Act is a tiered, risk-based approach. The regulatory burden placed upon a system is directly proportional to the potential harm it could inflict on an individual’s health, safety, or fundamental rights. This methodology creates a pyramid of compliance, with four distinct levels of risk, each carrying its own set of rules and consequences.

Unacceptable Risk: The Prohibited Practices

At the apex of the pyramid are AI practices deemed to pose such a clear threat to human dignity and democratic values that they are banned outright. These are the digital red lines that cannot be crossed within the EU. Examples include the use of AI for ‘social scoring’ by public authorities, where citizens are graded based on their behaviour, potentially leading to detrimental treatment in accessing public services. Imagine a scenario where an Irish citizen is denied social housing or placed lower on a healthcare waiting list because an algorithm has assigned them a low ‘social score’ based on data scraped from their online activities or civic records. Such a system is now unequivocally illegal.

Other prohibitions target manipulative subliminal techniques that could cause physical or psychological harm, and the exploitation of vulnerabilities of specific groups, such as children or people with disabilities. The Act also bans untargeted scraping of facial images from the internet or CCTV to build facial recognition databases, a practice that raises enormous privacy concerns. Furthermore, emotion recognition systems are prohibited in workplaces and educational institutions. While there are very narrow, judicially authorised exceptions for the use of real-time remote biometric identification (like live facial recognition) by law enforcement for serious crimes, the general principle is a firm prohibition on technologies that carry an unacceptable risk of mass surveillance and discrimination.

High-Risk: The Zone of Stringent Compliance

The second tier, and the one that will occupy the most attention for businesses and their legal advisors, is the ‘high-risk’ category. These are AI systems that, while not banned, have the potential to significantly impact people’s lives and livelihoods. The Act identifies specific use-cases in Annex III which are presumed to be high-risk. These include AI systems used in critical infrastructure (like energy grids or transport), education (to determine access to schools or universities), and most pertinently for future compensation claims, in employment and the administration of justice.

An AI system will be classified as high-risk if it is intended to be used as a safety component in a product already covered by existing EU safety regulations, such as medical devices, toys, or machinery. A separate, extensive list covers standalone AI systems. If a system falls into this category, it is subject to a formidable list of obligations before it can be placed on the market. These include rigorous conformity assessments, robust data governance and quality control, detailed technical documentation, human oversight mechanisms, and high levels of accuracy, cybersecurity, and robustness. For many Irish companies, this will necessitate a complete overhaul of their product development and procurement processes.

Limited Risk: The Duty of Transparency

Below the high-risk category lies systems with ‘limited risk’. This tier primarily concerns AI systems that interact with humans. The core obligation here is transparency. Users must be made aware that they are interacting with an artificial system. This applies to chatbots, where the user must be informed they are not conversing with a human. It also covers ‘deepfakes’ or other AI-generated synthetic content, which must be clearly labelled as artificial. The goal is to prevent deception and empower individuals to make informed decisions. An Irish consumer interacting with their bank’s customer service bot, for instance, must be explicitly told they are dealing with an AI, preventing any misunderstanding about the nature of the interaction.

Minimal Risk: The Vast Majority

The base of the pyramid encompasses all other AI systems, which are deemed to be of ‘minimal or no risk’. This category includes applications like AI-powered video games or spam filters. The Act imposes no new legal obligations on these systems, allowing innovation to flourish unimpeded. The expectation is that the vast majority of AI systems in use today and in the future will fall into this category, allowing regulators and businesses to focus their resources on the applications that pose a genuine threat.

The Irish Angle: Employment, Justice, and the Coming Wave of Litigation

For solicitors and barristers in Ireland, the high-risk category outlined in Annex III is a roadmap to the future of litigation. The Act effectively creates new standards of care and operational requirements, the breach of which could form the basis of negligence claims, discrimination cases, and actions for damages. Let us consider some tangible Irish scenarios.

AI in the Workplace: A New Front for Employment Law

Annex III specifically designates AI systems used in “employment, worker management and access to self-employment” as high-risk. This covers AI used for recruitment, such as CV-screening tools, as well as systems for making decisions on promotion, termination, or task allocation. Imagine a large multinational in Dublin uses an AI tool to sift through thousands of applications for a graduate programme. If that tool, trained on historical data, has inadvertently learned to penalise candidates from certain postcodes, educational backgrounds, or with non-traditional Irish names, it could lead to a wave of discrimination claims under the Employment Equality Acts. The AI Act will require the ‘deployer’ (the company using the tool) to ensure human oversight and the ‘provider’ (the developer of the tool) to demonstrate the data used for training was unbiased. A failure to do so could be damning evidence in a claim brought before the Workplace Relations Commission (WRC) or the Civil Courts.

Consider another scenario: an employee is overlooked for promotion or made redundant based on a performance score generated by an AI monitoring their productivity. If the employee can argue the AI system was flawed, lacked transparency, or failed to account for context, they may have grounds for an unfair dismissal claim. The AI Act’s requirements for transparency and explainability will be crucial. An individual will have the right to an explanation for a significant decision made by an AI. The inability of a company to provide a clear, human-understandable reason for the AI’s output could become a significant legal liability, potentially leading to substantial compensation awards for the affected employee.

AI in the Courts and Gardaí: A Question of Justice

The Act also classifies as high-risk AI systems used in the administration of justice and law enforcement. This could include tools used by An Garda Síochána for predictive policing or by the courts system to assist judges in researching case law or even assessing the reliability of evidence. The potential for harm here is immense. What if an AI system used to analyse evidence in a criminal trial contains a bug or a bias that leads to a wrongful conviction? The ensuing legal challenge could lead not only to the conviction being quashed but also to a significant compensation claim against the State for a miscarriage of justice.

The right to a fair trial, a cornerstone of the Irish Constitution, is at stake. The use of ‘black box’ algorithms, where even the developers cannot fully explain the reasoning behind a decision, is fundamentally incompatible with the principles of open justice. Legal professionals will need to develop a new skillset to challenge AI-derived evidence, demanding access to the system’s technical documentation, training data, and error rates, all of which are mandated for high-risk systems under the Act. The discovery process in civil and criminal litigation is set to become far more technically complex.

The Accidental Deployer: A Trap for the Unwary

A critical distinction in the Act is between ‘providers’ (those who develop and place AI on the market) and ‘deployers’ (those who use an AI system under their own authority). While providers bear the primary burden of ensuring a high-risk system is compliant, deployers have significant obligations too. A law firm, an accountancy practice, or any SME in Ireland could unwittingly become a ‘deployer’ of a high-risk AI system simply by purchasing off-the-shelf software. For example, if a firm buys a new HR software package that uses an AI module for performance tracking, that firm is now a deployer and must comply with the associated obligations, including ensuring human oversight and using the system in accordance with its instructions.

This ‘accidental deployer’ status is a major risk. Many businesses may not even be aware that the software they use incorporates AI, let alone high-risk AI. A crucial first step for any Irish organisation will be to conduct a thorough audit of its technology stack, engaging with vendors to understand precisely where and how AI is being used. Failure to do so could leave a company exposed not only to regulatory fines but also to civil liability if the system causes harm to an employee or customer.

Enforcement and Redress: The Path to Compensation

The AI Act’s enforcement structure will be multi-layered. At the European level, a new European AI Office has been established within the Commission to oversee the most advanced AI models and ensure consistent application across the Union. At the national level, each member state must designate competent authorities. In Ireland, it is anticipated that bodies like the National Standards Authority of Ireland (NSAI) for conformity assessments and the Competition and Consumer Protection Commission (CCPC) for market surveillance will play key roles. Data protection aspects will naturally fall under the remit of the Data Protection Commission (DPC).

The penalties for non-compliance are severe, designed to command the attention of boardrooms. Fines can range from €7.5 million or 1.5% of global annual turnover for supplying incorrect information, up to a staggering €35 million or 7% of global annual turnover for using a prohibited AI system. These figures eclipse even the top tier of GDPR fines, signalling the EU’s seriousness.

Beyond regulatory fines, the Act empowers individuals. It provides a right for any person to lodge a complaint with a national authority if they believe their rights have been infringed. More importantly, it lays the groundwork for compensation claims. The EU is concurrently working on an AI Liability Directive, which aims to make it easier for victims of AI-related harm to claim compensation by adjusting the burden of proof. When combined with the AI Act’s transparency and documentation requirements, this will give potential litigants a powerful arsenal. An individual seeking compensation will be able to petition a court to order the disclosure of information about the high-risk AI system that caused them harm, helping to overcome the ‘black box’ problem and establish a causal link between the system’s failure and their loss.

The Timeline and Preparing for a New Reality

The AI Act will not come into force overnight. Following its formal adoption and publication in the Official Journal of the EU, there will be a phased implementation. The prohibitions on unacceptable-risk AI will apply after just six months. The rules for general-purpose AI models will come into effect after twelve months, while the comprehensive obligations for high-risk systems will have a 24-month grace period. This gives Irish businesses a window to prepare, but it is a window that will close quickly.

Preparation should begin now. Businesses must start by inventorying their use of AI systems. They need to engage with their supply chain to understand the technology embedded in the products and services they procure. Legal and compliance teams must familiarise themselves with the Act’s provisions, particularly the high-risk categories relevant to their sector. This is not simply an IT issue; it is a fundamental matter of corporate governance and risk management.

The AI Act is more than just another piece of regulation. It is a tectonic shift in the legal landscape. For Ireland, a nation that has built its modern economy on technology and innovation, the Act presents a pivotal moment. It offers a framework for responsible innovation, but it also introduces a complex web of obligations and a new frontier of legal liability. The era of AI litigation is on the horizon, and for those who are unprepared, the financial and reputational costs could be immense. For individuals who suffer harm at the hands of an autonomous decision, however, it represents a crucial new pathway to justice and compensation.