Who enforces the EU AI Act in Ireland, Malta and the EU?
Short answer
In Ireland, the Regulation of Artificial Intelligence Act 2026 has been in force since 31 July 2026. The AI Office of Ireland is the central point of contact, and enforcement is shared between around 13–15 sector regulators, including the Data Protection Commission (DPC), which also supervises GDPR. In Malta, the Malta Digital Innovation Authority (MDIA) is the main market surveillance authority and point of contact, and the IDPC supervises GDPR and certain AI areas, such as biometrics. At EU level, the AI Office in the European Commission supervises general-purpose AI models and – following the Digital Omnibus – certain AI systems built on them. In other EU countries, national authorities are responsible.
The authorities in Ireland
Ireland has chosen a decentralised model: around 13–15 existing sector regulators each supervise AI in their own area. The legal basis is the Regulation of Artificial Intelligence Act 2026, in force since 31 July 2026, together with S.I. No. 366 of 2025 (amended by S.I. No. 405 of 2026).
| Authority | Area |
|---|---|
| AI Office of Ireland | Central coordinating authority and single point of contact. Whether it also acts as a market surveillance authority is not yet clear. |
| Data Protection Commission (DPC) | GDPR, plus market surveillance of certain prohibited practices and high-risk uses under the AI Act (Article 74(8)) |
| Workplace Relations Commission (WRC) | Reportedly AI in employment – not yet confirmed in the legislation |
| Other sector regulators | AI in their own sectors |
Uncertain: the full list of Irish authorities and the WRC's role have not yet been verified in the legislation itself. Check the AI Office of Ireland's website for the latest position.
The authorities in Malta
Malta designated its authorities in October 2025 in the Artificial Intelligence Regulations 2025 (L.N. 226 of 2025) and L.N. 227 of 2025, which designates the IDPC.
| Authority | Area |
|---|---|
| Malta Digital Innovation Authority (MDIA) | General market surveillance authority, notifying authority and single point of contact |
| Information and Data Protection Commissioner (IDPC) | GDPR, plus prohibited practices and high-risk AI in biometrics, law enforcement, migration, the administration of justice and democratic processes |
Supervision in the rest of the EU
Every EU country has its own authorities. Germany, for example, has a law implementing the AI Act that entered into force in July 2026, while other countries are still designating their authorities – in some, there is only a bill so far, or nothing at all. The European Commission keeps a list of the national authorities (see Sources). For businesses that operate in several countries, it is the authority in the country where the AI is used that supervises it.
What does a supervisory authority look for?
In practice, an authority will ask: What do you use AI for? Do your staff have the necessary AI literacy? Are you using anything prohibited? Do humans oversee high-risk uses? Can you document it? That is exactly what a GoalCube report brings together.
What to do
- Keep your AI inventory up to date.The first thing an authority will want to see is what you use AI for.
- Be able to show your AI literacy.Who has had which introduction, and when.
- Be able to show human decisions.For high-risk AI: who decided, when and why.
- Put it all in one report.GoalCube produces a report for supervisory authorities and auditors with your inventory, policy, course, decisions and log.
What the law says
- Ireland: Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026)
- Irish law supplementing the AI Act. Signed on 21 July 2026 and in force since 31 July 2026. The market surveillance authorities are designated in S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026.
- Article 70 AI Act – national competent authorities
- Each country designates market surveillance authorities and a single point of contact.
- Articles 75 and 88 et seq. AI Act – the AI Office
- Supervision of general-purpose AI models; extended by the Digital Omnibus.
Questions and answers
Who do we contact in Ireland or Malta?
In Ireland, the AI Office of Ireland is the central point of contact for the AI Act, and questions about personal data go to the Data Protection Commission (DPC). In Malta, contact the MDIA about the AI Act and the IDPC about personal data.
Does the data protection authority supervise AI?
Yes – the GDPR side of all use of AI. In both countries it also supervises certain AI systems under the AI Act: in Ireland, the DPC covers certain prohibited practices and high-risk uses; in Malta, the IDPC covers prohibited practices and high-risk AI in areas such as biometrics and law enforcement.
Can we get guidance?
Yes. The authorities must support small businesses in particular, and the European Commission has published guidelines, including on prohibited AI practices.
Sources
- AI Office of Ireland
- Data Protection Commission (DPC), Ireland
- Malta Digital Innovation Authority (MDIA): artificial intelligence
- Office of the Information and Data Protection Commissioner (IDPC), Malta
- Malta: Artificial Intelligence Regulations 2025 (L.N. 226 of 2025)
- European Commission: market surveillance authorities under the AI Act
- European Commission: the AI Office
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.