knowledge 23 October 2026 |

Regulating AI in Financial Services

Introduction

The Irish Act represents Ireland’s domestic legislative response to the AI Act. As an EU Regulation, the AI Act applies directly in Ireland and sets the substantive obligations for providers, deployers and other operators of AI systems; however, the Irish Act supplies the Irish institutional, supervisory and enforcement architecture needed to make that regime operational in practice.

The AI Act is a landmark piece of legislation at the EU level, and one which has attracted much attention early in the Irish Presidency of the Council of the EU, with the passage of the Digital Omnibus on AI. While originally intended to be progressed alongside the implementation of the Data Act, the two were separated in order to meet the demanding timeframes. The President signed the Irish Act into law on 21 July 2026, and it was commenced on 31 July 2026.

For a more in-depth discussion in relation to the AI Act, listen to our recent MCF Horizons Podcast: AI Act Summer: Guidelines, Deadlines and What’s Next, available here.

For financial services firms, arguably the most important feature of the Irish Act is not the creation of the new domestic Irish AI Office (Oifig IS na hÉireann) to complement the AI Office established in the EU Commission (which will supervise general-purpose AI models and systems), nor the detailed inspection and adjudication machinery that will apply across much of the Irish economy. Rather, of particular concern for regulated financial services entities will be the deliberate decision to oust the enforcement provisions in the Irish Act that apply to most market surveillance authorities in favour of the continued application of the Central Bank’s existing enforcement frameworks. In practice, this means compliance with the new rules introduced by the AI Act will be supervised and enforced, in the provision of financial services at least, by the altogether more familiar Central Bank.

The Policy Rationale for Sectoral Enforcement

The move towards sectoral financial supervision is not a purely domestic innovation. Indeed, the Irish Act merely gives effect to a policy choice embedded in the AI Act itself, which requires that the national authority responsible for financial supervision under EU law – in Ireland, the Central Bank - shall also be the market surveillance authority (“MSA”) for high-risk AI systems that are placed on the market, put into service or used in “direct connection with the provision of financial services” by financial institutions.

This is a bespoke and deliberate choice, reflecting the policy rationale articulated in Recital 158 of the AI Act that financial supervisors have the sectoral expertise, existing supervisory relationships, and institutional capacity to best regulate AI systems deployed in financial services contexts, and that integration with existing supervisory mechanisms and procedures under Union financial services law is preferable to a parallel (and inefficient) regime.

However, it should be noted that while the Central Bank is likely to be the principal regulator for financial services firms under the AI Act, it is expected that such firms will have interactions with other regulators too. For example, if a financial services firm processes personal data (of its staff and/or customers) using AI systems, such processing may be regulated by the Data Protection Commission rather than the Central Bank.

Furthermore, the AI Act provides that the MSA for financial services law – which again, in Ireland is the Central Bank - shall continue to perform its market surveillance functions even in respect of entities which are directly supervised by the European Central Bank (“ECB”) and participate in the Single Supervisory Mechanism (“SSM”). The AI Act also provides a mechanism by which any information that is gathered in the course of such market surveillance functions that are relevant to prudential supervision is in turn provided to the ECB.

The Central Bank is, therefore, the MSA designated under the AI Act for the financial services sector generally, while the ECB's role is confined to assessing how AI-related risks (e.g., governance of AI-driven credit models, internal controls) may impact its specific and closed list of prudential supervisory tasks. This is consistent with the approach under the SSM Regulation (and its implementation in Ireland) more generally, which limits the role of the ECB to only what is necessary for the performance of the specific relevant functions delegated to it in the SSM Regulation itself, and is without prejudice to the responsibilities and powers of authorities under other legal frameworks.

The General Rules & the Central Bank Exception

Parts 5, 6 and 7 of the Irish Act contain the general enforcement machinery. These Parts include significant detail on the essential features of an enforcement framework, from setting out the powers of authorised officers - what they can and cannot demand and access - to the variety of notices which can be imposed on non-compliant entities, and culminating with the processes for adjudication and the constitutionally required confirmation of sanctions, fines and criminal penalties by the High Court. Those provisions will be central to enforcement in many sectors. They are not, however, the relevant regime for financial services firms and the Central Bank.

The Irish Act simply provides that these very detailed provisions, in their entirety, shall not apply to the Central Bank. This is not merely a minor procedural carve-out. It is a structural displacement of the Irish Act’s entire enforcement regime in favour of the Central Bank’s own statutory framework. The effect is that regulated financial services entities will not, at least in respect of AI systems used in direct connection with the provision of financial services, face AI Act enforcement through a separate sanctions track outside the Central Bank’s existing supervisory remit.

The Irish AI Office will, nonetheless, have an important coordination and information-sharing role across the distributed network of market surveillance authorities. Where it receives a complaint, the Irish AI Office will carry out an initial assessment and may refer the complaint to the relevant MSA, or where relevant to the EU AI Office. The Irish Act establishes a distributed regulatory model across a large number of MSAs; but where AI systems are used in direct connection with regulated financial services, the relevant supervisory relationship is with the Central Bank.

Central Bank Responsibility for Enforcement

While the Central Bank already has many of the tools and powers it needs to carry out these functions, the Irish Act makes several relevant changes to the Central Bank Acts 1942-2018 (the “Central Bank Acts”) to ensure there is no AI-shaped gap.

For example, the Irish Act allows the Central Bank to impose administrative fines at the levels specified in the AI Act, including fines of up to €35 million or 7% of worldwide annual turnover for infringements involving prohibited AI practices, and up to €15 million or 3% of worldwide annual turnover for other relevant infringements. These fines may be imposed following the Central Bank’s established inquiry procedures under the Central Bank Acts.

At a practical level, this is achieved by grafting the AI Act’s penalty levels onto the Central Bank’s Administrative Sanctions Procedure. AI Act infringements by regulated financial services firms will be investigated and sanctioned through the same enforcement architecture that firms already know and have become accustomed to from other regulatory regimes: investigation, possible settlement, inquiry, sanction and publication.

The Irish Act also specifically provides that these AI Act administrative fines are additional to and not in substitution for the sanctions otherwise available to the Central Bank. This suggests that AI Act penalties may sit alongside the Central Bank’s existing (and very broad) range of sanctions, including reprimands, directions, conditions, suspension or revocation of authorisation and other measures available under the Central Bank Acts. This arguably gives the enforcement of the AI Act in the financial services sector even greater teeth than in other sectors.

The Irish Act also designates the AI Act as both a “designated enactment” and a “supervisory EU legal act” for the purposes of the Central Bank’s supervisory framework. These are technical amendments with significant regulatory importance. In practice, this means the Central Bank will be able to monitor, assess, and take enforcement action against regulated firms that fail to meet their obligations under the AI Act, in much the same way as it does for other core financial services legislation.

Supervisory Expectations

The main practical consequence of all of this is that AI Act compliance will be absorbed into the Central Bank’s existing supervisory model. Regulated firms should expect AI questions to arise through ordinary supervisory engagement, be it specific thematic reviews, risk mitigation programmes, conduct supervision, or operational resilience reviews.

The Central Bank’s view is that many of the risks AI presents are not new, and that existing rules already deal with them. Its Regulatory & Supervisory Outlook (February 2026) sets out what it expects of firms using AI:

• Strategic alignment: Firms must ensure their use of AI is appropriate for the specific business challenge being addressed.
• Accountability and explainability: Firms should establish clear accountabilities and responsibility, human oversight of decisions and their explainability.
• Proportionate governance: Risk management practices must be commensurate with the scale, scope and sensitivity of the AI deployment.
• Compliance: Processes should be in place to ensure all EU AI Act obligations are met including transparency requirements.

The Outlook also signals where the Central Bank is focussing its attention. In insurance, the concern is that AI use in pricing and claims models without adequate human oversight could introduce discrimination, lack of transparency or exclusion of vulnerable consumers. In markets, the Central Bank plans targeted inspections where AI has a material effect on trading or surveillance, and it is looking at how investment firms use AI in their digital interfaces.

Accordingly, the Central Bank is principally assessing AI through the lens of existing financial services expectations. That includes board and senior management oversight, individual accountability, systems and controls, consumer protection, model risk management, outsourcing, ICT risk, DORA, data governance, and operational resilience. AI governance - particularly for high-risk use cases such as creditworthiness assessment, credit scoring, life and health insurance risk assessment or pricing, and other customer-impacting decision-making - should therefore be integrated into existing risk management frameworks rather than treated as an isolated workstream.

The UK position

A similar position is emerging across the Irish Sea. On 19 October 2026, the UK Financial Conduct Authority (“FCA”) published AI in financial services: good practice and areas for improvement, which echoes many of the themes expressed in the Central Bank's Regulatory & Supervisory Outlook of 26 February 2026. Both documents emphasise explainability, accountability and proportionate governance in the deployment of AI, together with transparency towards consumers about how AI is used. The FCA’s examples of good practice, notably board-level ownership of AI strategy and oversight, offer a useful benchmark for Irish firms reviewing their own governance arrangements.

What firms should do now

The Central Bank will treat AI Act breaches within its remit as potential regulatory contraventions and deal with them through its established supervision and enforcement processes. With that in mind, we recommend that firms:

• build an inventory of the AI systems used across the business, including AI embedded in vendor products, and record for each whether it is high-risk and whether the firm is its provider or its deployer;
• check that customer-facing chatbots and other AI tools meet the transparency obligations that already apply;
• ensure that responsibility for AI governance and risk is clearly allocated within the firm’s existing governance and individual accountability arrangements, and that the Board receives regular reporting on AI risk;
• review contracts with AI suppliers for audit, information and exit rights, consistent with the firm’s obligations under DORA; and
• be ready to show the Central Bank how AI is governed, because questions will come through ordinary supervisory engagement rather than a separate AI process.