I need to make statement at the outset to advise members of the constitutional requirement that they must be physically present within the confines of the Leinster House complex in order to participate in public meetings. I will not permit a member to participate where they are not adhering to this constitutional requirement. Therefore, a member who attempts to participate from outside the precincts will be asked to leave the meeting. In this regard, I ask any member partaking via Microsoft Teams that prior to making their contribution to the meeting they confirm that they are on the grounds of the Leinster House campus.

Members and witnesses are reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as to make him, her or it identifiable, or otherwise engage in speech that might be regarded as damaging to the good name of the person or entity. Therefore, if their statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks, and it is imperative that they comply with any such direction.

I propose we publish on the committee's website the opening statements, briefing documents and the letter from the Minister provided by the witnesses. Is that agreed? Agreed.

I suggest we invite our witnesses to speak for approximately ten minutes and that we allow members to ask questions or make comments for approximately seven minutes each. We may have a second round of questions and members will be allowed five minutes. Members or substitutes may be called as they appear on the speaking rota which was circulated. Committee members may substitute within their party or group. Attendees who are not members of the committee or substitutes may speak after committee members or substitutes. Is that agreed? Agreed.

We are here to deal with pre-legislative scrutiny of the general scheme of the regulation of artificial intelligence Bill 2026 and the general scheme of the data Bill 2025. In accordance with Dáil Standing Order 181 and Seanad Standing Order 154, the Minister for Enterprise, Tourism and Employment, Deputy Burke, referred the two general schemes to the committee for pre-legislative scrutiny on Wednesday, 28 January 2026. Before deciding whether to carry out pre-legislative scrutiny of either or both these general schemes, either together or separately, the committee decided to meet with officials from the Department of Enterprise, Tourism and Employment. While there is no overlap in the provisions of these general schemes, the Minister's intention is to combine these general schemes into one Bill. I ask everyone to note that as this general scheme was received by the committee on Wednesday, 28 January 2026, the eight-week period in Standing Order 181 will run until Wednesday, 25 March 2026.

I welcome officials from the Department of Enterprise, Tourism and Employment. We are joined from the data economy regulation and data centres unit by Ms Ciara Bartley and Ms Máire Ellen O'Connor, and from the AI and digital regulation unit by Mr. Declan McCormack, Ms Kathy O'Donoghue and Mr. Santosh Aryal.

I am going to invite our witnesses to make their opening statements. I will start with Ms Bartley whose statement will be on the general scheme of the data Bill 2025.

I thank the Cathaoirleach and members of the committee for the invitation to speak with them today as part of their consideration as to whether the committee wishes to undertake pre-legislative scrutiny of the general scheme of the data Bill. I am principal officer in the data economy policy and data centres unit of the Department of Enterprise, Tourism and Employment. I am joined by my colleague, Ms Máire Ellen O’Connor, who is assistant principal in the same unit. We welcome the opportunity to set out the purpose of this legislation and the context in which it has been developed.

The general scheme of the data Bill provides the national measures necessary to give full effect to the EU regulation known as the Data Act, so it needs to be read in tandem with that Act. While the majority of the obligations in that regulation apply automatically, certain elements require domestic legislation. These measures relate chiefly to designation of competent authorities, enforcement powers, administrative financial sanctions and the resourcing model for ComReg in undertaking its new regulatory functions. I emphasise at the outset that the Bill does not go beyond what is required by the regulation. Its provisions are designed solely to ensure that Ireland meets its legal obligations under EU law and that the relevant competent authorities, in this case, ComReg and the Competition and Consumer Protection Commission, are properly empowered to perform the roles assigned to them under the Data Act.

The Data Act regulation is one of the central pillars of the EU’s data strategy. It entered into application on 12 September 2025 and establishes harmonised rules on fair access and use of non-personal data. At the heart of the Data Act is a simple but transformative ambition: to democratise access to data and unlock a genuine EU-wide data economy.

The Act recognises that data has become the new gold. It is an essential resource that powers innovation, competitiveness and public value. Today, much of that value is concentrated in the hands of a limited number of manufacturers and service providers. By establishing clear rights for users to access and share the data generated by connected products and services, the Data Act seeks to rebalance this landscape. It aims to ensure that the economic and societal benefits of Europe's data are more widely shared across businesses, consumers and public bodies. In doing so, it lays the foundation for a more dynamic, fair and resilient digital economy across the Union.

The regulation contains four principal components. The first is access to data from connected products. Users of connected devices must be able to easily access the data generated by their connected devices and to share it with a third party of their choice. Contracts governing such data sharing must meet fairness standards set out by the Act. This means, for example, that a homeowner using a smart heat pump must be able to download its performance data and instruct the manufacturer to share that data directly with an independent repair service. The second component is switching between cloud and other data-processing services. The regulation promotes competition in cloud and data-processing markets by obliging providers to facilitate switching and interoperability, reducing vendor lock-in and enabling integration across different services. This means, for example, that an Irish SME using one cloud provider for data storage must be able to transfer its datasets and applications to another provider without undue delay, hidden charges or technical barriers. The third aspect is business-to-government data sharing in situations of exceptional need. In clearly defined circumstances, such as national or regional emergencies, data holders must provide relevant data to public sector bodies that demonstrate an exceptional need for it. This could mean that, during a public health incident, a pharmaceutical distributor may be required to provide stock level and supply chain data to the Department of Health to support urgent planning and allocation decisions. The fourth aspect regards safeguards for international transfers of non-personal data. The Act requires data holders to implement measures to protect Union-based non-personal data from unlawful governmental access by third-country authorities and sets out the assessment they must undertake when responding to foreign disclosure orders. This means, for example, that a cloud provider hosting Irish non-personal industrial data must assess and, where necessary, refuse a foreign authority's disclosure request if it conflicts with EU law or risks unlawful access.

The general scheme provides the domestic legislative framework required to implement and enforce the Data Act regulation in Ireland. As the regulation operates under the country of origin principle, Ireland will act as lead regulator for companies headquartered here whose operations fall under the scope of the Act. The key elements of the general scheme are as follows. The Competition and Consumer Protection Commission will be designated as the competent authority for business-to-consumer, business-to-business and business-to-government data-sharing obligations, and for unfair contractual terms relating to data access and use. ComReg will be designated as the competent authority for regulating switching between data-processing service providers and interoperability of data-processing services. A further designation will be required in respect of Chapter VII of the regulation, which concerns unlawful international governmental access to non-personal data. Chapter VII engages highly sensitive matters touching on national security, defence and international legal co-operation, and therefore it is not a straightforward regulatory assignment but one that spans justice, security, foreign affairs and data-processing oversight. Because of that complexity, a final designation has not yet been made. While I recognise that this is not ideal, the underlying policy is already set in the regulation. What remains to be settled is agreeing the most appropriate and effective national enforcement structure, and work is well under way in this regard.

The Bill provides the necessary powers for the designated competent authorities to receive and investigate complaints, conduct investigations, require information, issue compliance notices and impose administrative financial sanctions for breaches of the regulation. The Bill sets maximum financial penalties of up to 4% of a company's EU-wide turnover in the preceding year with an additional cap of €500,000 in cases where turnover is not an appropriate basis for calculation. This level is appropriate because it is significant enough to ensure compliance while proportionate to the type of obligations involved, many of which relate to technical access rights, interoperability and cloud switching rather than behaviour causing direct consumer harm. The Bill provides for the introduction of an industry levy to meet ComReg's expanded regulatory responsibilities, consistent with existing levy-based funding models. The Bill includes procedural measures relating to service of documents, complaints mechanisms, certification of independent out-of-court dispute settlement bodies and the role of a national data co-ordinator. Again, I reassure the committee that these provisions reflect the minimum measures needed to operationalise the regulation. They do not create any new obligations beyond those already set out in EU law.

The committee may be aware that, in November 2025, the European Commission published its digital omnibus proposal. The proposal forms part of the Commission's wider programme to simplify and streamline the EU's regulatory framework. The digital omnibus has proposed a range of amendments to the Data Act regulation, the most significant of these being the consolidation of three legislative instruments into a single restructured Data Act regulation. The digital omnibus proposal does not affect Ireland's Data Act implementation requirements in respect of the general scheme of the data Bill. It is important to note that the digital omnibus remains a proposal and is therefore subject to ongoing negotiations and changes through the EU legislative process. The timeline for full agreement of the data elements of the digital omnibus is expected to extend beyond 2026. In light of the evolving nature of the proposal and potentially lengthy legislative process, we believe it is most prudent to continue working to implement the agreed and currently applicable Data Act regulation. The general scheme of the data Bill provides the essential national measures required to implement and enforce the EU Data Act. It ensures that Ireland meets its EU obligations, supports the effective functioning of the digital Internal Market and equips our competent authorities with the tools they need - no more and no less - to uphold the regulation. My colleague, Ms O'Connor, and I are happy to assist the committee in its deliberations and to answer any questions it may have.

I thank the committee for the invitation to appear before it today regarding the general scheme of the regulation of artificial intelligence Bill 2026. I am principal officer for the AI and digital regulation unit of the Department of Enterprise, Tourism and Employment. I am joined today by my departmental colleagues, both of whom are assistant principals also in the AI and digital regulation unit. We welcome this opportunity to support the committee's prelegislative scrutiny of this strategically important piece of legislation. Artificial intelligence is reshaping the global economy, enabling innovation, competitiveness and helping to tackle some of the most pressing challenges of our times. While the full impact of this transformational technology is still unfolding, the potential of AI raises new questions about ethics, safety and societal impact. Trustworthy and human-centric AI is both pivotal to promote its uptake for driving economic growth and crucial for preserving the fundamental rights and principles that underpin our society. The general scheme for the Bill before the committee today is required to give effect to Ireland's implementation of the EU Artificial Intelligence Act. The AI Act, as the EU regulation is more commonly referred to, provides a consistent and high level of protection of European citizens' health, safety and fundamental rights and provides certainty for operators on the rules to ensure the development, provision, deployment and use of human-centric and trustworthy AI in the EU. As a regulation, it is directly applicable and binding in all EU member states without needing to be transposed into national law. This ensures uniform rules for artificial intelligence across the EU.

Although the AI Act is directly applicable in all member states, it also imposes obligations that do require national implementing measures. These include designating the national competent authorities required for the supervision and enforcement of AI regulations, establishing a national single point of contact for the AI Act, ensuring the establishment of a national AI regulatory sandbox, creating an administrative sanctions regime for penalties and other enforcement measures consistent with Article 99 of the AI Act, which sets out penalties for non-compliance and empowering regulators with investigative and enforcement powers.

In Government decisions of 4 March 2025 and 22 July 2025, the Government agreed to adopt a distributed model of competent authorities for the purposes of the regulation of AI in Ireland. Fifteen public bodies have been designated as competent authorities across various sectors and products including financial services, health products, and transport, reflecting the horizontal nature of the potential uses of AI. The Government also agreed that a new entity would be established under the aegis of the Department of Enterprise, Tourism and Employment to act as a central co-ordinating authority for the purposes of the AI Act.

The proposed general scheme does not seek to further designate public bodies as competent authorities beyond what has been agreed to in the aforementioned Government decisions. However, we recognise that further designations may prove necessary as AI systems become more deeply integrated across a wider range of sectors. Accordingly, it will be essential to maintain a framework that is capable of adapting in a timely and flexible manner to future developments and emerging supervisory needs. The majority of the general scheme of the regulation of artificial intelligence Bill primarily empowers the national competent authorities to give effect to a robust and effective model of regulation that ensures Ireland can meet its obligations under the EU AI Act.

In considering the basis for the scheme of the Bill, it is important to note the role of two EU regulations that underpin it, those being the aforementioned AI Act and the market surveillance regulation of 2019. The AI Act entered into force on 2 August 2024 and lays down a uniform legal framework for trustworthy AI systems in the European Union. It is the first ever comprehensive legal framework on AI worldwide. The Act classifies AI systems based on the level of risk they pose to society, banning those with an unacceptable risk, applying stringent obligations in relation to high-risk AI systems and laying down specific transparency requirements on certain AI systems where, for example, there is a potential risk of manipulation, impersonation or deception through the use of chatbots or deepfakes. There are also obligations relating to general purpose AI models for which the European Commission is the pre-eminent enforcement authority.

The AI Act distinguishes between two areas of application of high-risk AI systems, both of which are subject to the regulation. First, AI systems are deemed high-risk where they used as a safety component of, or are themselves, a product covered by the EU harmonised legislation for product regulation as listed in Annex I of the AI Act. Also deemed high-risk are AI systems intended for use in a range of use cases, such as in the operation of critical infrastructure or in evaluating the eligibility of persons to access certain essential services as listed in Annex III of the AI Act. Member states are primarily responsible for the supervision and enforcement of the AI Act with regards to prohibited AI practices, high-risk AI systems and those AI systems that must meet transparency requirements. The enforcement of the rules on prohibited practices, high-risk AI systems listed under Annex III, and transparency rules, are due to come into effect on 2 August 2026. The rules on high-risk AI systems according to Annex I, which are those systems linked to existing regulated products, are due to come into effect on 2 August 2027.

The AI Act is grounded in existing EU product regulation. It does not create a new enforcement system but plugs into the EU’s existing market surveillance regulation, which governs how regulators supervise and enforce compliance for products placed on the EU market. The market surveillance regulation provides a core enforcement toolbox including inspections, information requests, testing and corrective measures. It also facilitates co-operation across Europe between market surveillance authorities and through an EU product compliance network. The AI Act relies on these same mechanisms because AI systems, like other products and services, can easily circulate throughout the European Union. AI systems must comply with essential requirements pursuant to their risk level before being placed on the market and regulators oversee them using a market surveillance model.

The general scheme of the regulation of artificial intelligence Bill provides the legislative foundation by conferring market surveillance powers to the designated competent authorities to ensure that the AI Act can be effectively implemented within our national system of regulation. More information on the AI Act and its obligations has been provided in a briefing note. If there is anything more that members need, we would be happy to provide it to them.

The general scheme is structured into eight parts. Part 1 sets out definitions, commencement provisions and interpretative rules to ensure full alignment between national law and the terminology and structure of the EU AI Act. Part 2 of the general scheme establishes "Oifig Intleacht Shaorga na hÉireann", the "AI Office of Ireland", as an independent statutory body under the aegis of the Department of Enterprise, Tourism and Employment. The AI office of Ireland will serve as Ireland’s single point of contact and will facilitate national co-ordination with the European Commission. It will act as the central co-ordinator for all national competent authorities for the purposes of the regulation of AI and will host the national technical expertise to support regulators. It will be the entity to ensure the establishment of a national AI regulatory sandbox and it will be the maintainer of the national register of certain AI systems. Part 3 of the scheme provides the designated competent authorities with the powers they need under the AI Act and the market surveillance regulation. Part 4 sets out the investigative roles and powers for competent authorities and are modelled on long-established frameworks in product safety and competition law. Part 5 establishes a sanctions regime aligned with Article 99 of the AI Act, including:significant financial penalties for serious breaches. Part 6 formalises the role of Ireland’s notifying authorities in designating and monitoring conformity assessment bodies for AI systems. Part 7 provides a mechanism for enabling levy-based funding models, where appropriate. Part 8 of the scheme provides a provision to enable necessary amendments to other Acts.

Before concluding, I would like to address the ongoing digital omnibus work being led by the European Commission as it is also relevant context for the committee. In November 2025, the Commission published the digital omnibus on AI proposal. The proposal sets out targeted measures to simplify certain provisions of the AI Act based on comprehensive multi-stakeholder consultation by the Commission and are intended to ensure the timely, smooth, and proportionate implementation of the AI Act across the EU. It is important to note that the digital omnibus on AI is still a proposal currently under negotiation between the European Parliament and the Council. It does not affect Ireland’s current obligations under the AI Act, nor does it lessen the need to progress this national legislation ahead of the implementation phase of the AI Act in August 2026. If simplification measures are adopted through the omnibus proposals later in 2026 that have implications for national legislation, the general scheme is drafted in a way that will allow us bring forward any targeted amendments required at that point.

The main supervision and enforcement provisions of the AI Act are due to come into force in August 2026. National competent authorities are designated and making the necessary provisions to ensure readiness. The general scheme of the regulation of artificial intelligence Bill 2026 aims to provide a strong, proportionate and future-proofed foundation for Ireland’s implementation of the EU AI Act. This, in conjunction with the EU AI Act, safeguards public interests, supports enterprises, especially SMEs, and reinforces Ireland’s position as a trusted centre for digital innovation. I would once again like to highlight that AI is already embedded across our economy and society, from healthcare and transport to online platforms, financial services and public administration and its impact will only deepen in the years ahead. As a small, open economy that hosts many of the world’s leading technology firms, including developers of foundation models, timely progression of this Bill is vital to meet our obligations under the EU AI Act and to ensure that Ireland remains the location of choice for AI investments and innovations. I look forward now to addressing any questions members may have on these matters.

I thank Mr. McCormack very much. I thank Senator Fitzpatrick for standing in briefly this morning. It is much appreciated. I now invite the first speaker, Deputy Conway-Walsh.

I thank the witnesses for their statements. This is obviously critical legislation. We have missed the 12 September deadline for implementing the EU Data Act, despite the fact of the country of origin principle that this State would act as lead regulator for many of the leading multinational tech companies.

At the same time this legislation places significant new investigative enforcement responsibility on ComReg and on the CCPC, including cross-border co-operation and the imposition of substantial administrative sanctions. In that context, please outline what enforcement gaps currently exist, what interim arrangements are in place and how we are ensuring the ComReg and CCPC are adequately staffed and resourced, and technically equipped to fulfil those expanded roles effectively? Also, please confirm by what date it is expected that full investigatory and sanctioning powers will be operational?

I assume the questions are for my colleague, Ms Bartley.

Yes. Unfortunately, the Deputy is right that the deadline of 12 September has been missed but as the regulation is directly applicable, its provisions apply. The regulation contains provisions for individuals, where they cannot get a suitable outcome from a competent authority, to pursue a court settlement or take a court action. That is an option that is available to individuals.

ComReg and the CCPC do not have enforcement powers at the moment but, through the European Data Innovation Board, they can still co-operate with their competent authorities. The EDIB is an EU body that was established through the Data Governance Act. Of course ComReg and CCPC will not be able to enforce anything until the legislation is in place. They will have their full sanctions available to them once that legislation is in place. That is why there is a need. It is one of the reasons the Minister intends to join the two pieces of legislation and I think that is because the Data Act will progress on a more certain timetable when it is joined with the artificial intelligence Bill.

On resourcing, I will take the CCPC and ComReg in turn. The elements the CCPC is regulating are distinct from the elements that ComReg is regulating. The CCPC elements relate to data sharing. The intention of them is to stimulate or create a data economy and an innovation economy. The CCPC has established a digital regulation division or unit. This is novel legislation so it is difficult for the commission to assess what the precise requirements will be in terms of resourcing at the moment but the CCPC has secured resources through the 2026 Estimates process. On the other hand, ComReg will be resourced through its levy. Members will note that the general scheme contains a provision for a levy. ComReg does not receive Exchequer funding. Again, ComReg has done a good deal of work to identify the resources that it will need, which will include things like cloud engineers and data analysts, and they are currently with their parent Department, which is the Department of Culture, Communications and Sport, for consideration at the moment. In the interim, because this legislation has not been introduced, ComReg has been provided with interim funding to allow it to continue this work for this year.

Obviously the 4% is at the lower end when compared with other member states. How was a rate of 4% arrived at and have comparables been done for the other EU states?

There is. This one of the causes for the delay in legislation. The legislation provides that turnover may be an appropriate basis for penalties. It also provides that penalties should be harmonised across member states and that the EDIB group should give guidance but the guidance was extremely slow to arrive.

On the rate of 4%, we engaged with other member states and looked at comparable legislation. Most of the other digital legislation sets out the maximum level of penalties. Other member states, like Ireland, have found it challenging to implement this legislation on time. Of the member states that we are aware of, the maximum penalties appear to range between 3% and 5%, and there is one outlier at 10%. We believe that a rate of 4% will put Ireland firmly in the middle. It should be noted that that is the maximum level of penalties that will apply. The regulation contains a provision that states any penalties should be proportionate to the infringement, which is particularly significant in the Data Act because of the broadness of areas being regulated. It is regulating maybe potential harms in the cloud sector but actually trying to stimulate that data economy more in the connected devices aspect.

It is important to provide for smaller companies but is that enough of a deterrent for the huge multinationals and that they will not just work it into their cost of doing business?

From what is publicly available, most of the cloud aspects apply to data processing service providers that are based in Ireland. Several of them, and long before the deadline, have said they had removed the egress and switching fees ahead of the deadline. With any good regulation we are hopeful that it will not come to a point of penalties but the level that we have chosen puts Ireland in the same category as many of the other member states. Yes, we believe it is proportionate.

It provides for written policy directions to the AI office of Ireland from the Minister. How can we ensure that there is operational independence around that in its enforcement and co-ordination functions? How is the balance struck between independence and co-ordination?

The AI office is being established as a statutory body. A CEO will be appointed to run its functions and ensure operational effectiveness. The CEO will be accountable to a board that will be appointed and accountable to the Committee of Public Accounts and other Oireachtas joint committees, as necessary. Its independence arises from its statutory establishment and the fact that it is accountable to the board and reporting to the board. That is the main thrust of its independence.

Perhaps other members will take up that matter. I am conscious of my time and will conclude there.

I thank everyone for being here today and for their work on these important pieces of legislation. AI affects all of our lives every moment of the day and its importance is not lost on this committee. EU compliance is an important piece. More important, is how AI will be operated and regulated and how it will have an impact on the lives of citizens. The remit of this committee is enterprise, tourism and employment and AI has enormous potential. If AI is harnessed in the right way then it will be incredibly powerful for us. I greatly support the work being done by the Department and I thank the officials.

On the establishment of the AI office, can the officials tell me its current status? Obviously this legislation has to progress and so on. Mr. McCormack has said that the AI office will be established on a statutory footing and will be accountable to a board and how the independence of its operations from Government will be asserted. It is important for citizens to understand that whosoever is in government will not have undue influence or powers in this space. What is the current recruitment, budget and headcount? What skill sets are required? Are there challenges in achieving success? Please paint a picture of what the AI office will look like once it is established. While I appreciate that we have a big piece of work to do in terms of pre-legislative scrutiny and getting the legislation through the Houses and we will do our part, I just want to know what the AI office will look like when it is done.

The office is already taking shape as for some time we have had an AI office unit within the Department. The unit has dedicated resources focused on mobilising and taking the initial steps in terms of the start-up phase of the AI office. As part of the budget 2026 process, €1.5 million was allocated to the start-up phase of the AI office of Ireland.

That implementation is progressing and work is under way to schedule the recruitment of the staff that are needed and look at the administrative aspects such as systems and processes. Leading up to this, a consultancy report was commissioned to set out what a structure and work programme might look like for the AI office. That was completed and it is the basis on which the office is being progressed.

Recruitment will cover a range of skills, including leadership at CEO level. Senior management roles will be initially recruited for legal, technical, corporate organisation skills and operational skills. The recruitment process has already started for some of those roles. Some are being scheduled and are with the Public Appointments Service committee. It is a challenging timeline but the response to the work, and certainly to the recruitment, has been good so far. It is an incredible opportunity for people to get involved at a ground level on this activity. We expect the office will be operational in a start-up mode by August 2026, as required by the Artificial Intelligence Act.

What is the projected budget for the office? I am not talking about the budget for the rent of the office. When I say "the office" I mean the organisation.

The budget for 2026 is considered to be for a start-up phase and it is €1.5 million. It is expected to grow, but I am not in a position to comment on what it might project to. There is a role for the CEO and the senior management team when they are in place to look at what the activity level in the regulation of AI is and the work needed to co-ordinate across the 15 competent authorities that are involved and that will help to further dimension the AI office and understand what the cost will be in future years. There are comparable organisations we could take a guideline from but it is probably not appropriate for me to go down that road at this point.

Are there comparisons from other EU member states?

There are comparisons in that AI offices exist but the ones that are available for us to reference are in much larger jurisdictions, such as Spain and the Netherlands. They are perhaps on a scale that is not necessarily comparable to us, although their functions are similar.

When Mr. McCormack talks about the scale, is he talking about the number of AI companies operating in the jurisdiction?

I was talking about the size of the population and the scale of the entities they are required to regulate, not just the providers, but the users and deployers. I might allow my colleague, Ms O'Donoghue, to come in.

It might be helpful to talk about the study that was done last year to prepare for this first year. It was done on a phased basis. I cannot give figures for the budget for future years. I think that will be a lot of the work of the office in the next few months. However, the study benchmarked against comparable regulators in six other member states. All other member states are in the same position as Ireland, setting up offices. Some have followed a similar model with a totally centralised or a hybrid model similar to ours. As other member states get set up, we will have more bases to compare with. As well as the six member states the study looked at last year, we also looked at three existing regulators nationally and brought together an insights panel to talk to existing regulators who have worked in that area to get lessons learned and best practice, looking at how we should move forward. That is how the initial implementation phase of the office was established, including having a CEO and a board. That came from the study. As Mr. McCormack said, the CEO recruitment will be launched very soon. It is with the Public Appointments Service at the moment. It is moving quite smoothly and we anticipate it will meet the August deadline when the sandbox has to be up and running.

On skills, a key function of the AI office of Ireland will be to host a central panel of experts. The competition for talent and skills will be immense, so we will have a central panel the regulators can draw down from. This is as well as having the sandbox, which will be for SMEs to access, so there is a lot going on.

That is great. It is multifaceted. That sounds encouraging.

Can we request a copy of the report Ms O'Donoghue referenced that helped to inform the establishment of the start-up environment for the office, if it is publicly available. That would be great.

Absolutely.

Gabhaim buíochas leis an Chathaoirleach.

I thank the witnesses for coming to talk about AI. It is a minefield. I did my degree on an electric typewriter. That just goes to show how fast we have moved, although I am quite old as well.

Last week, someone who came into my constituency office was an absolute expert on AI and works for a huge American conglomerate. That person spoke about the fear he had that we are not moving fast enough. Since I had that meeting, I have heard ads on the radio with businesses saying how they are using AI platforms and how it can help small businesses. Perhaps they are ahead. It seems very new. Yesterday, I visited two large businesses that deal in the hot school meals area. They serve 100,000 children per day with hot school meals and they use AI in the background to be able to tell what percentage of children will not order the chicken curry, for example. It was fascinating to see this on screens.

I have been looking at figures in the past week of where different countries are with businesses and small businesses with AI. Denmark seems to be setting the trend in Europe. Approximately 42% of businesses are using it there and Finland has about 38%. We are probably at the lower end of the scale at 9% or 10%.

Two people have mentioned the office so far and I will mention it as well. It will be oifig intleachta shaorga na hÉireann or the AI office of Ireland. What are businesses doing at the moment, while the office has not yet been set up, to be able to safeguard and help themselves without having that office to refer to? If consumers are using these businesses and there is no equivalent of the Competition and Consumer Protection Commission, CCPC, to go to, what are they doing?

It was mentioned that the general scheme imposes obligations that require national implementation measures, including empowering regulators with investigative and enforcement powers. That got me thinking that last week someone was convicted of insurance fraud and sentenced to three and half years in jail. That is big. Insurance fraud impacts businesses a lot but it took ten years from when the claim went in to find out it was fraudulent. Will we have to train gardaí or who will the enforcement people be? Will they be the people sitting in this office? Will there be gardaí sitting there who are heavily trained? What are the plans for that? I imagine with all this we will need a lot more people. I would be interested to hear what the witnesses have to say on enforcement.

I thank the Senator. I agree it is being widely adopted already by businesses. The Senator is right to say that, in terms of reported adoption figures in recent years, Ireland is not necessarily at the higher end of the adoption rate. However, the rate of increase is actually at the higher end. The level of AI usage in businesses between 2023 and 2024 increased by 75%. A year on from that, I think we could extrapolate from that significantly.

What are businesses doing now in relation to AI? A number of supports are available to help them to adopt it. The Commission has an informative and helpful single point of information contact, website and service desk that enables them to do so.

The Commission has a dedicated unit for the implementation of the AI Act called the European AI Office. It is resourced very well. It may not have reached its full complement but I think there is a target of 240 people. It has established a website with information on complying with the Act, use cases for AI and for general queries that parties might have, be it around AI or the regulation. That is a very helpful resource for business. At a national level, Ireland has four European digital innovation hubs around the country that are forums and entities of which businesses can avail to help them explore not just AI but various forms of digital technology to help their business. That is in combination with the local enterprise offices and various digital supports that are available through the Department and other agencies of the Department.

In terms of consumers and if there is a regulatory matter that arises at the moment, the enforcement obligations of the AI Act do not really come into effect until August of this year. It is possible for consumers to raise issues through the AI office. What is probably happening is issues are raised through other digital services regulators at the moment, albeit they do not have the powers to react to that.

From August, they will have somewhere to go, in the same way they can go to the CCPC if they are not happy with a shop. Will it be as easy as that?

Yes. At the moment, in advance of the AI office being fully established, the Department itself has established a single point of contact for Ireland. On the Department's website, there is a single point of contact email address. Anybody can report incidents they see or send any query they have about the regulation, the Act and AI in general to that email address. That is serviced by a dedicated unit within the Department.

Do we see ourselves needing highly skilled gardaí or enforcement officers?

One of the primary bodies for supervising and enforcing the regulation will be the national competent authorities that have been designated for this Act. I will not go through them all but they include the Central Bank, Coimisiún na Meán, the Commission for Railway Regulation, the Health and Safety Authority, etc. They are actively preparing for this. We are working with them on training, skills and awareness. The roles and investigative powers they have will allow them to involve gardaí, should they deem it necessary.

There is a need for AI skills to be more widespread across the board, no matter what the roles are. I am sure elements of the gardaí will take steps in that regard.

Gabhaim buíochas and I thank the witnesses for being here today. I am feeling old listening to all of this about AI and how it is moving so fast. I certainly welcome the legislation and it is important, along with the AI office being set up with its own CEO.

As an SME owner, it was interesting to have several SMEs in here giving witness to their own business challenges. They are faced with various costs and new issues, even regarding data protection which we have only just got used to. I see the Data Act is described as democratising access to data. Many SMEs that have been in here giving testimony still lack the technical capacity to use the data once it is accessed. What supports are in place to ensure it does not simply shift power from one large player to another, rather than empowering small SMEs?

I thank the Senator for the question. There is a genuine opportunity for SMEs here. I think of it in a situation where at the moment, if you have your car, you have to bring it to the dealership for them to access the official data when you are getting it serviced. Under the Data Act, your local mechanic will actually be able to access all of that data and provide the same service. There is an opportunity for SMEs and potentially for a consumer-friendly service as well because you might be able to get it at a better rate. There is a genuine opportunity to really democratise access to data.

As the Senator rightly points out, there is challenge with the communications and awareness piece to make sure small businesses actually have the supports they need to be able to turn something from an opportunity into a reality. The data Act regulation provides for this in respect of a requirement for the data co-ordinator and for CCPC to lead on data literacy. They will be able to make materials available to businesses that want to engage with data more, as foreseen through the Data Act. To support that, there is a programme for Government commitment to develop a new national digital strategy. That will actually be a national digital and AI strategy. That is imminent and will be published very shortly. That will contain the sorts of provisions and supports to make it a reality for SMEs and make sure they can use AI. There are already supports there from the LEOs and Enterprise Ireland but the ambition of the national digital strategy will be to take that to a new level.

Will there be any key supports available from day one, whether that is funding or technical assistance, specifically for SMEs?

There are already supports available through-----

Through the LEOs?

Yes, through the LEOs. There are already vouchers available through them. I do not want to pre-empt what the national digital strategy will say.

Okay. Carrying on from what Deputy Conway-Walsh was saying about Ireland being the lead regulator for many multinational firms, does ComReg or the CCPC have the expertise for that? Does it have the staffing and does it have the enforcement appetite to take this on? Is there any gap there?

Do we have the expertise. This is really about the country of origin principle. That says where a company is headquartered is where it is regulated, effectively. Many digital regulations already have this concept in place and the Data Act is not unusual in that regard. In respect of ComReg, it will regulate the data processing service providers, which is where we will see most of those very large companies. I believe that internally, ComReg developed a report to look at the types of skills it needs and the quantum of resources it needs.

ComReg is aware of the challenge that faces it and the size of the task. It has developed a plan and I gather it is with its parent Department to consider how best to resource it. From my interactions with ComReg, there is definitely the appetite there to regulate very effectively.

Okay. Mr. McCormack mentioned banning those AI systems of unacceptable or high risk. What sort of examples does he have of them?

I will pull some up here, so I do not get them wrong. They are focused on Orwellian type practices such as subliminal or manipulative AI techniques that could be used, untargeted scraping of facial images in public spaces, predictive policy based solely on profiling of traits of persons, emotion recognition in workplaces that could be used to confer something or automate a decision and biometric categorisation based on sensitive traits.

Is that list comparable with the lists of our European counterparts? Are they all doing similar? Are those practices unacceptable in those jurisdictions?

Yes. Prohibitive practices are called out by the European regulation. It takes direct effect and there is no requirement for national governments to implement or transpose that. It has direct effect. We have not added to or amended them.

That is the general practice across Europe to ensure there is a harmonised approach to it across the EU.

Is it the AI office and the CEO? Is it their decision to judge these unacceptable or high-risk? I know the law will, but who oversees that?

There would be a number of competent authorities that are designated across those particular areas, depending on the nature of the space the competent authority is operating in. For regulation, the Government decided on a distributed model, and to leverage the capabilities and experience of the sectoral regulators that are already in place. Depending on the sector where the prohibited practice is taking place, it would be a matter for that particular competent authority to investigate and reach a decision on that.

Mr. McCormack is confident that the AI office will have sufficient technical expertise, funding and staffing from day one.

Yes, albeit in a start-up phase. No doubt, it will evolve and grow over time as the level of regulation activity needed becomes clear. It will establish access to technical support to help the regulators access technical expertise in their jobs.

I thank the witnesses for coming in. I found their opening statements very interesting and informative. Ireland has an opportunity to be a leader with regard to AI, but we must ensure that regulation protects the public without dampening innovation. Getting that balance right is crucial to our economy and society.

I have several core questions. When we come to balance and competitiveness, how will the Department ensure that this legislation protects the public without undermining Ireland's position as a leading destination for AI investment? If we look at future-proofing, given how quickly AI capability is evolving, how are we building flexibility into that framework so that it does not become outdated within a few years? My colleague mentioned the impact on SMEs. What specific steps are being taken to ensure SMEs and start-ups are not disproportionately burdened compared with large multinationals? Will regulatory sandboxes or phased compliance supports be introduced so businesses can innovate safely while meeting their obligations?

With regard to managing unknown risks, if harms emerge that we cannot foresee, what rapid response mechanisms exist to update the regulation? Who will ultimately be accountable when autonomous AI systems cause real-world harm? Is it the developer, the deployer or any other party? How are the AI Bill and the data Bill being aligned to provide clarity for businesses while maintaining strong data protections?

I will do my best to work through those questions. The first point concerned balancing the need for investment with the protection of citizen rights. The risk-based approach that the regulation takes seeks to target the areas that have the most potential for harm to the rights and safety of citizens. For those practices that we call “prohibited”, there is a defined set of high-risk product areas that would come under the regulation and a defined set of high-risk use cases. Quite a lot of AI systems would not fall under the hefty level of obligations for systems through this regulation. Therefore, it should allow businesses to explore, adopt and promote AI, which is one of the key objectives of this.

When we think about that point, a lot of AI is very good, and we need to embrace that. When AI is bad, we need to legislate to make sure it does not affect our society. That is what Mr. McCormack is trying to say.

That is exactly what the Act is endeavouring to do. The scheme we are putting forward today does not alter, amend or add to the EU AI Act, which has direct effect, but it empowers the regulators to carry out the functions that they will need to ensure they are regulating.

The range of activities that will still be of minimal risk, as considered under the AI Act, is quite broad. It would probably be for the more common use cases of AI, particularly in small businesses, and would not necessarily encompass the large-scale entities for some of the prohibited practices or high-risk use cases. Where it is done to help drive efficiencies in businesses, for procedural tasks, or to help further prepare and assist workers in actions they already undertake, there is minimal regulation - in fact, none. It is only when something goes into a state where it is considered high-risk that the full obligations of the regulations kick in, along with the burden of that for businesses.

The Deputy mentioned the need for flexibility in order that the Act is not outdated. The Act does not call out particular technologies, apart from a reference to the general-purpose AI category. It is generally focused on risk, use case areas and the use of AI. Whatever stage of advancement the AI is at, it is how it is used, in what way it is used and in what products it is used that it is regulated.

There are also provisions in the EU AI Act to adjust and amend those lists over time. The Commission will review at regular intervals those use cases, and can amend or adjust the list without fundamental renegotiation of the AI Act. They are built-in as implementing Acts of the main Act itself.

We must also be very nimble in the way we react so that we are not caught off guard. For example, we do not want one of the gatekeepers that Mr. McCormack spoke about earlier to be blaming another. We need to get the problem solved as quickly as possible so that it does not affect our communities and society.

I totally agree. That is a key role the AI office of Ireland will have. It will be a point of contact for businesses and anybody engaging with regulation who has queries around the AI systems themselves. It will be there to help and to foster co-operation and collaboration across the competent authority network so that where there is perhaps uncertainty, it can be resolved through good communication and collaboration forums.

Does Mr. McCormack have a comment on the impact on SMEs?

The Act introduces a number of support measures tailored to SMEs. They include the possibility to prepare simplified technical documentation should they be subject to the AI Act, such as simplified quality management systems if they are using high-risk AI systems. They are also granted free-of-charge access to the AI regulatory sandbox, enabling them to test and develop systems in a controlled environment. In addition, the Commission and national authorities are required to provide specific measures, so they have access to advisory support through the regulation system. Finally, where penalties are to be imposed, the SMEs will benefit from special consideration that would take into account their scale and the nature of their operation.

There is a network in the EU and nationally of European digital innovation hubs. Ireland has four of them, in Dublin, Cork, Mullingar and Sligo. They are there to support businesses in a range of digital things, particularly AI. Our Department has worked with CeADAR, Ireland's national centre for AI, to develop an online training course, which is proving to be very helpful to businesses and citizens. Generally, the fact that this establishes a harmonised law for AI across all EU member states is aimed at reducing costs for SMEs, in particular when they are going to grow their business across the member states of Europe in a harmonised way.

AI is on everyone's lips and everyone's minds at the moment. I was listening to something today about the technological advances in medicine around AI and how quickly now they are bringing forward medicines that previously would have taken years. There are hugely positive aspects to AI. It has been around in some form for a very long time anyway, but the speed and the technological advances we have had over the last couple of years have really brought it into focus. I welcome the legislation. There are a couple of things I want to ask about. The legislation establishes the AI office as a new statutory body with a central co-ordinating role for the enforcement of the EU AI Act. It also provides that the Minister may issue written policy directions to the office. Ireland has positioned itself as a credible and robust regulator of AI systems developed and applied by powerful multinational firms. How does the Department intend to ensure the AI office can have genuine operational independence in its enforcement, co-ordination and functions, particular where decisions may have significant economic or political implications? That is just in respect of the sheer size of some of these companies, the number of jobs there are and Ireland's relationship to those companies. With their economic size and value to the economy, there is just a worry that, like the banks in 2008 and 2009, they are too big to fail. Are they too big to criticise or influence?

Again, I would point to the fact that the AI office of Ireland is being established on a statutory basis. The CEO will report to the board as opposed to the Minister. The office itself will be a central co-ordinating authority for a network of national competent authorities which are for the most part very well-established, credible and independent regulators in their own sectors. Ireland has a good reputation, I think, in these areas for its independence and its focus on the role of the regulator as opposed to the interests of other areas of the economy and society. I think the combination of the office being established on a statutory basis, the governance structure and mechanisms being set up is in line with best practice for the establishment of statutory bodies and the governance of those. The strong, experienced, credible and reputable set of national competent authorities that will be the main regulators, supervisors and enforcers of the regulation also lead to a strong position in terms of ensuring independence.

It is really going back to the size and scale of these operations, particularly the AI companies that we have, the scale in terms of the tax take in Ireland and the profits they make. I am looking at the funding stream for the offices. It looks tiny in comparison with the scale of what we are facing here in terms of AI companies. If, for example, one of these big organisations was brought to court or brought to book for something that happened, where would the money come from to bring that forward? Bringing a case is going to take an enormous amount of resources and expertise. It does not look like it could come from the current funding, so where would that money come from if a very significant case needed to be brought forward?

It is important to note that the role of the AI office of Ireland is that central co-ordinating role. It is supporting and facilitating the network of competent authorities that will actually carry out the regulations within their sectors. The Government has decided on a distributed model of regulation. The entity of the AI office is not the regulation system in its entirety. If we look at it in its entirety, we do have some very significant regulators in there, such as the Central Bank, Coimisiún na Meán and the Data Protection Commission. A number of the regulators have the ability to fund through levy mechanisms to meet the requirements and costs of carrying out their functions. When it is put in the context of the distributed model, there are mechanisms there to secure the funding needed for them to carry out their functions.

How will this Bill ensure that the definitions within the AI Act are clear and enforceable in practice? I have seen internationally that there are concerns around definitions when it comes to deepfakes, general-purpose AI and the extent of those definitions. What are the officials' thoughts on that and how will they ensure the interpretations are crystal clear across the board?

As part of the implementation of the AI Act, the Commission has established a number of governance bodies and the European AI Office is a key one of them. One of the functions of that office has been to target specialised topics in relation to the implementation of the AI Act. One of them has focused on the definitions of AI systems, for example. Through activities like that, it is helping member states and the Commission itself to interpret the Act in terms of definitions but also in other ways and in other obligations that are set out. That work will continue. Some guidelines have issued around, for example, the definition of AI systems. They would be the strongest point of reference for any legal interpretation of that, given that they have been agreed through the EU governance bodies. That will be an evolving space as new uses emerge.

There will be new terms and new references that will come to exist only in the coming months and years, and things are moving at so great a pace. A big conversation that has been happening for us here in the committee and across Europe relates to competitiveness, whether the EU can compete, and whether Ireland as a country can continue to innovate and be agile. Has an assessment been done as to whether the AI Act will promote AI innovation and competitiveness as opposed to stifling it, particularly for start-ups and SMEs? We are living through an age where first-mover advantage in AI is going to be critical for companies. Is this AI Act going to be more of a hindrance than an acceleration and a guardrail?

One of the key objectives of the Act is to promote the adoption and uptake of AI. It is intended that the Act will put harmonised guardrails in place that would make it easier for innovation, because people now understand the rules they have to innovate and develop within to keep citizens safe and protect fundamental rights. A number of measures will help in that regard. Priority access to regulatory sandboxes for SMEs is a good space. While AI is in the innovation stage with businesses, they are not necessarily subject to the full breadth of the regulation. While something is under development, they are not necessarily subject to all the obligations that will apply once it is put on the market.

On the sandboxes, will our national regulatory sandbox be sufficiently resourced to help innovators test AI in a safe way while they are trying to comply? Who is going to take over the management of that? I know that in last year's budget, the national AI office was funded, but where is that at and how soon will people be able to access a sandbox to prepare?

The AI office will have responsibility for ensuring the establishment of it. Initially, based on recommendations and support of the AI advisory council, the initial stage and manifestation of the sandbox should be to provide that regulatory guidance and help businesses navigate through the guardrails, the rules and the obligations to help them to develop and innovate in a way that will leave them in a place where they can put their new systems on the market.

It will evolve. It will start as a regulatory body that helps organisations to navigate the regulations, but it will be the role of the AI office, once it is established on a statutory basis, to put in place a regulatory sandbox that leverages not just its own entity but the wider competent authority network so the sandbox can be applied in a way that is relevant to the sector in which a particular innovation is being employed or is intended for.

Okay, lastly, in international terms and concerning trade implications, are there any anticipated trade implications from the implementation of the AI Act? In terms of the non-EU companies serving the Irish market, are there any unintended consequences that Mr. McCormack can foresee?

Not at this juncture. The Act applies to where a company puts a system on a market and into service in a market, so it does not necessarily exclude companies that are third parties from the regulation. It applies the rules fairly. Whether it is a business entity established within the EU or outside of it, if it is deploying its AI system within the market and putting it into service, then it is subject to the regulations.

I am nearly out of time, but many companies are going to be trying to integrate AI into how they do business. Take the example where I go online and I am looking at purchasing something. All of a sudden, I am chatting to an AI chatbot about perhaps making a better decision or trying to clarify what I am looking for from that shop. That might be a third-party integration. Is it the third party's responsibility to make sure that AI is functioning fairly correctly and within the realms of the guidelines or is it the main company's? Main companies that are bricks-and-mortar at the moment but that are trying to adapt to this environment and do not have large language models or this AI skill set at their disposal will be looking to outsource that into their products as an add-on. How do we make sure that is all above board?

The provider would be subject to the regulation if it is putting it into service in the market. If that service is being deployed in a specific way by an entity within the EU, it would also have regulations. It would kind of depend on exactly how the system was used, but both provider and deployer would have obligations. If the deployer was not significantly changing it or using it in a way it was not intended for, the majority of the regulation would fall on the provider or the entity that is establishing it.

I thank Mr. McCormack very much. I really appreciate it.

It has been fascinating listening to the discussion and there are so many different directions we could go in. One thing always intrigues and fascinates me. I know that as part of what is being proposed there is the reference to designating the national competent authorities required for the supervision and enforcement of AI regulations. Coming down into that, we have seen such a pace in terms of deepfakes, tools like Grok, etc., where legislators have had to face very contentious questions. I am just intrigued. Many people would say there has been a lot of scaremongering around AI, but, in reality, in the last few months we have seen quite the opposite, where a lot of people's worst fears are starting to materialise. Does the Department have any concerns it wants to share with the committee in respect of this?

Ultimately, it is about that line between reality and this new multiverse of bad content and inflammatory language, which has given people involved in malign activity a lethal weapon. We could probably say the last time humanity developed the capacity to destroy ourselves was probably in the 1940s with nuclear weapons. AI is a new tool that represents just as much danger to society in terms of people losing complete faith and trust in the institutions we rely on in our daily lives, public trust in what Government does and how we try to keep systems balanced. I see AI, potentially, as having enormous negative consequences if we do not do this correctly. Much of this seems to be falling under the remit of the Department. I am really fascinated to see what the witnesses may have to say about this and if they have concerns they wish to share.

Recent events would certainly have emphasised the importance of regulation of this nature, particularly in relation to AI, but also the broader digital rulebook in relation to online services and online safety. I think with AI, as with many emerging technologies, it is the scale at which the risk can expand that is the most challenging for society and regulations.

The Government has welcomed that the European Commission has played its role in investigating the recent matters and the entity involved. The regulator, our own digital services co-ordinator, has played a key role in that. I think it demonstrates that the regulation does work and it is taking the steps needed to deal with these threats as they arise. They will evolve, though, and they will be emerging, and the AI Act, in particular, is very well designed in terms of looking at how to approach that from a risk-based level. Empowering it through that sort of product regulation-type approach to regulation gives quite significant powers to investigate, to recall, to withdraw products and to issue contravention notices and prohibitive notices. It is an important piece of legislation to address and it emphasises the need for this legislation to move forward.

We would also note that it is important not to lose sight of the other primary objective that goes in tandem with protecting citizens' rights, which is to promote and reap the benefits of AI. One of the members mentioned hearing stories this morning about the use of AI in healthcare and it being transformative in terms of how it can treat certain illnesses. It is important that the regulation is in place and it is strong in doing its job. It then leaves a safe space for innovation and for society to benefit from AI, and that is really the space where we want to be. An important step in the right direction is being made with this scheme and this Bill.

Absolutely. It was phenomenal to see the accuracy even in cancer scans and the positive impact some of the new and emerging AI technology can have. There is that balance. There is, however, that dark cloud relating to the social media operators in particular and that is disturbing. It is the pace of it. I worry that in international politics, and especially in US politics, the people in public office are at a much later stage of their lives. I just wonder if they are digesting information the same way as people in their 40s, 50s and 60s would and if they see the danger and the advancement in how fast deepfakes have become so accurate. It is starting to get genuinely difficult to tell the difference between what is real and what is not. This represents a very serious danger on the political side for democracies.

We all have to face elections every few years and we meet the public. There can be deeply defamatory and totally spurious AI content, or a video or voice recording, etc., that is completely fake. People, particularly vulnerable people in society, will not be able to tell the difference. There is an old cliché or joke that Winston Churchill said the best argument against democracy can be a five-minute conversation with the average voter. I think he was referring to people who might be a little bit more vulnerable, who are not as well read-in or cannot tell the difference. That is a really serious worry I have.

Besides the strong protections in terms of prohibited practices in high risk systems, another key aspect of it is around transparency for generative AI. That is for things like deepfakes, chatbots and content that is generated. There is an obligation arising from the Act for that sort of content to be clearly labelled in order to make clear to consumers at the point of consumption that it has been generated by an AI entity.

I am delighted to welcome my colleague from Kildare, Deputy Naoise Ó Cearúil, as a guest to the committee. He also sits on the Committee on Artificial Intelligence.

Go raibh maith agat, a Chathaoirligh, and thank you for giving me the opportunity to ask questions here this afternoon. As the Cathaoirleach has said, I sit on the AI committee and I am spokesperson for my party on AI. I commend Mr. McCormack and his team on their work, particularly when the Grok issue arose. Between his team and the Minister, I really commend them. They got into action very quickly and gave the public a lot of certainty and brought calm to the situation, which shows the importance of having the AI unit within the Department.

I worked in AI prior to being elected to this House. In April, I published a paper on establishing a national AI office and then in July I published a Bill that I was planning to bring forward to the Dáil in September. Then the Department along with the Minister announced in September they were establishing the office anyway, which saved me a little bit of work. That said, my fear is that the national AI office will lack the teeth that it requires. I completely appreciate that there are 15 competent authorities that have been assigned as the regulatory authorities. That was done in 2024 and this is a continuation of that. I want to use an example where an issue arises and the Data Protection Commission and Coimisiún na Meán both want to take it on. Who makes the call on which is the regulatory authority and the competent authority in that situation? Is it the national AI office? Is it the Minister?

The national AI office would have a role to bring the regulators in question together through a collaborative forum but, ultimately, I think it would be a collective decision through discussion of the issue and through understanding what the-----

Let us say there is push back on both sides. Who puts the foot down and says it is the DPC's issue to address, for example?

That would really be the AI office that would give strong direction in that regard and then it would be a matter for the regulatory authority.

My fear is that in the scheme it is more of a signposting office. I appreciate if Mr. McCormack, the Department and the Minister do not see it as a regulatory body, but it needs to have a level of teeth, decision-making and certainty. This Bill will be proceeding and I think it needs to be strengthened from that perspective. The office cannot just be seen as a signposter and bringing people together collaboratively. Obviously, we should start with collaboration, do not get me wrong, but there needs to be an ultimate decision-maker here. There needs to be the office and the person in charge.

I appreciate the Deputy's comments. The scheme allows for, and the office will lead on, establishing memorandums of understanding between the regulatory bodies. As part of that process it is likely that there will be agreements or a framework for how decisions would be made on matters like that. Those areas are most likely to be addressed through the protocol for how it is ultimately decided on through those-----

Personally, I do not, particularly given how quickly algorithms are changing and how adaptable technology is now. We saw the issue with Grok. That is small in comparison with what is coming down the line. Do not get me wrong, I do not think we will deal with anything as gruesome as the manipulation of images of women and children, but we have serious issues. Obviously we are going to deal with financial issues. That will be the Central Bank of Ireland. There will be a load of issues coming up that will need leadership rather than just being dispersed. This is why my argument when I published the initial Bill was that we needed a commissioner and a commission rather than a CEO. A commissioner would have the strength to instruct Departments and competent authorities, and to actually act upon its decision.

While I appreciate this is proceeding, I ask that this be looked at and considered again. There is the capacity within the EU AI Act to have a commissioner. There is nothing precluding us from having a commissioner and establishing the office. I am fearful. Grok was the first example. We will have further examples that could be every month, every six months or every day. We just do not know with how quick things are moving. As many people have said, there are some excellent cases of AI being used in healthcare, justice and administration. There are a lot. However, it is about the unknown and the unforeseen. The AI advisory council and a lot of academics are doing these forward-looking trends and themes to try to get ahead of it and I am assuming the national AI office will be doing a lot of that work. Well, I hope it will. However, it is the issue of that ultimate decision-making on which I am fearful. Mr. McCormack does not need to answer that because I assume his response would be the same as his previous answer.

The last thing I want to raise relates to the name and whether it can be changed. At the moment it is the national AI office. I propose in Irish it be called oifig náisiúnta um intleacht shaorga, ONIS, which is the grammatically correct way of writing it but also has a ring as ONIS, rather than saying the national AI office or the AI office. It should be referred to as ONIS, similar to other State bodies and State entities. I think it would make it easier for people in discussions here and, indeed, branding in the future for the public. As part of the AI office's competencies in the future it must be public-facing. People need to know what it is, what it does, and what they can go to it with. A simple suggestion such as that would help.

I thank the Deputy. The name was arrived at through a Government decision and it is in the general scheme but it is intended that it be known as Gaeilge as oifig IS na hÉireann. The acronym would be used, as it is in English.

That is so long. I raised this with the Taoiseach and the Taoiseach agreed with me so I will raise it with his office again before it proceeds. Again, I thank Mr. McCormack and his team. They really are doing sterling work, particularly in such a fast-paced area that is changing so rapidly. However, it is important to get my concerns across and my hopes for what the office would have been and still can be.

Just remember that agreeing with you and sorting it out are two very different things. I have some experience in that matter. I thank all of the witnesses and members for their time and for participating in this meeting. It was really interesting and is definitely a topic of very current national importance. I wish the witnesses well in their work and thank them for coming into the committee. I also thank the members for being here, Senator Fitzpatrick for chairing this morning and the committee team.