What happened
On 24 September 2026, Ireland's Data Protection Commission published 'Responsible AI Innovation: Insights from the Data Protection Commission's Supervision of AI (2021-2025)' — a report documenting the DPC Supervision Function's engagements with large-scale AI (LLMs, recommender systems) and the compliance improvements it secured on lawful basis, transparency, data minimisation and child protection.
Why it matters
The DPC is the EU lead supervisory authority for many of the world's largest technology companies. This report crystallises the DPC's supervisory expectations for AI products in the EU market — indicating where GDPR compliance gaps in GenAI are being found and corrected as the EU AI Act's GDPR interface comes under enforcement pressure. It signals the areas (lawful basis, transparency, minimisation) that DPC investigations will target in AI deployments.
Action needed
AI product providers with EU-facing services should review the report's case studies to benchmark their GDPR lawful-basis and transparency controls, anticipating DPC scrutiny as EU enforcement of AI-related data-protection obligations ramps up.