Digital Guardians
AI generated historical illustration, not a contemporary photograph.
At a Glance
Artificial intelligence regulation and online safety are often presented as sudden concerns of the 2020s. In Ireland, however, they belong to a longer history: the State’s attempts to adapt public safeguards, media rules, privacy rights and democratic accountability to each new communications technology. The arrival of generative artificial intelligence accelerated that history rather than beginning it. By 2026, Ireland stood at an important junction, administering national online-safety measures while helping to give practical effect to European rules on AI in a country that hosts the European operations of many of the world’s largest digital companies.
Digital Origins
The modern Irish debate on artificial intelligence and online safety rests on a communications transformation that pre-dates the public internet. During most of the twentieth century, broadcasting was scarce, geographically bounded and relatively easy for the State to licence. Newspapers, cinema, radio and television could be influential, but their channels of distribution were identifiable. Editors, proprietors and broadcasters could be named; material could be scheduled, reviewed and, when necessary, challenged through established legal processes. The internet unsettled each of these assumptions. It allowed publication at scale without a printing press, made foreign services readily available inside the State and blurred the older division between audience and publisher.
Ireland’s academic network, HEAnet, illustrates that the country’s relationship with digital communications began in research and education rather than in mass entertainment. The Higher Education Authority recorded that the network had operated for the Irish academic and research community from 1983–84. Such networks were initially the preserve of institutions, specialists and students. Yet they helped build the infrastructure and technical culture from which general internet access later grew. The story matters because early policy was primarily concerned with connectivity, innovation and economic opportunity. The social risks that would later dominate public discussion—harassment, compulsive design, extremist propaganda, child sexual abuse material, manipulated imagery and automated discrimination—were neither absent from human life nor fully foreseeable in the form they would take online.
By the late 1990s and early 2000s, internet access was becoming a commercial and domestic service. The expansion coincided with Ireland’s wider transformation into a centre for technology investment and internationally traded digital services. The attraction of multinational firms brought employment, infrastructure and expertise, but it also placed Irish institutions in a distinctive position. Decisions made by regulators in Dublin could affect companies serving users across the European Union. This was not initially understood as a constitutional change in the character of Irish public administration, but it became one in practice.
Historical interpretation should nevertheless resist a simple story in which an innocent internet suddenly became harmful. Older media had always raised questions about obscenity, violence, advertising, political influence and the protection of children. What changed was the speed, personalisation and persistence of communication. A broadcast might reach a large audience at a particular time; a platform could rank, recommend and redistribute material continuously, drawing on a user’s previous behaviour. Later AI systems increased the capacity to generate, classify and target content. Regulation therefore had to move beyond judging individual publications towards examining systems: design choices, data flows, recommender mechanisms, reporting processes and business incentives.
Broadcast Legacies
The legislative inheritance for Irish online safety came partly from broadcasting. Broadcasting law developed around the idea that scarce spectrum and licensed services justified public obligations. The Broadcasting Act 2009 created the Broadcasting Authority of Ireland and gave it responsibilities in relation to standards, compliance and the development of broadcasting. It reflected a long-established principle: freedom of expression was important, but media serving the public also carried responsibilities.
That inheritance was useful but incomplete when video platforms and social networks became ordinary parts of family and civic life. A traditional broadcaster controlled a schedule and normally had a settled editorial chain. A video-sharing platform could host material uploaded by millions of users, often from outside Ireland, while its visibility was shaped by automated recommendation. The legal question was no longer only whether a programme met a standard. It was whether the service had adequate systems to reduce foreseeable harm, make reporting possible, provide age-appropriate protections and respond coherently when rules were broken.
European law helped to create this transition. The revised Audiovisual Media Services Directive extended certain safeguards to video-sharing platform services. Its importance lay in recognising that the audiovisual environment had changed. Services carrying user-generated video could not be treated exactly like broadcasters, but neither could they be regarded as legally irrelevant conduits. The directive required Member States to ensure measures protecting minors and the general public, while maintaining regard for freedom of expression and information.
This framework produced a distinctly Irish institutional response. The Online Safety and Media Regulation Act 2022 amended the older broadcasting structure, established Coimisiún na Meán and supplied statutory machinery for online-safety codes. The choice to build from media regulation was historically significant. Rather than inventing an entirely separate internet ministry or relying only on criminal law, the State created a regulator intended to work across broadcasting, audiovisual on-demand services, media development and online safety.
There is an important distinction between evidence and aspiration here. The Act documented a shift in legal powers and institutional responsibility; it did not demonstrate that harmful content would disappear. Nor did it make Coimisiún na Meán an editor of every disputed post. Its framework centred on supervision of platform systems and compliance. That distinction is crucial in public debate, where the understandable desire for immediate removal of harmful material can be confused with a regulator’s actual legal role. Systemic regulation is slower and less dramatic than direct censorship, but it is intended to make safety part of the ordinary architecture of a service.
Privacy Foundations
Irish regulation of AI also grew from the history of data protection. Long before generative AI became a household term, personal information had become a central issue in European digital law. The capacity to collect, combine and analyse data changed the relationship between citizens, public bodies and commercial organisations. Data protection law sought to set boundaries: personal information should be processed lawfully, fairly and transparently; it should be collected for specified purposes, kept no longer than necessary and protected against misuse.
The General Data Protection Regulation, applicable across the European Union from 2018, gave those ideas a powerful contemporary form. It did not regulate artificial intelligence as a single category, but many AI systems involve the processing of personal data. Training datasets, biometric technologies, profiling, automated decisions and chat interfaces can all engage rights protected by the GDPR. The regulation also created the one-stop-shop mechanism for certain cross-border processing, a feature that became especially consequential in Ireland because many large technology companies operate European headquarters there.
The Data Protection Commission consequently became one of the State’s most internationally visible regulators. Its work should not be reduced to a simple narrative of Ireland policing foreign technology firms. The Commission is an independent authority working within a European legal system, with duties that apply to Irish organisations as well as multinational companies. Still, Ireland’s role as country of establishment for major platforms means that decisions, investigations and guidance can carry implications far beyond the State.
When AI systems entered popular use, existing privacy principles provided a starting point rather than a complete answer. The Commission’s 2024 guidance on AI, large language models and data protection stressed issues including lawfulness, transparency, purpose limitation, retention, security, accuracy and the possibility that automated outputs may affect people’s rights. It also noted that publicly accessible personal data remains personal data. This was an important corrective to a popular assumption that material visible online is automatically free from legal and ethical constraints on reuse.
Privacy law also explains why AI regulation cannot be confined to spectacular cases of robots or synthetic images. A recruitment system that ranks applicants, a public-service tool that flags cases for review or a model that produces inaccurate personal claims may be less visually striking than a deepfake, but it can have serious consequences. The historical development of data protection supplied Irish regulators with concepts for addressing such risks: accountability, impact assessment, safeguards and meaningful attention to the persons affected. It also exposed limitations. Data protection cannot alone settle questions about product safety, labour, education, copyright, consumer protection or democratic manipulation. The later AI framework would therefore need to overlap with, rather than replace, privacy law.
Platform Power
Online safety emerged as a major policy concern because platforms altered the scale and economics of public communication. Their services enabled valuable forms of connection: diaspora families could communicate cheaply, small businesses could find markets, campaigners could organise and creators could reach audiences beyond the limits of traditional media. These benefits are part of the historical record and should not be obscured by a catalogue of harms. Yet the same systems could amplify abuse, disinformation, graphic material, fraud and content that encouraged self-harm or hatred.
The issue was not simply that harmful material existed. Harmful speech, images and conduct pre-dated the internet. The newer problem concerned distribution and visibility. Recommendation systems could make choices about what a person saw next; engagement-based design could reward provocative material; reporting mechanisms could be difficult to navigate; and the commercial incentives of a platform might not align with the interests of children or vulnerable users. Public arguments increasingly turned from individual posts to the conditions that made certain posts widely seen.
Ireland’s situation was especially notable because a high proportion of major technology businesses held important European operations in the State. This created a difficult balance. Successive governments wished to support employment, investment, research and innovation. At the same time, the public and European partners expected effective supervision where Irish-established companies operated services used throughout the Union. These objectives are not inherently incompatible, but they can create tension. A regulator requires independence, technical expertise and adequate resources if it is to command confidence while working in a country deeply invested in the digital economy.
The European Digital Services Act responded to platform power through an EU-wide set of obligations. It covers intermediary services and introduces duties that vary with the nature and size of a service. Among its central concerns are transparency, mechanisms for notice and action, protection of users, risk assessment and mitigation for the largest platforms and search engines. It does not require a single European authority to handle every issue. Instead, it combines direct European Commission powers in relation to designated very large services with national Digital Services Coordinators.
Coimisiún na Meán became Ireland’s Digital Services Coordinator. That role added a European dimension to an institution already created through national online-safety legislation. It also illustrates a defining feature of modern Irish digital regulation: domestic bodies operate within shared European legal structures. The practical work is often administrative rather than theatrical—receiving information, supervising processes, collaborating with counterparts, investigating systemic compliance and communicating with users—but its effects can shape how global services function.
Safety Turning
The Online Safety and Media Regulation Act 2022 marked the clearest domestic turning point. Most of its principal provisions commenced on 15 March 2023, when Coimisiún na Meán formally replaced the Broadcasting Authority of Ireland. The timing is worth stating precisely. The Act was passed in 2022; the new regulator and key provisions began operating in March 2023. Conflating enactment with commencement can make legal history appear simpler than it was.
The legislation gave Coimisiún na Meán responsibility for developing online-safety codes for designated categories of services. It also created the office of Online Safety Commissioner. The statutory model was deliberately broader than one concern or one platform. It recognised dangers to children, illegal content, harmful audiovisual material and the need for clearer procedures. At the same time, the legislation did not create a general power to pre-approve or remove all online content. The focus was on regulating services and their protective measures.
That approach reflected both legal necessity and historical experience. A regulator attempting to decide every individual content dispute would face impossible scale, significant free-expression questions and a risk of becoming a substitute for courts or platforms. A systems-based model asks different questions: Are terms and conditions properly applied? Can users report material? Are complaints handled? Are children protected from adult content? Do services assess and reduce risks? These questions do not remove disagreement about difficult speech, but they shift responsibility towards companies that design and profit from digital environments.
Coimisiún na Meán adopted its first Online Safety Code in October 2024. The Code applied binding rules to Irish-based video-sharing platform services and addressed content including cyberbullying, material promoting self-harm or suicide, content encouraging eating or feeding disorders, incitement to hatred or violence, terrorist content and child sexual abuse material. It required appropriate measures such as restrictions on prohibited uploads, user reporting routes, parental controls, content-rating arrangements and age-assurance or age-verification measures where appropriate.
The process of producing the Code is historically revealing. It was not merely drafted within government and imposed without engagement. Coimisiún na Meán issued a call for inputs, held public consultation, consulted its Youth Advisory Committee and notified the proposed rules to the European Commission through the technical-regulations process. Nearly 1,400 submissions were received during consultation on the draft Code and guidance. Consultation does not guarantee agreement, but it creates a documentary trail of competing concerns: child protection, privacy, feasibility, freedom of expression, industry practice and the experiences of people harmed online.
Youth Voices
Children and young people have been central to Irish online-safety policy, though not always in the same way. Earlier public debates frequently treated young people principally as vulnerable recipients of unsuitable content. That concern remains justified: children may encounter pornography, graphic violence, bullying, grooming, harmful challenges or misleading commercial practices. But contemporary policy has increasingly acknowledged that young people are also active participants who understand platforms, create material, navigate peer cultures and can identify problems that adult institutions overlook.
The Youth Advisory Committee associated with Coimisiún na Meán represents this shift. Its consultation on the Online Safety Code gave young people a formal role in a regulatory process. This should not be romanticised. A youth advisory mechanism cannot speak for every child, resolve inequalities in access or remove the need for parents, schools, services and law enforcement to play their own parts. Nevertheless, it moves policy beyond the idea that regulation should be designed entirely about young people without their participation.
The difficult subject of age assurance shows why online safety is not a matter of simple slogans. Many people support restricting children’s access to pornography or content likely to impair their welfare. Yet methods of proving age can create privacy, security and exclusion risks. A system may ask users for identity documents, facial estimates, account data or confirmation from another adult. Each method has limitations, particularly where a person lacks documents, wishes to preserve privacy or is wrongly classified. The historical lesson is that a protective objective does not automatically justify every technical means proposed to achieve it.
The Irish Code therefore speaks in terms of proportionate measures and appropriate age assurance rather than assuming a single universal solution. This is not evasiveness; it reflects the practical diversity of services and the legal requirement to balance safety with other rights. Effective regulation must consider whether a measure works, whom it burdens, how data are handled and whether the system creates new forms of surveillance or exclusion.
Public folklore has sometimes portrayed the internet as a separate realm in which ordinary social responsibilities do not apply. That view has little support in law or experience. The online world is made of human relationships, commercial arrangements and technical systems. Young people who experience bullying online do not leave its effects on a screen. Equally, adults should avoid imagining that all risk comes from unknown strangers. Harm may involve peers, recommender systems, commercial persuasion, impersonation or the circulation of images. Irish policy’s growing attention to systems reflects this more complicated reality.
European Frameworks
Irish regulation of AI and online safety cannot be understood solely through national statutes. Membership of the European Union supplies both the legal setting and much of the practical machinery. The Digital Services Act, the GDPR, the revised Audiovisual Media Services Directive and the Artificial Intelligence Act form a layered regime. Each has a different purpose, scope and enforcement structure. Their overlap can be confusing, but it mirrors the fact that a single digital service may raise questions about privacy, consumer treatment, audiovisual content, platform governance and AI safety simultaneously.
The EU Artificial Intelligence Act, formally Regulation (EU) 2024/1689, entered into force in August 2024. Its rules take effect in stages rather than all at once. This phased application is historically important because public debate often compresses legislation into an imagined single starting date. Some obligations, including certain prohibitions and AI-literacy requirements, applied earlier; the regulation’s wider provisions became fully applicable from 2 August 2026, subject to the Act’s particular transitional arrangements. National legislation was still required to organise enforcement and penalties within Ireland.
The Act adopts a risk-based framework. It prohibits specified practices considered incompatible with European values and fundamental rights, imposes duties on certain high-risk systems and establishes transparency requirements for particular uses of AI. It also contains rules for general-purpose AI models and governance provisions intended to support innovation while managing serious risks. The law is not a declaration that all AI is dangerous. Nor is it an assurance that technical progress will reliably regulate itself. It is an attempt to distinguish uses by their likely effects and to allocate obligations accordingly.
For Ireland, the European dimension has two consequences. First, companies working in or from Ireland must consider EU-wide requirements even where their products are designed for global markets. Secondly, Irish authorities must cooperate with European institutions and other national bodies. This is particularly relevant when a service is established in Ireland but has users throughout the Union. Regulatory sovereignty in the digital age is therefore often exercised through cooperation rather than isolation.
The relationship between the Digital Services Act and the AI Act is especially significant. A recommender system on a large platform may involve AI, while the platform itself has obligations under the Digital Services Act regarding systemic risks. Synthetic media can concern both AI transparency and online-content governance. Personal data used for training or deployment may activate GDPR duties. The legal frameworks are complementary but not identical. A careful historical account should avoid saying that one law solves all problems. Their efficacy will depend on enforcement, judicial interpretation, technical development and the capacity of institutions to understand rapidly changing systems.
Artificial Intelligence
Artificial intelligence is a broad and unstable term. It has been used for decades in computer science, sometimes to describe ambitious research goals and sometimes to market relatively ordinary automated tools. The public prominence of large language models and image generators after 2022 made the term newly immediate. People could ask a system to draft text, generate pictures, summarise material, translate languages or produce computer code. The accessibility of these tools brought AI from specialist workplaces into homes, schools, libraries and small businesses.
That visibility created understandable anxiety. Generative systems can produce convincing but false information, imitate styles, fabricate citations, reproduce biases in data and be used to make non-consensual sexual imagery or political deception. They can also assist with accessibility, research, routine administration and creative experimentation. The historical task is not to decide whether AI is wholly liberating or wholly destructive. It is to identify who gains, who bears the risks and which safeguards can make beneficial uses more trustworthy.
Ireland’s first National Artificial Intelligence Strategy, AI Here for Good, was published in July 2021. It expressed a people-centred and ethical ambition before the public boom in generative AI. Its language shows that concerns about trustworthy AI were already present in policy, even though subsequent technological developments altered the urgency and detail of the debate. The 2024 refresh acknowledged significant changes in technology and regulation since the original strategy. This sequence cautions against viewing Irish AI policy as a reaction only to chatbots; it emerged from a longer attempt to connect innovation with governance, skills, public services and trust.
Government strategy is not law. A strategy may set priorities, coordinate departments and signal intention, but it does not itself create enforceable individual rights or regulatory powers. This distinction became increasingly important as Ireland prepared domestic arrangements for the AI Act. Advice, consultation and policy roadmaps can help identify problems, yet they must eventually be joined by statutory authority, resources and accountable decision-making.
Artificial intelligence also complicates older understandings of online safety. A harmful video once had to be recorded or edited by people; synthetic media can now be produced quickly and cheaply. A fraudster can automate persuasion. A platform can use AI to identify harmful content, but the same technology can misclassify speech or embed discrimination. Moderation itself may become less transparent if automated systems make or influence decisions. Ireland’s regulatory story is thus not one of technology confronting law from outside. AI is becoming part of the systems through which safety rules are implemented, contested and enforced.
National Powers
Ireland’s Regulation of Artificial Intelligence Act 2026 supplied the national legal structure for implementing and enforcing the EU AI Act. The legislation reflected the fact that an EU regulation has direct legal effect, but still requires national arrangements for competent authorities, coordination and sanctions. It represented a further stage in the State’s institutional adaptation: from data protection and broadcast regulation towards a more explicit architecture for AI governance.
The chosen model distributed responsibilities among relevant regulators while providing for central coordination. This was a pragmatic recognition that AI is not confined to a single sector. An AI tool may be used in financial services, health, employment, education, product safety, media or public administration. Sectoral regulators may already understand the domain-specific risks, while a central body can promote coherence, act as a point of contact and undertake functions that should not be fragmented. The model’s success will depend on how clearly responsibilities are defined and how effectively information is shared.
The Data Protection Commission has roles under the AI framework where its expertise is relevant, alongside its existing obligations under data-protection law. Coimisiún na Meán’s online-safety and Digital Services Act roles also create an obvious point of contact where AI is embedded in platforms and audiovisual services. This does not mean that every harmful AI output falls automatically within the jurisdiction of either body. Legal competence remains dependent on the particular service, conduct and law involved.
The Irish approach reveals a broader historical pattern in administrative government. New technologies rarely arrive neatly packaged for a single department. Instead, legislatures layer new functions onto existing institutions, create specialist offices and rely on cooperation. That can be sensible, because it retains experience and avoids needless duplication. It can also make the system hard for citizens to understand. A person harmed by a synthetic image, an inaccurate AI decision or abusive material online may reasonably ask which public body can help. Clear public guidance is therefore not a cosmetic addition; it is part of access to justice.
There is also a democratic question about independence. Regulators need enough distance from both government policy priorities and commercial interests to make credible decisions. They also need accountability: statutory duties, transparent procedures, reporting obligations, rights of appeal and judicial oversight. Arguments that regulation inhibits innovation overlook the costs of unsafe or untrusted technology. Conversely, regulation that becomes vague, burdensome or poorly administered can harm smaller organisations without effectively restraining powerful actors. The history of Irish digital governance will be judged not simply by the number of laws passed, but by whether institutions can apply them fairly and competently.
Democratic Risks
Online safety and AI regulation concern democracy as well as personal welfare. Digital platforms have become spaces in which political argument, news consumption and social mobilisation occur. Their capacity to target advertisements, recommend material and circulate altered images can influence the conditions in which citizens form opinions. AI makes some of these problems more acute by lowering the cost of producing persuasive text, audio and video at scale.
It would be historically careless to claim that Ireland’s democratic life was previously free of propaganda, falsehood or unequal media power. Political rumour, partisan newspapers, anonymous pamphlets and manipulated images all have long histories. The new element is the combination of speed, microtargeting, automation and cross-border reach. A misleading item may be adapted for distinct audiences, spread through networks and amplified by recommendation before traditional verification can catch up. The challenge is not solely to label false content, since political disagreement often involves contested interpretation rather than demonstrable falsehood. It is also to make the systems that distribute information more transparent and accountable.
European AI law recognises that certain systems may threaten fundamental rights, democracy and the rule of law. The Digital Services Act similarly addresses systemic risks associated with very large platforms and search engines. These laws do not guarantee a healthy public sphere. They establish obligations, processes and supervisory powers. The quality of democratic debate will still depend on journalism, education, civic institutions, political ethics and citizens’ willingness to examine claims critically.
Ireland’s own historical experience gives this issue particular resonance. Public communication has long been entangled with questions of national identity, language, religion, conflict and constitutional change. That history should encourage caution about easy solutions. Regulation must protect people from serious harm and illegal conduct without becoming a tool for suppressing lawful dissent or unpopular expression. The distinction is often difficult in practice, especially where content is offensive, misleading or intensely political without clearly being unlawful.
Media literacy is consequently a necessary companion to regulation. It cannot shift all responsibility onto individual users, particularly children facing sophisticated systems designed to hold attention. But citizens need ways to recognise manipulated material, understand why something may have been recommended and distinguish a confident automated answer from a verified source. The best historical interpretation is that law, platform design and public education must work together. None is sufficient alone.
Uncertain Futures
By October 2026, Ireland had travelled a considerable distance from the early academic networks of the 1980s. It possessed a specialist media and online-safety regulator, a national online-safety code, an established data-protection authority with international significance, a role as Digital Services Coordinator and domestic legislation supporting enforcement of the EU AI Act. These are substantial developments, but they should be described as a beginning of mature governance rather than its completion.
Several uncertainties remain. AI technology may change faster than standards and guidance can be revised. Courts will clarify the meaning of statutory terms. Regulators will need technical staff capable of assessing models, data practices, recommender systems and complex corporate structures. Smaller Irish businesses and public bodies will need comprehensible advice, not merely formal obligations. Children’s safety measures will continue to raise questions about privacy and age assurance. Creators will continue to debate the use of their work in model training. Individuals affected by automated decisions will need routes to explanation and redress.
There is no reliable evidence for the popular folklore that a single technical fix will make the internet safe. Nor is there evidence that governments can simply legislate away all misinformation, cruelty or deception without risks to freedom. The more defensible conclusion is modest but important: institutions can require safer design, clearer responsibility, better transparency and more effective remedies. They can make it harder for firms to treat foreseeable harm as somebody else’s problem.
Ireland’s role will remain unusually visible because of its position within Europe’s digital economy. That visibility carries opportunity and responsibility. The country can contribute expertise, support innovation and demonstrate that regulation need not mean hostility to technology. But it will also face pressure when enforcement is slow, decisions are contested or global companies resist national and European demands. Such conflict is not evidence that regulation has failed. In a constitutional democracy, disagreement, scrutiny and appeal are often signs that power is being tested rather than simply accepted.
The historical significance of this period lies in a shift of expectation. The earlier internet was often imagined as a frontier beyond ordinary public control. Irish and European law increasingly reject that premise. Digital services may be global, technically complex and commercially powerful, but they operate among people with rights. The enduring task for Ireland’s digital guardians will be to ensure that innovation serves those people, rather than asking them to absorb its harms as the unavoidable price of progress.
