By Kieran Harte

In September 2026, the Data Protection Commission (DPC) published its AI Insights Report: Responsible Artificial Intelligence Innovation, providing a detailed overview of its supervision of AI systems between 2021 and 2025.  The report offers a unique insight into how Ireland’s data protection regulator has engaged with some of the world’s largest technology companies as they developed and deployed AI systems across Europe. 

The report highlights the DPC’s regulatory expectations for AI systems but also signals the direction of travel for AI governance, privacy engineering, software development, cybersecurity, data science, and digital transformation across Ireland and the wider European Union. 

A Unique Regulatory Perspective

As the Lead Supervisory Authority for many global technology companies with their European headquarters in Ireland, the DPC has been at the centre of some of the most significant AI governance discussions in Europe.  Between 2021 and 2025, the DPC engaged with controllers on the creation, launch and deployment of approximately 180 AI products and services, including large language models (LLMs), recommender systems, facial recognition technologies, age assurance systems, personalisation engines and AI agents.  The regulator engaged with organisations including Microsoft, OpenAI, Google, Meta, Apple, LinkedIn, TikTok, and others. 

The report emphasises that AI innovation and strong data protection are not competing objectives.  Instead, the DPC argues that privacy-by-design, transparency, accountability and robust governance are prerequisites for sustainable AI innovation. 

The Continuing Importance of DPIAs

A recurring theme throughout the report is the need to identify and mitigate risks at the earliest stages of AI development.  For many AI use cases, this will require a robust Data Protection Impact Assessment (DPIA).  DPIAs provide a structured mechanism for assessing potential impacts on individuals’ rights and freedoms, particularly where AI systems involve profiling, innovative technologies, large-scale processing or the use of sensitive data.  For organisations seeking to deploy AI responsibly, an effective DPIA should be viewed not merely as a compliance exercise but as a key component of good governance and risk management.

The Growth of AI Supervision

One of the report’s most striking findings is the tenfold increase in AI-related supervisory engagements between 2021 and 2025.  The emergence of generative AI has significantly increased regulatory attention, particularly where personal data are used for training, fine-tuning or deploying models. 

The DPC notes that over half of EU organisations that considered using AI but ultimately chose not to cited privacy and data protection concerns as a contributing factor.  This highlights the importance of regulatory certainty in supporting AI adoption. 

For ICT professionals, this reinforces a simple reality: understanding data protection requirements is rapidly becoming a core technical competency rather than a purely legal consideration.

Key Themes from the Report

1.  Transparency Remains Paramount

The DPC identifies transparency as one of the most common shortcomings in AI deployments.  Many AI systems operate as complex black boxes, making it difficult for individuals to understand how their data are collected, processed, used and retained. 

The regulator expects organisations to provide clear and meaningful explanations about:

• How personal data are collected;
• Whether data are used to train AI systems;
• The purposes for which AI models are deployed;
• How individuals can exercise their rights; and
• The risks associated with AI processing activities. 

For software architects and developers, explainability and transparency can no longer be treated as optional features added at the end of a project.  They must be embedded into system design from the outset.

2.  Data Subject Rights in the AI Context

The report also reinforces the importance of safeguarding data subject rights throughout the AI lifecycle.  While transparency is a critical first step, organisations must also be able to facilitate rights such as access, rectification, erasure and objection in practice.  As AI systems become increasingly embedded in business processes, organisations should ensure that governance frameworks, technical controls and operational procedures enable individuals to exercise their rights effectively and without undue complexity.  The ability to demonstrate compliance in this area is likely to remain an important focus of regulatory scrutiny.

3.  Lawful Basis for AI Training

The report devotes significant attention to the use of legitimate interests as a legal basis for AI training.  The DPC expects organisations relying on legitimate interests to undertake robust assessments demonstrating necessity, proportionality and appropriate balancing of individuals’ rights. 

Large-scale scraping of publicly available information for generative AI training remains an area of active regulatory scrutiny.  This issue aligns closely with recent ICS coverage of the European Data Protection Board (EDPB)’s draft guidance on anonymisation and web scraping for generative AI systems, which highlighted the need for organisations to carefully assess the provenance and lawfulness of datasets used for AI training.

4.  Data Minimisation Must Apply to AI

A recurring theme throughout the report is that AI does not create an exemption from fundamental GDPR principles.  Organisations must continue to adhere to data minimisation requirements and justify the necessity of personal data used in AI systems. 

This principle has important implications for:

• Model training datasets;
• Testing and validation data;
• Monitoring and operational logs;
• Synthetic data initiatives; and
• Data retention practices. 

For data scientists and engineers, the traditional assumption that “more data is always better” is increasingly difficult to reconcile with regulatory expectations.

5.  Strong Protections for Children

The DPC identifies children’s data as a priority area and expects organisations to implement enhanced safeguards where AI systems may affect children.  This includes recommender systems, age assurance technologies and algorithmic profiling. 

ICS Members working in education technology, gaming, social media, healthcare and public services should pay particular attention to this aspect of the report.

6.  Automated Decision-Making and Accountability

The report revisits longstanding GDPR concerns relating to automated decision-making and profiling.  Organisations deploying high-impact AI systems must be able to demonstrate effective governance, meaningful human oversight and robust accountability measures.

The report’s observations are particularly relevant to organisations that use AI to support or automate decision-making processes.  Particular care is required where processing may engage the provisions of Article 22 GDPR concerning solely automated decisions that produce legal effects or similarly significant consequences for individuals.  Even where Article 22 does not apply directly, organisations should carefully assess the level of human involvement, the explainability of AI-generated outcomes, and the procedures available to challenge, review or escalate decisions supported by AI.

These expectations are consistent with broader regulatory developments under the EU AI Act and the emerging European framework for AI governance, which place increasing emphasis on transparency, accountability, risk management and human oversight throughout the AI lifecycle.

What Does This Mean for ICS Members?

The implications extend well beyond privacy teams.

For Software Developers

Developers must increasingly consider data protection requirements during system design rather than after deployment.  Privacy-by-design, transparency, auditability and explainability are becoming core engineering requirements. 

For Data Scientists and AI Practitioners

The report underscores the need for careful documentation of training datasets, lawful basis assessments, bias mitigation measures and governance controls.  Organisations should be prepared to justify every stage of the AI lifecycle. 

For Cybersecurity Professionals

As AI systems rely upon increasingly large volumes of data, security controls become critical for protecting both training data and operational environments.  The DPC’s emphasis on risk mitigation aligns strongly with broader cybersecurity obligations under frameworks such as NIS2. 

For Data Protection Officers

The report provides perhaps the clearest indication yet of regulatory priorities in Ireland.  DPOs should review AI governance frameworks, DPIA processes, legitimate interests assessments and transparency notices in light of the DPC’s observations. 

For ICT Leaders and Executives

AI governance is now a strategic business issue.  Organisations that build privacy and accountability into AI programmes early are likely to face fewer regulatory obstacles and enjoy greater stakeholder trust.

Connections with Recent ICS Coverage

Many of the themes identified in the DPC report have already featured prominently in ICS publications and events.

ICS Members may wish to revisit:

• EDPB Draft Guidance on Anonymisation and AI Web Scraping: What Data Protection Professionals Need to Know for insights into emerging European guidance on anonymisation, identifiability and AI training data governance. 
• O’Brien v DPC: What Ireland’s High Court Data Protection Judgment Means for ICS Members for discussion of recent developments in Irish data protection law and accountability expectations. 
• AI Omnibus enters into force: what it means for members, examining recent EU AI regulatory developments.  [ics.ie]
• The ICS Strategic AI Network (SAIN) and AI Lite Bites podcast series, which continue to explore practical AI governance challenges facing Irish organisations.

Looking Ahead

The DPC AI Insights Report delivers a clear message: responsible AI depends on strong data governance.  Drawing on its engagement with approximately 180 AI products and services between 2021 and 2025, the Data Protection Commission demonstrates that privacy, innovation and commercial success are not competing objectives.  Rather, organisations that address legal, ethical and technical risks at an early stage are better placed to unlock the benefits of AI while maintaining public trust and regulatory confidence. 

The report also highlights the importance of considering the broader data protection implications of AI deployment.  As many AI systems rely on globally distributed infrastructure, personal data may be processed across multiple jurisdictions throughout the development, training and deployment lifecycle.  Organisations must therefore ensure that international data transfers comply with GDPR requirements and that appropriate safeguards are in place.  Compliance obligations extend beyond the AI model itself and encompass the wider network of processors, service providers and technical infrastructure that underpin AI-enabled services.

For ICS members, the report serves as both a warning and an opportunity.  It signals rising regulatory expectations, while also providing a practical framework for developing and deploying AI systems that are trustworthy, compliant and aligned with European values.  As AI adoption accelerates across all sectors of the Irish economy, organisations that combine technical excellence with effective governance, transparency and accountability will be best positioned to lead the next phase of digital innovation.