Ireland’s Data Protection Commission published a comprehensive report on September 25, 2026, detailing its supervision of approximately 180 artificial intelligence products and services between 2021 and 2025. The publication outlines regulatory expectations for technology companies operating across the European Union.
The Irish Data Protection Commission released its extensive review examining the oversight of large-scale artificial intelligence systems, including large language models and recommender systems. As the designated lead supervisory authority for many major technology enterprises headquartered in Ireland, the agency documented its supervisory engagements and the compliance improvements it secured regarding transparency, lawful bases, data minimisation, and child protection.
Regulatory Framework and Voluntary Engagement Through the Quasi-Regulatory Sandbox
Operating under the title “Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission’s Supervision of AI (2021-2025)”, the supervisory authority detailed its approach to managing technology developers. The agency engages with data controllers on a voluntary basis, primarily prior to product launches. This mechanism operates via what the DPC terms a quasi-regulatory sandbox
designed to address critical issues, high risks, and likely harms.
While the DPC neither certifies compliance nor formally approves products, participation can help organizations demonstrate adherence to Article 31 of the GDPR by showing proactive cooperation. However, the agency retains its enforcement powers and will intervene if critical issues remain unresolved. The report highlights that early participation requires a minimum eight-week lead time before a commercial rollout.
Core Supervisory Expectations for AI Developers
The regulatory review establishes specific operational expectations for organizations training and deploying artificial intelligence models within the European market. Developers must treat compliance as an ongoing obligation rather than a one-time check.
- Early engagement: Controllers should initiate dialogue with the agency during the planning stage to ensure foundational design choices satisfy GDPR mandates.
- High-quality documentation: Submissions must include detailed data protection impact assessments and legitimate interests assessments that anticipate regulator inquiries.
- Transparent notices: Individuals must receive clear notifications prior to AI training, explaining processing risks rather than merely stating that data collection is occurring.
- Data minimization: Developers are encouraged to de-identify, pseudonymize, or anonymize training datasets whenever feasible.
- Child protection: Children’s data and accounts with uncertain ages must be excluded from AI training sets, supported by age-appropriate transparency measures.
Managing the Right to Object and Ongoing Compliance Monitoring
Particular attention is directed toward the right of individuals to object to the use of their personal information for model training. The agency expects this objection mechanism to function without error across all devices before training commences. Furthermore, the publication warns against any chilling effect
—defined as administrative hurdles or confusing wording that discourages users from exercising their statutory rights.
Live services face active scrutiny. The agency routinely treats risk assessments as living documents
that require re-evaluation against real-world operational data, prompting post-launch monitoring reports when necessary.