What happened
Ireland's Data Protection Commission published an 'AI Insight' report (analysed in early November 2026) covering its Technology Multinational Supervision Unit's supervision of AI products and services from 2021-2025 — approximately 180 AI products/services, of which 79% of engagements involved generative AI. It documents how the DPC applied GDPR principles to major AI developers (OpenAI, Meta, Google, Microsoft, Apple, LinkedIn, TikTok, X, DeepSeek and others), with case studies on GenAI training transparency, the mobile opt-out bug affecting ~7.7M EEA users, the Meta May 2024 training pause, and 'reasonable expectations' of data subjects. It sets recurring focus areas and the engagement-driven 'quasi-sandbox' supervisory approach, which can request a pause of a launch and use urgency powers.
Why it matters
It is authoritative guidance from the lead EU DPA for Big Tech on how it supervises AI training and deployment, giving AI developers and controllers a clear account of the GDPR red lines (transparency, lawful basis, data minimisation, children, right to object, automated decision-making, technical/organisational measures) and the benefit of early supervisory engagement.
Action needed
AI developers and controllers serving EEA users should treat DPC supervision engagement as a compliance path; keep DPIAs/LIAs as living documents, monitor live launches, and maintain robust opt-out and transparency mechanisms.