“We’re GDPR Compliant” Doesn’t Cover You in Ireland Anymore

This matters more in Ireland than almost anywhere else in Europe, because Ireland isn’t a peripheral pharma market. It’s home to nine of the world’s top ten pharmaceutical companies, Pfizer, Johnson & Johnson, Roche, Novartis, and others all operate substantial Irish operations. A regulatory change here doesn’t affect a handful of local firms, it touches a disproportionate share of the entire global pharma industry’s European footprint.

What the Health Information Act Actually Requires

The Act’s core provision is a duty for health service providers to share a patient’s personal health data with other health service providers, implementing the EHDS Regulation’s push toward interoperable health data access across the EU. For pharma organizations running clinical trials or research involving Irish health data, this creates a new domestic layer, the Irish Data Protection Commission, HIQA, and the HSE all now play defined roles in EHDS implementation that didn’t exist before this year.

This isn’t a paperwork formality. It changes the practical mechanics of how health data moves between institutions, and any AI tool touching that data, drafting research summaries, processing trial documentation, needs to be evaluated against this new domestic framework, not just GDPR’s general provisions.

What the National AI Office Changes

Ireland designated 15 competent authorities for AI Act enforcement back in September 2025, but the National AI Office, launching by August 2026, is the coordinating body that ties them together, the single point of contact between Irish authorities, the European Commission, and other member states. The Data Protection Commission, already Ireland’s lead GDPR authority and the one-stop-shop supervisor for Meta, Google, Apple, and several other major tech companies headquartered in Ireland, is positioned to carry significant weight in how this plays out for AI systems processing personal data specifically.

For a pharma organization, this means AI tool evaluation in Ireland is about to run through a more defined, more coordinated regulatory structure than it has at any previous point, not because Ireland is becoming stricter for its own sake, but because the coordinating infrastructure that was previously missing is now being built.

What This Means in Practice

Don’t treat Irish operations as covered by a general EU AI governance policy. The Health Information Act and the National AI Office both introduce Ireland-specific mechanics that a general EU policy won’t capture.

Map which AI tools touch health data that could fall under EHDS-related sharing obligations, since the Act’s data-sharing duty applies regardless of whether AI is directly involved in the process.

Watch the National AI Office’s early guidance closely once it’s operational in August, as a newly coordinating authority, its first interpretations will likely set precedent for how existing Irish regulators apply the AI Act to pharma-specific use cases.

Key Takeaways

• Ireland’s Health Information Act 2026 gives domestic effect to the EU’s Health Data Space Regulation, adding obligations beyond general GDPR compliance.
• The National AI Office, launching August 2026, coordinates Ireland’s 15 AI Act competent authorities, with the DPC positioned as a central player for AI systems processing personal data.
• Ireland hosts nine of the world’s top ten pharma companies, making its regulatory shifts globally consequential.
• GDPR compliance alone should not be assumed to cover Ireland-specific EHDS and AI Act obligations.