AI governance in Ireland: the policy your clients will ask to see
Few Irish practices have a bad AI policy. Most have none, which becomes a problem at a very specific moment: the first client pre-qualification questionnaire that asks how the firm controls AI use on their project.
That question is now appearing in Irish tender documentation, and the answer cannot be assembled during a clarification window. AI governance is the artefact that answers it, and the firms holding one are winning a small advantage over the firms explaining that they are working on it.
What AI governance actually means for a construction or engineering firm
Not an ethics charter. Not a statement of principles. A working document that a project lead can act on without ringing anyone.
Good AI governance in an AEC practice covers six things.
Which systems are approved, named, with the tenancy they run in. Not a category. The actual products.
What may go in and what may not. The clause everyone remembers and the one that prevents the scenario every Irish COO describes: an enthusiastic junior pasting a client's confidential masterplan into a public model.
Who verifies what. Anything touching calculation or specification carries a named human, because close enough is a liability and Irish building regulations and the Eurocodes do not accept a model as an author.
What gets logged. Which decisions are recorded, where, and who can read them afterwards.
Who to ask. One named person. A policy with no escalation route gets ignored at the first ambiguous case.
How staff are trained on it. Which connects governance to the Article 4 literacy duty rather than leaving them as separate exercises.
Why AI governance in Ireland is a commercial document, not a compliance one
The framing matters because it changes who writes it and how fast it gets approved.
A compliance document is written to survive an audit that may never happen. A commercial one is written to answer a client, and clients are asking now. Irish professional networks are tight, so a firm that handles the question well once tends to get asked about it by a peer within the month.
There is also a regulatory floor underneath it. The EU AI Act applies to Irish firms directly, which is a different position from the one British practices are working out, and the obligations have been live since February 2025.
Writing an AI governance framework you will actually use
The output should be two pages. Firms that produce thirty get a document nobody opens.
Start from the systems in use rather than from a template. List what people actually open, which is always more than the approved register shows. Write the boundary for each. Name the verifier for each category of output. Decide what is logged. Name the person to ask.
External structure helps if you want something to hang it on. ISO/IEC 42001 is the management system standard for AI, and the National Standards Authority of Ireland is the route for Irish firms considering certification. Most practices do not need certification. They need the two pages.
Who owns AI governance in an Irish practice
This is where it stalls.
IT owns the tooling and has no authority over professional judgement. Quality owns the process and often does not know what the tools do. The MD owns the risk and does not have the time. So it sits unowned, and unowned documents do not get written.
The arrangement that works in smaller Irish firms, where individuals already carry broad remits, is a single accountable owner at director level with one technical contributor and a fortnight deadline. Committees produce principles. One person with a deadline produces a policy.
What AI governance will not do
It will not make anyone competent. A policy tells people where the line is and teaches them nothing about doing the work well. Governance without literacy produces a firm that knows what it must not do and still cannot get a usable result, which is why the two belong together.
It will not survive being written once. Tools change, tenancies change, and a policy naming a product the firm stopped using last year damages credibility more than having none.
It will not substitute for data protection work. GDPR obligations run alongside the AI Act and are supervised separately, so a firm with a strong data protection position has not thereby covered its AI governance.
And it will not, on its own, win work. It removes a reason to be excluded, which is a smaller claim and a true one.
Where to start with AI governance this month
Take an hour and list every AI system anyone in the firm opens. Write the boundary for the three that touch client material. Name one owner. That is a credible starting position and it is more than most Irish practices currently hold.
The moment governance stops being theoretical is the moment something starts acting on the firm's behalf without a person watching, which is covered in AI agents in Ireland. A policy written for a team that has never used the tools describes a firm that does not exist.
The sector-specific detail, including the governance questions that come up in AEC tender documentation, is in AI governance for construction and engineering firms.
AI Institute builds the policy alongside the training rather than after it, because a document written without the people who have to follow it tends to describe an ideal firm. The built environment programmes cover both.
