Barry Scannell and Leo Moore

Ireland has a unique position in the European Union’s regulatory framework for artificial intelligence (AI), benefiting from an exemption from certain provisions related to AI used in law enforcement, under Recital 40 of the EU AI Act.

What Recital 40 means

Recital 40 defines Ireland’s unique position under the AI Act. It grants specific exemptions to certain obligations outlined below. These exemptions arise from Protocol 21 of the EU Treaties and apply to Ireland, reflecting Ireland’s distinct status in matters of justice and home affairs.

Understanding Protocol 21

Protocol 21 of the Treaty on the European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU) governs Ireland’s participation in EU measures related to the Area of Freedom, Security, and Justice (AFSJ). This protocol, originally intended to address concerns about national sovereignty in sensitive areas, allows Ireland to opt into or remain outside of such measures on a case-by-case basis.

The protocol was established during the Maastricht Treaty negotiations, reflecting both Ireland’s and the United Kingdom’s preference to retain control over judicial and police cooperation in criminal matters. While the UK’s departure from the EU altered the application of Protocol 21, Ireland continues to benefit from its provisions, enabling a tailored approach to EU legislation in these domains.

What Ireland is exempt from

Recital 40 outlines that Ireland is not bound by several key provisions of the AI Act, specifically where these relate to police and judicial cooperation in criminal matters. These include:

1. Article 5(1), Point (d): Prohibitions on using AI systems for risk assessments predicting the likelihood of individuals committing criminal offences.

2. Article 5(1), Point (g): Restrictions on biometric categorisation systems that infer sensitive attributes, such as race or political beliefs, for law enforcement purposes.

3. Article 5(1), Point (h): The use of ‘real-time’ remote biometric identification systems in public spaces for law enforcement purposes.

4. Article 26(10): The requirement for deployers of high-risk AI systems used in law enforcement to obtain judicial or administrative authorisation for post-remote biometric identification.

5. Articles 5(2) to 5(6): Further procedural obligations tied to the prohibited AI practices outlined in Article 5.

Why these exemptions exist

These exemptions are tied to Ireland’s decision not to opt into EU frameworks governing judicial and police cooperation unless explicitly agreed upon, as codified in Protocol 21 to the Treaties. Activities covered by these provisions intersect with areas of sovereignty that Ireland has chosen to retain outside EU competence under Protocol 21. For instance, the processing of personal data by law enforcement authorities remains governed by Ireland’s own implementation of Directive (EU) 2016/680, the Law Enforcement Directive.

Practical implications

Ireland’s exemptions ensure that the AI Act’s provisions do not constrain its autonomy in areas deemed critical to national security and law enforcement. For example:

• Irish authorities may independently regulate the use of biometric AI systems in criminal investigations without adhering to EU-level restrictions.

• The opt-out ensures flexibility in deploying high-risk AI systems tailored to Ireland’s specific legal and operational requirements.

However, this autonomy does not mean Ireland escapes oversight entirely. Domestic measures must still comply with the General Data Protection Regulation (GDPR) and Directive (EU) 2016/680. Additionally, Ireland remains accountable for ensuring that its AI practices respect fundamental rights as outlined in the EU Charter.

It is important to note that none of this is to say that Ireland cannot implement the AI Act regulations relating to law enforcement, and Recital 40 says that Ireland can implement these rules in its own domestic legislation if it so chooses.

Conclusion

Ireland’s exemptions under the AI Act reflect its nuanced relationship with EU law as governed by Protocol 21. While these exemptions provide flexibility in relation to AI and AFSJ, they also place responsibility on Irish policymakers to ensure that domestic measures align with broader EU principles of fundamental rights and data protection. As AI continues to transform key sectors, Ireland’s approach, whatever that may end up being, could serve as a case study in balancing national interests with international obligations.

• Barry Scannell and Leo Moore are partners at William Fry LLP.