GDPR and AI tools: a plain-English rule set for Irish SMEs

The most common question from Irish business owners isn't "what can AI do?" It's "am I allowed to put this in?"

The short version

Using an AI tool doesn't change your obligations. You are still the controller of your customers' personal data. What changes is that it becomes very easy for a staff member to paste something into a browser without thinking.

Four rules that cover most of it

1. No identifiable personal data in a general-purpose AI tool unless the business has checked the terms and recorded the decision. Names, addresses, PPS numbers, health details, employee records.
2. No client-confidential material — contracts, pricing, drawings, tender documents — unless the client agreement allows it or you've anonymised it.
3. A human signs off on anything that leaves the business. Quotes, letters, reports, anything a customer sees.
4. Write down which tools are approved. Two or three, chosen deliberately, beats whatever each person happens to have open.

Practical anonymisation

Most of the value comes from structure, not identity. "Client A, a 12-person joinery firm in Galway" gets you the same quality of draft as the real name, with none of the exposure. Teach that habit once and it sticks.

Business-tier accounts matter

Consumer tiers of AI tools often differ from business tiers in how data is retained and whether it is used for training. Check the tier you are actually on, not the marketing page. Where it matters, choose providers with EU data handling options and record why.

Keep a short record

A single page listing the tools in use, what they're used for, what data is permitted, and who approved it. That page is the difference between a considered position and an awkward conversation.

When to get help

If you handle health data, children's data, or you're a data processor for other businesses, get a proper assessment. For most SMEs the four rules above plus a written record is a proportionate response.