Generative AI Policy for Employers in Ireland: What to Cover

In our view, a generative AI policy for employers in Ireland should say which tools staff may use, what information may go into them, who checks the output, and who is responsible. None of the sources we read sets out a template for a generative AI policy or requires private employers to have one. What we can do is summarise what Irish official bodies have published and show how an employer might turn it into a policy. In this article, items that come from an official page are attributed to it, and items that are our own ideas are marked "Our suggestion." Nothing here is legal advice.

The main sources are the Data Protection Commission (DPC) blog "AI, Large Language Models and Data Protection" (18 July 2024), the DPC's AI Insights Report (the DPC pages are dated 24 and 25 September 2026), the Irish Government's Guidelines for the Responsible Use of AI in the Public Service on gov.ie, the Department of Enterprise's page "The EU AI Act and my organisation" (last updated 27 May 2026), and the European Commission's AI literacy Q&A (last updated 27 July 2026). For more on the DPC material, see our summary of the DPC guidance on AI and large language models.

What the DPC says organisations using AI products should consider

The DPC blog sets out key points for organisations that use AI products, which it distinguishes from developers and providers. In summary, it says deployers should:

• Assess before adopting: identify what personal data is involved, how it is used, where it goes (especially to third parties), whether the provider keeps or reuses it, and how the product supports GDPR compliance.
• Check whether they are a controller and, if so, consider a formal risk assessment.
• Review the provider's documentation, which should be clear and accessible.
• Plan to handle data subject rights requests, including access and deletion, for data held within the AI system.
• Understand how data entered by staff or users is protected, by the organisation and by the supplier.
• Be aware that models can reproduce personal training data and that filters meant to block content can be circumvented.
• Consider human review, because the DPC says relying on inaccurate or biased outputs without critical human analysis or intervention may introduce automated decision-making risks.
• Set retention rules, because without a retention schedule storage limitation may not be met.

In the section of the same blog addressed to AI product designers, developers and providers, the DPC says a data protection impact assessment may be required, especially where the technology or processing is new, datasets are combined or personal data of minors or vulnerable people is used, and that it would be best practice to carry one out anyway.

The DPC's more recent AI Insights Report reviews its supervision of AI products and services from 2021 to 2025. The DPC says it engaged with controllers on about 180 AI products and services and highlights two focus areas: legitimate interests as a legal basis for AI training, and transparency for complex processing. We have not drawn employer rules from it, because the DPC pages we read describe its supervision findings rather than setting out employer guidance.

What the Government's public service guidelines say

The gov.ie page for the Guidelines for the Responsible Use of AI in the Public Service says they aim to help public servants use AI while keeping the human central, and refers to Government's Principles for Responsible AI, a decision framework, a Responsible AI Canvas tool and AI lifecycle guidance. The page shows no date. We also opened the PDF, which shows no date in the text we could read, and our reading was incomplete, so we have not read every chapter (including the section for end-users of free generative AI tools). From the parts we read, the guidelines:

• Set seven principles, including human agency and oversight, privacy and data governance, transparency, and accountability.
• Say AI tools must sit within a process with human oversight, that generated material must be critically reviewed for accuracy, and that "AI tools can assist human capabilities, but they should never replace them."
• Advise against incorporating generative AI into business processes without an approved business case, and say staff access should not be permitted until departments complete business and risk assessments, have usage policies and run staff awareness programmes. They cite the National Cyber Security Centre's recommendation that access be restricted by default.
• Say that at every stage of an AI system's development and operation there will be a person responsible, and that audit trails should be kept.
• Say users should be told when they interact with an AI system or when content is AI-generated.

These guidelines are written for the public service. A private employer is not bound by them, but they show how Government approaches the subject.

What the AI Act pages add

The Department of Enterprise's page for organisations lists suggested steps that include mapping the AI you use, setting up governance such as internal policies for responsible AI use, which may include assigning responsibility for AI oversight, meeting transparency duties, training staff and checking vendors. The Commission's AI literacy Q&A says Article 4 requires providers and deployers to take measures to support staff AI literacy, with no certificate or test required and no specific governance structure mandated. Together, these suggest a policy sits naturally alongside staff training. For the transparency side, see our explainer on Article 50 transparency and labelling obligations.

Turning the sources into policy sections

The table below shows where each suggested section comes from. Entries marked "Our suggestion" are our own drafting ideas.

A practical approach (our suggestions)

• Keep the policy short enough that staff will read it. A one-page summary with a longer appendix works better than a long document.
• Give examples relevant to each team, such as drafting, summarising meetings or analysing spreadsheets, rather than abstract rules.
• Decide what happens when someone breaks the policy, and align it with your existing disciplinary procedure and data protection policies.
• Name an owner and a review date, since the rules and tools are changing quickly.
• Pair the policy with training so staff understand the reasons behind it. Our guide to GDPR staff training for employers may help with the data protection side.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does Irish law require a generative AI policy?

None of the sources we read says that a written generative AI policy is mandatory for private employers. The Department of Enterprise page suggests internal AI policies as part of governance, and the Commission says no specific governance structure is mandated under Article 4.

Can staff put customer or client personal data into public AI chatbots?

The DPC blog says organisations should understand what personal data is involved, where it goes and whether the provider retains or reuses it. It does not give a blanket yes or no. Our suggestion is that a policy should state clearly what categories of data are not to be entered.

Do we need a data protection impact assessment?

In its section for developers and providers, the DPC says a DPIA may be required, especially where technology is new, datasets are combined or personal data of minors or vulnerable people is used, and that carrying one out is best practice anyway. The blog does not address employers using a chatbot specifically, so take advice on whether one is needed for your processing.

Are the public service guidelines binding on private employers?

No. They are written for the public service. We use them as an example of Government thinking.

Should the policy mention the EU AI Act?

The Department of Enterprise page suggests tracking updates and training staff. Our suggestion is to reference the Act in the policy only at a high level and review it as the rules develop.

A generative AI policy is easiest to maintain when it is short, specific and owned by a named person, and when it is reviewed as the official guidance evolves.