Irish supervisory authority DPC publishes AI insights report

On September 25, 2026, the Irish supervisory authority (DPC) published its report entitled “Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission’s Supervision of AI (2021-2025)” (the Report). As the EU lead supervisory authority for many leading technology companies with European headquarters in Ireland, the DPC supervised approximately 180 AI products and services, including LLMs, age assurance, facial recognition, recommender systems and agents.

Engaging with the DPC: the expected approach According to the Report, the DPC engages with controllers on a voluntary basis, primarily before launch of a product, operating what it calls a “quasi-regulatory sandbox” focusing on critical issues, high risks and likely harms. As lead supervisory authority, the DPC can relay concerns raised by other EU regulators and may provide guidance in the absence of regulatory consensus.

The Report notes that engagement with the DPC may help organisations demonstrate compliance with Article 31 GDPR by evidencing co-operation with a supervisory authority. The DPC neither approves products nor certifies GDPR compliance and its recommendations are non-binding. However, where critical issues are identified and not addressed, the DPC may use its other regulatory powers to intervene.

The DPC expects controllers to take the following approach: Engage early: The DPC encourages engagement as early as the planning stage and considers a minimum eight-week lead time before launch necessary, with early contact highlighted to prevent launch delays. According to the DPC, early engagement can ensure that foundational design choices meet the GDPR’s requirements, resulting in a more compliant final product.

Engage openly and iteratively: The DPC states that the most effective engagements involve open, honest and considered dialogue between the DPC and the organisation. The DPC expects controllers to answer its questions, including those of other EU regulators, and often to provide access to relevant documentation, technology and commercially sensitive information.

Act on recommendations: The DPC expects controllers to follow up on its recommendations, noting that early engagement gives controllers time to fully address outstanding questions and implement any recommendations before launch. Provide high-quality documentation: Controllers are expected to provide data protection impact assessments (DPIAs) and legitimate interests assessments (LIAs) that are detailed, anticipate likely regulator questions, provide clearly articulated analysis and documented design decisions and, where a data protection officer is designated, reflect their involvement.

Unevidenced, high-level statements of compliance may lead the DPC to request a launch pause. It is also highlighted that training a new AI model will likely require a DPIA. Consider all data protection issues: Although the DPC most often cites issues such as transparency, design and default, data minimisation and legal basis, it reviews all data protection issues during engagements.

It expects controllers to carry out thorough due diligence on all aspects of a product, including its design and user-facing notices. Treat compliance as ongoing: According to the DPC, monitoring live launches and treating data protection assessments, such as DPIAs and LIAs, as “living documents” can demonstrate responsible innovation and help develop safer, more compliant products.

The DPC proactively monitors live AI services and may request post-launch monitoring reports, which require controllers to re-evaluate their DPIAs, LIAs and other risk assessments against real-world data. Key areas of DPC focus Transparency: Controllers are expected to notify individuals before AI training and give a reasonable notice period to exercise their rights.

Additionally, the data protection risks must be explained, not just that data is being processed. Notifications should reach all affected individuals, including non-users (who remain data subjects), through accessible notices addressed to them and, where needed, direct channels such as email.

The DPC warns that insufficient transparency can undermine the validity of a controller’s lawful basis. Legitimate interests: Controllers are expected to evidence data subjects’ reasonable expectations in LIAs, judged at the time of data collection. Importantly, as historical data is unlikely to have been collected with AI training in mind, the DPC considers that its use heightens the need for enhanced transparency.

The DPC also notes a very high threshold for training of AI systems on private messages. Right to object: The DPC expects controllers to make it easy for individuals to object to their personal data being used for AI training. This should work on all devices and before training begins.

The DPC considers any “chilling effect” unacceptable, describing it as any measure that discourages individuals from exercising their right to object, including difficulties accessing an objection form or the use of misleading wording. Data minimisation: The DPC recommends that controllers de-identify, pseudonymise or anonymise training datasets where possible.

Children: The DPC recommends age-appropriate transparency. This includes enhanced onboarding information and plain-English explanations of AI terms and risks (such as the risk of hallucination). Children’s data, as well as accounts where an individual’s age is uncertain, should be excluded from use in AI training.

Users turning 18 should be given notice and a chance to object before their data is used for training. Automated decision-making: The DPC considers that a human trigger or a human appeals process does not, on its own, necessarily ensure compliance with Article 22 GDPR (which gives individuals the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them), and that each phase of deployment must be assessed independently.

For further details, please see: the Report the press release .