IS boasted in an online statement that it had "breached all the security checkpoints of the agent Kurdistan government and reached the heart of the city of Arbil."
It identified the bomber as Abdulrahman al-Kurdi, indicating that he was an ethnic Kurd.
The bomber struck the main checkpoint on the way to the provincial government headquarters in the northern city just before noon on Wednesday, killing four people and wounding more than two dozen.
The bombing was the worst attack to hit Arbil since September 29, 2013, when militants struck the headquarters of the asayesh security forces in the city, killing seven people and wounding more than 60.
In that attack, the asayesh said a suicide bomber detonated explosives at the entrance to their headquarters, after which they killed four more would-be bombers before a fifth blew up an ambulance rigged with explosives.
Signup to our newsletter and follow us on Facebook and Twitter!
Iraq's three-province autonomous Kurdish region is generally spared the rampant violence plaguing other parts of the country.
But Kurdish security forces are battling IS, which spearheaded an offensive that has overrun large areas of Iraq since June, making it a more prominent target for militants.
The initial jihadist onslaught swept federal security forces aside in the north, allowing the Kurds to take control of a swathe of disputed territory that they want to incorporate into their autonomous region over Baghdad's objections.
IS turned its attention to the north again in August, launching a renewed drive that pushed Kurdish forces back towards Arbil, helping to spark a US-led campaign of air strikes that has since been expanded to Syria.
Backed by the strikes, Kurdish troops have managed to regain some areas seized by IS, as have federal forces backed by pro-government fighters.
But significant territory, including three major cities, remain in the hands of the militants.