How to use this Checklist The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (EU GDPR) distinguishes between controllers (who determine the purposes and means of processing personal data) and processors (who process personal data on behalf of the controller). For further information, see Practice Note: Key definitions under EU data protection law. Where data is processed by a processor on behalf of a controller, Article 28(3) of Regulation (EU) 2016/679, EU GDPR sets out an extensive list of mandatory provisions which must be included in a contract between them. These requirements (which the parties are free to supplement and include in any order) are detailed in the below Checklist. The third column can be used to record observations or comments as the Checklist is worked through. The

Artificial intelligence (AI) is being used and being considered for use throughout the employment lifecycle, from recruiting new employees to performance management of existing employees and termination of employment. Additionally, the use of AI as part of an employee’s daily activities in the workplace adds to the complexity of managing and leading employees. This Practice Note focuses on the following two areas: • employees using AI as part of their daily activities in the workplace, and • AI used through the employment lifecycle AI in daily activities There can be a number of reactions from employees at the prospect of AI becoming an integral part of their role: • employees may be reluctant to use AI for various reasons—lack of training, concern for job security, and/or fear of the unknown • employees may become less efficient by spending time on AI tools which are more fun than productive, which are not being used correctly to maximise efficiencies • employee’s over-reliance on AI may have a negative impact on output. For example, the documents produced

FORTHCOMING CHANGE: This Practice Note reflects the current legislative position. However, note that legislation is currently being drafted in Ireland to facilitate the implementation and enforcement of Regulation (EU) 2024/1689, the EU Artificial Intelligence Act. This Practice Note provides a summary of Irish data protection law as it applies to the use of artificial intelligence (AI), while also referencing Regulation (EU) 2024/1689, the EU Artificial Intelligence Act (EU AI Act). It covers the following: • personal data, data protection law and the EU AI Act • understanding the controller/processor relationship and obligations • general obligations on controllers • EU GPDR principles: ◦ lawfulness, fairness and transparency ◦ purpose limitation ◦ data minimisation ◦ accuracy ◦ storage limitation ◦ integrity and confidentiality (security) ◦ accountability • Data Protection Impact Assessments (DPIAs) • data protection by design and by default • data subjects’ rights • automated decision-making in AI systems and the role of human oversight • children’s personal data • generative AI It focuses on the EU General

The legal technology landscape is evolving rapidly, creating a whole new vocabulary of artificial intelligence (AI) related terms and phrases. For those who are not product developers or software engineers, it is helpful to define what these terms mean. This Practice Note is designed to provide legal professionals with a better understanding of key AI concepts. The basics • Algorithm: a coded set of instructions for software that solves a problem or performs a computation • Artificial Intelligence (AI): computer software and systems that are capable of demonstrating human intelligence. They can learn, plan, reason or process natural language as they go rather than only relying on pre-programmed tasks, eg speech recognition, computer vision, translation between (natural) languages, as well as other mappings of inputs. In the EU and UK, different approaches have been taken to defining AI, see Practice Notes: The EU AI Act and Artificial intelligence—UK regulation and the National AI Strategy • Natural Language Processing (NLP): a type of AI used to analyse, understand, and generate human language. For legal documents, NLP analyses

Ireland—Commercial: The LexisNexis Ireland—Commercial practical guidance team has published a new Practice Note which provides a glossary of key terms and concepts designed to provide legal professionals with a better understanding of key artificial intelligence (AI) concepts The legal technology landscape is evolving rapidly in front of our eyes, creating a whole new vocabulary of artificial intelligence (AI) related terms and phrases. For those of us who are not product developers or software engineers, it is helpful to define what these terms mean. This Practice Note is designed to provide legal professionals with a better understanding of key AI concepts.

Introduction This Practice Note considers the current Irish intellectual property law framework governing artificial intelligence (AI) (or machine learning) in Ireland. We provide an overview of the key pieces of IP law that apply to AI systems and models and in particular we examine the issues concerning IP rights in AI inputs (eg training data), the AI system itself and AI outputs. What is artificial intelligence? There is no single definition of AI. Broadly speaking it is the simulation of human intelligence in machines, generally computer systems. Regulation (EU) 2024/1689, the EU AI Act defines AI system as: ‘… a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.’ For information on commonly used terms associated with AI, see Practice Note: Ireland—Artificial intelligence—glossary of terms for legal professionals. For

What is an assignment? An assignment is an immediate transfer of an existing proprietary right, vested or contingent from one party to another. In essence, one party’s rights under the contract are assigned to someone else: for example, in a contract between (A) and (B), (B) assigns their rights under the contract to (C). The assignment of a contractual right does not create privity of contract between the assignee (C) and the promisor (A). This means that where (A) contracts with (B), no contractual rights or liabilities can attach to (C). Relevant terminology • legal chose in action: a right that can be enforced by an action at law, and is also recognised in equity, for example, a debt due under contract • equitable chose in action: a right that was enforceable only by a suit in equity prior to the Supreme Court of Judicature Act (Ireland) 1877 (Ireland) (SCJA(I) 1877 (IRL)). A right connected with some form of property, such as

Security over choses in action, such as debts and other contractual rights, is often taken by way of an equitable or statutory security assignment. They are essential collateral for many financings, and it is important to understand how they are created and their effects. This Practice Note explains: • what assignments by way of security are • which types of assets they are used for • whether they take legal, statutory or equitable form and the features of each of these types of assignment • why it is important to serve notice of an assignment by way of security • what registrations and filings should be made in respect of such security interests What is an assignment by way of security? An assignment by way of security is a type of mortgage. It involves: • an assignment (ie transfer) of rights by the assignor to the assignee subject to: • an obligation on the assignee to reassign those rights back to the assignor upon the discharge of the obligations

An auction sale is designed to elicit competitive bidding for a target company or business among interested parties at the highest price and on the best possible terms for a seller. The seller will generally take control of an auction process and will appoint various advisers to act on its behalf. One of the first and most important advisers will be a corporate finance firm who will market the sale of the target on behalf of the seller. Such firms tend to have auction experience and knowledge of the market in which the target operates. The auction process generally commences upon completion of a confidential information memorandum concerning the target company and its business. The information memorandum will be distributed by the corporate finance advisers to carefully selected potential buyers. Each such party will have signed a confidentiality agreement before receiving the information memorandum. For example, see Precedents: Confidentiality agreement—private M&A—share purchase—auction sale and Confidentiality agreement—private M&A—asset purchase—auction sale. A letter setting out details of the auction process (ie the process letter) is

This Practice Note provides an outline of the process for obtaining authorisation from the Central Bank of Ireland as a (re)insurer. It considers the requirement for authorisation under SI No 485/2015 European Union (Insurance and Reinsurance) Regulations 2015 (Ireland) (the Insurance and Reinsurance Regulations) and the process for obtaining authorisation. It also considers the conditions that an applicant may be required to fulfil before the authorisation is granted, the refusal and withdrawal of an application and post authorisation amendments. When is authorisation required? A person is required to obtain an authorisation under the SI No 485/2015 European Union (Insurance and Reinsurance) Regulations 2015 from the Central Bank of Ireland (CBI) to carry on the business of insurance under any class, or any reinsurance activity, in Ireland. Providing insurance without the requisite authorisation is an offence. There are certain limited exemptions from the requirement to obtain an authorisation from the CBI (for example, based on financial thresholds (such as balance sheets, technical provisions,

This Practice Note outlines key elements regarding the authorisation of a crypto-asset service provider (CASP) in Ireland. In particular, this Practice Note outlines the services which require authorisation as a CASP, the CASP authorisation process, the scope of permitted CASP activities, and the relevant exemptions and transitional provisions. It covers the regulatory framework for CASP authorisations in Ireland, including the application of the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) (MiCAR) and the role of the Central Bank of Ireland (CBI) as the national competent authority for the supervision of CASPs in Ireland. It details the types of crypto-asset services that require authorisation, the step-by-step authorisation process, and the conditions applicants must meet. The Practice Note also addresses the notification procedure for existing regulated financial service providers wishing to provide crypto-asset services under MiCAR, transitional provisions for existing virtual asset service providers (VASPs), and practical considerations for preparing a successful

Regulatory framework The Markets in Financial Instruments Directive (Directive 2014/65/EU) (MiFID II), the Markets in Financial Instruments Regulation (Regulation (EU) No 600/2014) (MiFIR) and their delegated acts set out the regulatory framework for the authorisation, operating conditions and supervision of investment firms at EU level. MiFID II was transposed into national law in Ireland pursuant to the SI No 375/2017 European Union (Markets in Financial Instruments) Regulations 2017 (Ireland) (SI No 375/2017 (IRL)) (the MiFID Regulations) which came into operation on 3 January 2018. MiFIR is an EU regulation which does not require transposition into national law and is therefore directly effective in Ireland. Scope of the MiFID Regulations The SI No 375/2017 (IRL) apply to ‘investment firms’. An investment firm is defined as any person (a natural or legal person) whose regular occupation or business is the provision of one or more investment services to third parties or the performance of one or more investment activities on a professional