Product Design and Governance in Ireland: Central Bank Guide

Ireland's revised Consumer Protection Code, in force from 24 March 2026, does not read like a classic product governance rulebook. When we read the Central Bank's published text, we found product design duties spread across the Standards for Business and a small set of duties aimed at product producers. This guide sets out what those provisions say, how they connect, and what a firm can do with them. It sits alongside our course overview on product governance and target markets.

What the rules are and when they apply

According to the Central Bank of Ireland, the Consumer Protection Code 2025 has two parts: the Standards for Business Regulations 2025 and the Consumer Protection Regulations 2025. The Standards for Business are Statutory Instrument No. 80 of 2025, dated 24 March 2025, and came into force on 24 March 2026 after a 12-month implementation period. The Central Bank says its stated aims include requiring firms to factor customer interests into strategy and decisions and giving firms clearer, more predictable obligations.

Product design in the Standards for Business

Section 5 of the Standards for Business is titled securing customers' interests. Reading the Central Bank's text, three items bear directly on product design:

• Item 1: a firm must build its culture, strategy, business model, decisions, controls and processes around customer interests. Product decisions are decisions, so they fall within this.
• Item 3: customer interests must be considered when designing services and the way they are delivered.
• Item 4: a firm must not design services that exploit customers' behaviours, habits, preferences or biases in ways that harm them.
• Item 9: a firm must deliver fair outcomes for customers.

Item 4 is the most operational. It asks firms to look at how a product behaves in the hands of real customers, for example whether a feature depends on inertia or on a predictable bias to generate revenue, and to avoid designs that cause harm in that way. The text we read does not define harm further, so firms should record how they have interpreted it.

Distribution and advice

Section 8 of the Standards for Business covers acting in customers' best interests and treating them fairly and professionally. In the text we read, it requires a firm to assess customers' needs, circumstances, knowledge and experience, and the range of options it can offer, and to ensure any advice or recommendation is appropriate and tailored to the customer.

Governance, delegation and outsourcing

Section 11 covers controlling and managing a firm's affairs. Its items require adequate resources and effective governance of policies, procedures, systems and controls (including compliance checks), suitable staff training on the legal and regulatory framework, delegation of tasks to appropriate people with effective oversight, and effective management of outsourced activities by identifying, monitoring and managing outsourcing risk. Section 14 on systems and controls adds that a firm must put in place systems, controls, processes and policies to ensure compliance with the Regulations, including by agents acting for it under outsourcing arrangements. Where a product is built or distributed with third parties, these are the provisions that make the firm answerable for them.

Section 10, on financial abuse, adds a monitoring duty that is useful for product teams: firms must continuously monitor vulnerabilities in services and distribution channels and escalate where risk rises.

Duties on product producers

The Consumer Protection Regulations 2025 define a product producer as a regulated entity that produces, manufactures or packages a product of a financial or investment nature. Two duties are clear in the text we read:

• Regulation 65 (information): a producer must design the information it provides for its products so that consumers can readily understand it, having regard to the target market for the product. The requirement must be built into the producer's product and service design processes, and the producer must have a process to regularly review, test and monitor whether the information works. Our guide to informing customers effectively under regulations 44 to 70 covers the wider information rules.
• Regulation 26 (commission): where a producer pays an intermediary commission based on the levels of business provided, it must ensure the arrangement does not undermine the intermediary's duty to act in consumers' best interests or create a conflict of interest between the intermediary and a consumer.

The Central Bank's table of contents also lists headings for further producer duties for investment products, including a statement on investment products, an information document after a tracker bond sale, and a chapter on product producer responsibilities for giving information on new investment products to intermediaries. We saw only the headings of those provisions.

Our suggestions for a product governance file

These are Learnsignal's suggestions, not Central Bank requirements. Keep one record per product that shows who the target market is, how customer interests were weighed at design stage, how you tested for exploitation of customer behaviour and bias, how the information was tested and when it was last reviewed, which third parties distribute or administer it and how they are overseen, and what monitoring of distribution channels is in place. Review each record on a set cycle and when complaints or errors suggest a pattern. Staff who work on products can build the underlying knowledge through Learnsignal CPD.

What we could not confirm

We did not find a regulation headed product oversight, product approval or product review in the portions of the Central Bank text we could read, but we could not read the full Consumer Protection Regulations or the Central Bank's guidance documents (including the securing customers' interests guidance), so such provisions may exist elsewhere. We did not read the text of the producer provisions for investment products beyond their headings. Product governance rules that come from other regimes, such as those for specific investment services or insurance distribution, were outside what we reviewed, and firms should check whether they apply.

Frequently asked questions

When did the revised Consumer Protection Code take effect?

According to the Central Bank, the Standards for Business Regulations 2025 came into operation on 24 March 2026.

Does the Code define a product producer?

Yes. The Consumer Protection Regulations 2025 define it as a regulated entity that produces, manufactures or packages a product of a financial or investment nature.

Can a firm outsource product administration and avoid responsibility?

The Standards for Business require outsourced activities to be managed by identifying, monitoring and managing outsourcing risk, and require systems and controls to cover agents acting under outsourcing arrangements.