AI Agents for Irish SMEs and GDPR

Honest Consultancy. Updated 3 November 2026

What is an AI agent, in plain terms?

It is software that uses a large language model to complete a task by taking steps, usually by reading information, calling other systems and producing a result. A chatbot answers. An agent can also look up an order, draft a reply or update a record.

That extra ability is where the value and the risk both come from. The more systems an agent can reach, the more useful it becomes, and the more damage a wrong step can do. OWASP, which publishes security guidance for these applications, maintains a list of the most serious risks to them.¹ So the first design question is what the agent is allowed to do without asking anyone.

Which jobs suit an AI agent in a smaller business?

Good first jobs share three traits: they repeat often, a person can check the result quickly, and a mistake is cheap to fix. In our view, these are sensible places to start.

Be careful with anything that decides something important about a person, gives regulated advice, or spends money without a check. Those are poor first projects, whatever a demo suggests.

Models can also be wrong in a confident tone. The Data Protection Commission warns that relying on AI outputs without critical human analysis or intervention can create risks around automated decision-making.² Design for checking from the start, and measure how often the agent is right on your own examples before it goes near a customer.

Support questions answered from your own help content, with a clear route to a person.
An internal assistant that finds answers in your policies, procedures and contracts.
Lead qualification: asking the same first questions, then passing the conversation to your team.
Document processing: pulling fields from invoices, forms or delivery notes for a person to approve.
Drafting: first versions of replies, reports and summaries that a person edits and sends.

What does the Data Protection Commission say to check?

The DPC published guidance on AI, large language models and data protection in July 2024, and it reads as a good starting checklist for any Irish business.² It asks organisations using these products to understand the following.

If you cannot answer these for a tool your team already uses, that is the place to start, ahead of any new project.

What personal data the system uses, how it uses it, and where the data goes when a third party is involved.²
Whether the provider keeps your data or re-uses it, and whether its documentation explains this clearly.²
Whether you are a data controller, and whether you need a formal risk assessment or a data protection impact assessment.²
How you would meet an access, correction or deletion request.²
How long data is kept, because without a retention schedule you risk breaching storage limitation.²
How third-party security works, including whether filters meant to block personal data can be circumvented, and who is responsible for that.²

Which parts of GDPR matter most for an AI agent?

Five come up on almost every project. GDPR applies to AI the same way it applies to any other processing of personal data.³

A data protection impact assessment is mandatory where processing is likely to result in a high risk to people's rights and freedoms.⁴ The DPC also suggests considering one where processing is new or involves minors or vulnerable people.² Even when it is not required, working through one is a useful way to find problems early.

The European Data Protection Board adopted an opinion on AI models in December 2024, addressing when models can be considered anonymous and how legitimate interest may apply.⁵ It is most relevant if you train or fine-tune models, which few smaller businesses need to do.

A lawful basis and a clear purpose. Article 5 limits you to specified purposes, and Article 6 requires a lawful basis. Reusing customer emails to train or test a system is a new purpose to think through.³
Transparency. People should know their data is being processed and why, so review your privacy notice before launch.³
Processors. Article 28 requires a contract with any provider processing personal data on your behalf, so read the data processing terms.³
Automated decisions. Article 22 gives people rights around decisions based solely on automated processing that have legal or similarly significant effects. A person checking the output needs real authority to change it.³
Transfers. Chapter V applies if personal data leaves the EEA, including through a provider's support or model hosting.³

What does the EU AI Act ask of a business using AI?

For most SMEs using AI for routine work, three things matter today: the prohibited practices, AI literacy, and telling people when they are dealing with AI. The prohibitions and the AI literacy duty have applied since 2 February 2025.⁶

The dates have moved once already, so check the Commission's page for the current position before you rely on them.⁶ A lead qualification agent is one thing, while a system that sorts job applications is quite another. If your project touches decisions about people, take advice before you build.

We treat this as AI policy and readiness work: which tools your team may use, with what data, who checks the output, and how staff are trained. Your solicitor handles the legal advice.

AI literacy. Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and others using AI on their behalf.⁷
Transparency. Article 50 requires that people are informed when they interact directly with an AI system, unless it is obvious from the context, and the Commission says these duties apply from 2 August 2026.⁸⁹
High-risk systems. Using AI in areas such as employment or education can make a system high risk. After the AI Omnibus, those rules apply from 2 December 2027 for stand-alone systems, and from 2 August 2028 for AI embedded in regulated products.⁶¹⁰

How do we keep data under our control?

Run the model inside your own cloud account where you can, and send it only what it needs. Both AWS and Microsoft say they keep prompts away from model providers on their managed services, and both document how to control where processing happens.¹¹¹²

Our guide to private AI on your own AWS or Azure account covers the settings to check. The DPC also warns that personal data on your own website may be scraped for AI training, so review what you publish about staff and customers.²

Strip personal data from prompts when the task does not need it.
Limit the documents an assistant can search to those the user may already read.
Give agents the narrowest access that lets them work, and require approval for actions that are hard to undo.
Log what the agent read and did, and set a retention period for those logs.²
Tell staff which public AI tools they may not paste customer data into.

How should an SME start?

Pick one process, measure it, and prove the value before you build anything larger.

Do the sums honestly, including the model's usage cost, the time spent checking, and the upkeep. Some processes will not be worth automating, and it is better to find that out on paper. Grants may help small firms with digital projects, so ask your Local Enterprise Office about current schemes.¹³

List the repetitive work your team does each week, and how long each item takes.
Rank it by time saved, ease of checking, and how sensitive the data is.
Choose one process, and write down what a good result looks like.
Test on your own real examples, with personal data removed where you can.
Run it with a person approving every output, and track how often they change it.
Reduce the checking only when the numbers support it.

Frequently asked questions

Is ChatGPT or a similar tool allowed under GDPR?

GDPR does not ban particular tools. It applies to how you use them. Work through the DPC's questions on data flows, re-use and retention for each tool before staff put personal data into it.²

Do we have to tell customers they are talking to AI?

Under Article 50 of the AI Act, people must be informed when they interact directly with an AI system, unless that is obvious from the context.⁸ Check how the duty falls between provider and deployer for your setup.

Do we need a data protection impact assessment?

It is mandatory where processing is likely to result in a high risk to people's rights and freedoms.⁴ If you are unsure, the DPC's guidance is the place to start, and doing one anyway is rarely wasted.

Can an AI agent make decisions about customers on its own?

Be careful. Article 22 of GDPR gives people rights around solely automated decisions with legal or similarly significant effects.³ Keep a person with real authority in the loop for anything of that kind.

Sources

See software, data and AI See the AI opportunity review

AI agents for Irish SMEs: what works and what is safe under GDPR