Ireland’s AI Surge: The Growing Governance Gap

The Emerald Isle’s AI Paradox: A Nation on the Brink of Innovation and Infringement

Ireland, a nation long celebrated as a nexus of technological investment and digital prowess, stands at a precipice in 2025. An astonishing 91% of its organisations have embraced artificial intelligence, a figure that has nearly doubled from 49% in just twelve months. This meteoric rise, documented in pivotal research from Trinity Business School, paints a picture of a country hurtling towards a digitally transformed future, seemingly leading the European Union in a bold new era. Yet, beneath this glossy veneer of progress lies a perilous governance chasm. The rapid, almost frantic, adoption of generative AI tools—from OpenAI’s ChatGPT to Google’s Gemini and Anthropic’s Claude—has dangerously outpaced the development of the institutional frameworks required to manage them. A pervasive and insidious ‘shadow AI culture’ has taken root, where employees, driven by a desire for efficiency, independently deploy powerful platforms without any organisational oversight, creating a silent but catastrophic threat to data sovereignty and regulatory compliance.

This burgeoning crisis represents a fundamental disconnect between technological utility and legal obligation. As data flows unchecked from Irish corporate networks to servers in foreign jurisdictions, the foundational principles of the General Data Protection Regulation (GDPR) are being systematically undermined. With the full force of the EU AI Act looming on the horizon, the gap between enthusiastic experimentation and responsible implementation is no longer a matter of strategic oversight; it has become an existential threat to Irish enterprise. The nation’s digital ascent is being built on a foundation of unmanaged risk, where the very tools promising unprecedented productivity could trigger unprecedented penalties and reputational ruin.

The Economic Siren Song: Chasing a €250 Billion Prize

The motivation behind this high-speed, high-risk adoption is overwhelmingly economic. The figures are staggering and have captured the imagination of boardrooms across the country. Projections suggest that the widespread integration of AI could inject at least €250 billion into Ireland’s Gross Domestic Product by 2035. This figure could swell by an additional €60 billion if the government and private sector collaborate on supportive policies and frameworks for responsible innovation. At a more granular level, optimising AI adoption is forecast to boost Ireland’s Gross National Income (GNI) by a colossal €130 billion, potentially elevating the GNI per capita to an impressive €160,000. These are not merely statistics; they are powerful incentives fuelling a pervasive ‘fear of missing out’ among executives.

This climate has fostered a culture where the speed of implementation is prized above all else, often at the expense of meticulous due diligence. However, the maturity of this adoption is deeply questionable. While the 91% adoption rate makes for a compelling headline, a closer look reveals a landscape dominated by tentative and isolated experimentation. Only a meagre 8% of organisations have truly committed to an ‘AI-first’ approach, which is defined as the systematic and strategic integration of artificial intelligence across every facet of the business. The vast majority remain in a perpetual state of pilot projects, using AI in pockets rather than as a core component of their operational DNA.

Furthermore, a significant chasm has opened between the capabilities of multinational corporations and the limitations of indigenous Small and Medium Enterprises (SMEs). Multinationals, with their deep pockets and global resources, are leading the charge, with an adoption rate of 63%. In stark contrast, SMEs lag significantly behind at 40%. The hurdles for these smaller, domestic firms are primarily structural. A commanding 62% of SMEs cite a lack of internal AI expertise and the prohibitive costs associated with developing or implementing bespoke AI solutions as the principal barriers to entry. This creates a two-tier digital economy where the transformative benefits of AI are disproportionately accruing to larger, foreign-owned entities, while the backbone of the Irish economy struggles to keep pace.

Analysis of the 2025 data reveals further fragmentation. While the private sectors in the Republic of Ireland and Northern Ireland exhibit similar adoption rates, the regulatory burden appears to be felt more acutely in the North, where 80% of organisations reported significant compliance challenges, compared to just 50% in the Republic. The public sector, meanwhile, remains a cautious laggard. In the Republic of Ireland, a mere 13% of data-driven decision-making within public bodies utilises AI, a figure that, while low, is still dwarfed by Northern Ireland’s 24%. This patchwork of adoption rates and regulatory awareness underscores a critical lack of formal governance, creating dangerous gaps where secure and compliant implementation ought to be.

The Rise of Shadow AI and the Perils of Unearned Confidence

The most immediate and palpable threat to Irish data sovereignty stems from the proliferation of ‘shadow AI’. This phenomenon describes the unauthorised use of AI platforms within a corporate setting, completely bypassing established IT protocols and security measures. The scale of the problem is alarming: research indicates that a staggering 80% of Irish organisations have employees who are regularly using free, consumer-grade AI tools that lack the essential security controls of their enterprise-grade counterparts. This represents a dramatic escalation from 45% in 2024. Even more concerning is the candid admission from 61% of managers that AI is being actively used in their workplaces even in direct violation of explicit company prohibitions. This suggests a near-total collapse of traditional IT policy enforcement in the face of the sheer accessibility and seductive power of modern generative AI.

The drivers of this shadow culture are twofold. Firstly, there is a perceived vacuum in the provision of official, sanctioned tools. Employees, eager to enhance their productivity, turn to what is readily available. Secondly, and more subtly, there is a misplaced and dangerous sense of user competence. Many employees now view AI tools as their most trusted source of information, ranking them almost on par with their direct managers and significantly higher than their colleagues or even traditional search engines. This high degree of trust correlates directly with unauthorised usage; the more an employee trusts a tool, the more likely they are to integrate it into their daily workflow without seeking permission or considering the consequences.

This behaviour is compounded by what experts have termed the ‘Confidence Paradox’. This paradox describes a situation where an employee’s increasing awareness of AI-related risks ironically boosts their confidence in their own ability to make individual judgements about those risks, leading them to disregard corporate policy. Users who report a solid understanding of security requirements are, counterintuitively, statistically more likely to use unapproved tools. They believe they are capable of mitigating the risks themselves, making calculated decisions that ultimately expose their organisations to enormous liability. This finding implies that standard security awareness training is not only insufficient but may be inadvertently empowering employees to take unauthorised risks with highly sensitive corporate and personal data.

The consequences of this shadow culture are no longer theoretical; they are manifesting in real-world data breaches. Over the past year, there has been a doubling in the number of incidents where users have sent sensitive data to public AI applications. The average Irish company now experiences approximately 223 such incidents every single month. These breaches are silent and insidious. Unlike a ransomware attack that announces its presence with a locked screen and a ransom note, this data exfiltration happens quietly. A company may not realise its confidential financial forecasts, its proprietary product roadmaps, or its sensitive legal strategies have been absorbed into a third-party’s training dataset until the damage is done and utterly irrevocable.

The Data Trail: A One-Way Ticket to US Jurisdiction

A critical blind spot for the majority of Irish businesses is the physical and legal journey their data undertakes the moment an employee submits a query to an AI platform. Most of the popular and easily accessible AI tools, including the consumer versions of ChatGPT, Gemini, and Claude, are built upon cloud infrastructure that is overwhelmingly based in the United States. The instant an employee in Dublin, Cork, or Galway inputs personal or proprietary information into one of these free tools, a ‘restricted transfer’ under the GDPR is triggered. This single act initiates a complex chain of legal and technical events for which the organisation is ultimately liable.

In the consumer or free tiers of these platforms, the terms of service are explicit: the provider typically reserves the right to utilise user prompts and the resulting outputs to train and improve their models. This creates what legal experts describe as the ‘irrevocability problem’. Once data is incorporated into an AI model’s parameters through the training process, it becomes technically labyrinthine, and often practically impossible, to fully delete or isolate. This reality stands in direct and fundamental contradiction to the GDPR’s ‘Right to Erasure’ (Article 17), which grants individuals the right to have their personal data deleted. While a user can delete their prompt history, the essence of their data may live on, embedded within the very fabric of the model itself.

While enterprise-grade solutions such as ChatGPT Enterprise, Microsoft Copilot, or Gemini for Google Cloud offer a degree of salvation through isolated instances and contractual ‘no-training’ guarantees, the high prevalence of shadow AI means a significant volume of Irish corporate data is still being funnelled through these insecure consumer channels. Google’s Gemini, for instance, is noted for its deep and seamless integration with the Google Workspace ecosystem. While this offers powerful productivity benefits, it also heightens the risk of ‘function creep’—where data collected for a specific purpose, such as composing an email, is subsequently processed by an AI in ways that were never anticipated or consented to by the data subject.

This deep-seated reliance on US-based providers introduces a fundamental and unavoidable legal conflict. United States surveillance laws, most notably the CLOUD Act and Section 702 of the Foreign Intelligence Surveillance Act (FISA), grant US authorities the power to compel US-based firms to hand over data, even if that data is physically stored in data centres located within the European Union. This extraterritorial reach effectively nullifies the protections offered by geography. Simply selecting an ‘EU-region’ hosting option on a US cloud platform does not erect a fortress around the data that is impenetrable to US law enforcement and intelligence agencies. This stark reality, confirmed by the landmark ‘Schrems II’ ruling of the Court of Justice of the European Union, is now a central pillar of modern European data risk assessments.

GDPR Under Siege: The Compliance Conundrum

The Irish Data Protection Commission (DPC), as the lead supervisory authority for many of the world’s largest technology companies, has sharpened its focus on the regulatory challenges posed by AI. The DPC has publicly identified significant deficiencies in how companies are training and deploying Large Language Models (LLMs), emphasising that the ultimate responsibility lies with the organisation using the technology. Businesses must be able to demonstrate a clear understanding of what personal data an AI system processes, where that data is transferred when third-party providers are involved, and whether that provider retains or re-uses the data for its own purposes.

The integration of AI places immense strain on the core principles of the GDPR:

Lawfulness, Fairness, and Transparency: Organisations must establish a specific and valid legal basis for every single AI processing activity. If relying on the ‘legitimate interests’ basis, the organisation must clearly articulate this interest to data subjects and conduct a balancing test to ensure it is not overridden by their fundamental rights and freedoms. The DPC has already noted widespread deficiencies in the plans of many firms to use personal data for AI model training.

Purpose Limitation: Data collected for one purpose cannot be processed in a manner that is incompatible with that original purpose. Repurposing years of customer service chat logs to train a new customer-facing chatbot without a separate legal basis and a thorough impact assessment is a common and clear violation.

Data Minimisation: AI systems, particularly LLMs, are notoriously data-hungry, often demanding terabytes of information for effective training. This appetite directly challenges the GDPR’s requirement that data processed must be ‘adequate, relevant, and limited to what is necessary’ for the specified purpose.

Accuracy: LLMs are prone to ‘hallucinations’—producing outputs that are factually incorrect, biased, or entirely fabricated. If these inaccurate outputs are used in automated decision-making processes, such as credit scoring or recruitment screening, without robust human oversight, they can lead to significant harm for individuals and substantial legal liability for the organisation.

Storage Limitation: Without robust and enforceable data retention schedules, organisations risk non-compliance by allowing AI providers to store user inputs indefinitely, long after the initial purpose for processing has expired.

A glaring oversight among Irish firms is the systemic failure to conduct mandatory risk assessments. Under the GDPR, a Data Protection Impact Assessment (DPIA) is a legal requirement whenever data processing is ‘likely to result in a high risk to the rights and freedoms of natural persons’—a threshold that is almost invariably met by the introduction of powerful new AI technologies. A DPIA is not a mere box-ticking exercise; it must systematically describe the AI system’s purpose, data flows, and internal logic while rigorously identifying and mitigating risks such as allocative harm (e.g., discriminatory bias in a recruitment algorithm) or representational harm (e.g., the reinforcement of harmful stereotypes in generated content).

Concurrently, the ‘Schrems II’ decision mandates that organisations performing international data transfers to countries outside the EEA, such as the United States, must conduct a Transfer Impact Assessment (TIA). This assessment must critically evaluate whether the laws and practices of the destination country provide a level of data protection that is ‘essentially equivalent’ to that guaranteed within the EU. The DPC has set an exceptionally high bar for these assessments. Its recent inquiry into TikTok, for example, found that the company’s proposed technical and organisational supplementary measures were insufficient to fully compensate for the potential for government access to data in third countries.

The High Cost of Negligence: Landmark Fines and Looming Litigation

The financial and reputational consequences for Irish companies that neglect these complex data flow considerations are no longer hypothetical. The DPC’s recent enforcement actions serve as a stark and unequivocal warning to all businesses operating in Ireland. In 2024 alone, the DPC issued inquiry decisions resulting in administrative fines totalling €652 million. While this figure is down from the previous year’s record-breaking €1.55 billion, it signals a strategic shift towards more consistent and assertive regulation across a broader range of sectors.

The headline-grabbing fines against global tech giants have established critical precedents:

• Meta Platforms Ireland: A colossal €1.2 billion fine in 2023 for unlawful data transfers to the United States, directly addressing the ‘Schrems II’ compliance failures.
• TikTok Technology Ltd: A €530 million fine in 2025 for a combination of unlawful data transfers to China and failures in transparency regarding its data processing activities.
• LinkedIn Ireland: A €310 million fine in 2024 for the unlawful use of behavioural profiling to train its AI systems.
• OpenAI (ChatGPT): A relatively smaller but significant €15 million fine in 2025 for violations related to transparency and the handling of data subject access requests.

These fines are calculated as a percentage of a company’s global annual turnover, meaning that for large corporate groups, penalties can reach up to 4% of their worldwide revenue. Furthermore, the DPC has demonstrated its readiness to deploy its most powerful injunctive tools. In a landmark move, it invoked its emergency powers under Section 134 of the Data Protection Act 2018 for the first time against X (formerly Twitter). The action suspended the company’s plans to train its AI model, ‘Grok’, using the personal data of EU/EEA users until a compliant legal basis and appropriate mitigation measures could be established.

Beyond the threat of administrative penalties, Irish firms now face a dramatically increased risk of civil litigation. In a recent watershed ruling, the Irish Supreme Court removed a significant procedural barrier for individuals seeking compensation for data breaches. The court ruled that claims for ‘non-material loss’—such as mental distress, anxiety, or loss of control over one’s data—do not require prior authorisation from the Injuries Resolution Board. This decision not only makes it easier and faster for claimants to initiate legal proceedings in the Circuit Court but also extends the limitation period for such actions to six years. For a company that inadvertently leaks sensitive employee health records or confidential client information through an unvetted public AI prompt, the prospect of mass litigation, even without any demonstrable financial loss for the claimants, now represents a critical and potentially crippling business risk.

Intellectual Property in Peril: The Erosion of Trade Secrets

While GDPR compliance rightly dominates the regulatory discussion, the impact of unchecked AI usage on a company’s intellectual property (IP) is an equally existential threat. As ethical hacker Daniel Kelley astutely observed, the danger of shadow AI is that it is ‘not just leaking information, it’s leaking the thought process behind the information’. When employees input proprietary data into public AI tools, they are not merely risking a data breach; they are potentially nullifying the legal protections that safeguard their company’s most valuable assets.

Under the Irish European Union (Protection of Trade Secrets) Regulations 2018, information can only be protected as a trade secret if it meets three criteria: it must be secret, it must have commercial value because it is secret, and its owner must have taken ‘reasonable steps’ to keep it secret. The act of inputting sensitive business data—be it proprietary source code, a draft of a new financial strategy, or the formula for a new product—into a public AI tool can be interpreted by a court as a catastrophic failure to take those reasonable steps. Once that information is used to train a public model, it may be synthesised and reproduced in responses to other users, including direct competitors, thereby irrevocably stripping it of its legal status as a trade secret.

Furthermore, significant legal uncertainty clouds the ownership of works generated by AI. Irish law, specifically the Copyright and Related Rights Act 2000, attributes the authorship of a computer-generated work to the ‘person by whom the arrangements necessary for the creation of the work are undertaken’. However, it remains a highly contentious legal question whether the simple act of inputting a text prompt constitutes making the ‘necessary arrangements’. This ambiguity leaves businesses in a precarious position where marketing copy, software code, or research reports generated via AI may not be eligible for copyright protection, effectively placing them in the public domain for competitors to exploit without penalty.

The New Frontier of Risk: DORA, NIS2, and the EU AI Act

For organisations in regulated sectors like financial services and healthcare, the unvetted use of AI creates direct conflicts with a new wave of European legislation focused on operational resilience. The Digital Operational Resilience Act (DORA), effective from early 2025, and the Network and Information Security Directive 2 (NIS2) complement the GDPR by compelling organisations to manage the operational risks associated with their third-party IT suppliers and maintain data sovereignty.

Shadow AI usage represents a flagrant breach of these resilience standards. An organisation cannot manage the risk of a tool it does not know is being used. It cannot assess the data being shared, nor can it hold anyone accountable for a potential failure or security incident. Even if a data transfer were somehow deemed legal under a privacy framework, it could still fail a DORA audit if it creates a concentration risk or an unhealthy dependency on a single US-based provider, thereby compromising the firm’s ability to withstand a major ICT disruption.

As businesses grapple with these existing frameworks, they must also prepare for the phased implementation of the EU AI Act, which entered into force in August 2024 and began applying its initial provisions in February 2025. This landmark regulation introduces a risk-based approach to AI, with the most stringent requirements reserved for ‘high-risk’ systems. The penalties for non-compliance are even more severe than those under the GDPR, with fines for prohibited practices reaching up to €35 million or 7% of a company’s annual global turnover. A recent survey by law firm Arthur Cox revealed a worrying lack of preparedness, with 25% of Irish businesses still unclear on whether they are classified as an AI ‘provider’ or a ‘deployer’ under the Act—a distinction with profound legal consequences. A further 38% have yet to assign formal responsibility for AI oversight to a specific individual or function within their leadership team, creating a governance vacuum that will inevitably lead to misclassification and non-compliance.

A Roadmap for Responsible Innovation: From Experimentation to Accountability

To navigate this treacherous landscape and mitigate the severe risks of data exfiltration and regulatory failure, Irish organisations must urgently pivot from a culture of haphazard experimentation to one of strategic, top-down accountability. The old computing principle of ‘garbage in, garbage out’ is being reimagined for the AI era as ‘governance in, value out’.

The first step is to move beyond simple prohibition, which has proven ineffective and merely drives usage underground. Instead, organisations must adopt a managed provisioning model. This involves creating an approved repository or ‘whitelist’ of enterprise-grade AI tools that have undergone a rigorous TIA and DPIA. Access to these tools should be managed through corporate credentials, not personal accounts, to ensure visibility and create automated audit trails. Crucially, this must be paired with technical controls, such as data loss prevention (DLP) systems, that can identify and block the transmission of sensitive data categories to unauthorised AI endpoints.

Secondly, organisations must address the ‘upskilling divide’. AI literacy is no longer a soft skill; under the AI Act, it is fast becoming a legal obligation for both providers and deployers. Training must evolve beyond basic security awareness to encompass sophisticated prompt engineering safety—teaching staff how to leverage AI’s power without inputting identifying or proprietary information. It must also instil a culture of critical verification. The recent Oliveira v Ryanair case, where AI-generated ‘phantom citations’ of non-existent legal precedents were submitted to the Workplace Relations Commission, serves as a potent warning against the uncritical acceptance of AI outputs.

Ultimately, the surge of AI adoption in Ireland has far outpaced the erection of the necessary guardrails. The promise of a €250 billion economic windfall is tantalising, but it rests on a volatile foundation of unregulated data flows and unchecked shadow AI practices. The Irish Data Protection Commission has made it abundantly clear through its landmark enforcement actions that complexity is not an excuse for non-compliance. As the EU AI Act moves towards full application, the era of unmanaged experimentation must come to an abrupt end. The challenge for the Irish corporate sector is to transition from a state of ‘one-eyed kings’—where individual employees act with autonomous but limited vision—to a state of ‘collective sight’, integrating AI through a unified lens of data sovereignty, operational resilience, and profound ethical responsibility. Only by meticulously securing the path of every single query can Irish firms hope to sustainably and safely realise the truly transformative potential of artificial intelligence.