Aug 3, 2026 · CloudMount editorial
Brehon Law and the EU AI Act
From Celtic oral law to the EU AI Act: how Brehon Law's honour price and restorative justice foreshadow modern AI compliance frameworks like CloudMount.
A historical analogy, not a legal equivalence
Putting Brehon Law beside the EU AI Act can open a useful discussion about responsibility: how should rules respond when one person’s actions affect another? But a comparison is not a claim of shared legal machinery. Historical Irish legal traditions and a modern EU regulation belong to different institutions, societies and sources of authority.
The comparison does not establish that historical concepts anticipated particular AI Act provisions. Irish businesses must identify their duties in the applicable legislation. A historical reference can prompt reflection; it cannot supply a legal test, exemption or defence.
Turn the responsibility question into a practical inventory
Who is responsible when an AI system affects a customer, employee or applicant? Start by identifying the system, its intended purpose, the people affected and the organisation’s role. The AI Act distinguishes roles such as provider and deployer, with different responsibilities attached to each.
Do not assume that buying a tool settles the classification. Article 25 addresses circumstances in which another actor can become a provider of a high-risk system, including certain changes to branding, purpose or the system itself. Record the reasoning and revisit it when the deployment changes.
Risk classification is a legal exercise, not a metaphor
The AI Act prohibits certain practices under Article 5 and establishes requirements for high-risk systems identified through Article 6 and the relevant annexes. Other provisions address particular transparency situations and general-purpose AI models. These distinctions cannot be replaced by a broad judgement that a tool seems responsible or harmless.
Some employment-related AI uses appear in Annex III, but classification still requires reading the relevant provisions, including applicable conditions and exceptions. Assess the intended purpose and actual workflow.
Human oversight must have substance
Where the high-risk framework applies, Article 14 addresses human oversight, while Article 26 sets out deployer obligations. Define what a reviewer can see, when they should intervene and whether they have the competence, authority and support to do so.
If personal data is involved, assess GDPR requirements separately, including Article 22 where relevant. The AI Act does not displace data protection law or make every human-reviewed process lawful.
Keep reflection separate from evidence
An analogy can make a boardroom discussion more accessible, but an evidence pack needs contemporary material: an inventory, role and risk assessments, supplier documentation, training records and decisions about controls. Identify which records are legally required and which are sensible governance measures.
Historical comparison can encourage leaders to ask better questions about accountability and harm. Compliance itself depends on current law, the facts of the deployment and controls that work in practice.
Sources and further reading
General information only, not legal advice. Regulatory obligations depend on your role, context and the provisions in force.
Want to talk about your compliance?
Book a review