Part of the AI Regulation News hub.
Ireland's Data Protection Commission publishes a non-binding supervisory report on about 180 AI product engagements from 2021 to 2025 and sets out how it tests legitimate interests claims for AI training, without approving any product
The report is a non-binding account of supervision, and its own text says the DPC never approves a product through it. Its use is as a record of what the regulator asked of controllers training AI on personal data, above all on legitimate interests, notice and the right to object.
Bottom line: This is a non-binding supervisory report. It creates no new GDPR obligation, and it says "The DPC's recommendations are non-binding in nature". The roughly 180 AI products and services it counts are engagements, not approvals and not findings of infringement.
Who this affects: In a report that binds nobody, the readers with most at stake are data protection officers, AI-product counsel and privacy compliance leads at controllers that train or deploy AI on personal data in the EU/EEA, particularly where the DPC acts as Lead Supervisory Authority.
Issue date: The non-binding report is dated September 2026 on its cover. The DPC news item announcing publication is dated September 25, 2026. The report sets no deadline or transition period.
What changed: Nothing in the law. What is new is a non-binding published account, covering 2021 to 2025, of how the DPC's Technology Multinational Supervision Unit engaged with controllers on AI, with statistics, case studies and the questions it asks of a Legitimate Interests Assessment.
Analysis: On our reading of this non-binding report, the useful part is the checklist the DPC applies to Article 6(1)(f) claims for AI training: transparency set against reasonable expectations, friction in objection forms, necessity, less intrusive options and the age of the data. Transparency was cited in 72% of its recommendations.
Primary sources: Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission's Supervision of AI (2021-2025) (PDF, dataprotection.ie) · DPC news item: Data Protection Commission publishes AI Insights Report, September 25, 2026
- Instrument (EN)
- Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission's Supervision of AI (2021-2025)
- Authority
- Data Protection Commission (Ireland), Technology Multinational Supervision Unit within the Supervision Function
- Jurisdiction
- Ireland, with EU/EEA reach where the DPC acts as Lead Supervisory Authority under the GDPR
- Status
- Published. Supervisory insights report covering 2021 to 2025
- Bindingness
- Non-binding. The report says the DPC's recommendations are "non-binding in nature" and that it never approves a product as GDPR compliant through Supervision. It creates no new obligation
- Issue date / next deadline
- Cover dated September 2026; DPC news item dated September 25, 2026. No deadline
- Scope of the statistics
- The report says all statistics relate to the Technology Multinational Supervision Unit, not the whole DPC
- Law it discusses
- GDPR Articles 5, 6(1)(f), 6(4), 12 to 14, 21, 22 and 35; EDPB Opinion 28/2024; section 134 of the Data Protection Act 2018
- Primary source
- https://www.dataprotection.ie/sites/default/files/uploads/2026-09/DPC-AI-Insights-Report-AC.pdf
What did the DPC publish on September 25, 2026?
A non-binding report. The Data Protection Commission's news item of September 25, 2026 announces a new report on its supervision of AI products and services between 2021 and 2025. The cover is dated September 2026 and carries the full title Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission's Supervision of AI (2021-2025).
The report describes Supervision as separate from complaints and inquiries. It runs on a voluntary basis, mostly before a product launches, and the report calls it a "quasi-regulatory sandbox". Its figures come from one unit, the Technology Multinational Supervision Unit, whose remit is the large multinational technology companies based in Ireland.
The headline number is "approximately 180 AI products and services" engaged with between 2021 and 2025: 143 generative AI engagements and 37 non-generative ones. The report names Airbnb, Apple, Deepseek, Google, LinkedIn, Meta, Microsoft, OpenAI, Pinterest, TikTok and X (formerly Twitter) among the companies whose AI the Supervision Function engaged on. That is a list of engagements. It says nothing about the outcome for any one company.
Are the 180 engagements approvals or findings of infringement?
Neither. The report states that "the DPC will never approve or state that a process, product, or service is compliant with the GDPR through Supervision". It also says "The DPC's recommendations are non-binding in nature".
Recommendations are conditional. The DPC issues one where it has formed the view that the planned processing "may not be GDPR compliant, should the product or service launch as currently designed". Recommendations commonly concern planned processing before launch, though the report also describes recommendations made on post-launch deployments, and it adds that pre-launch recommendations may not reflect the product that actually launched.
Some figures from the report, all limited to the unit's AI work. In 2024 and 2025 combined, 59% of AI products or services that launched in the EU were issued with recommendations. The median engagement drew 3 recommendations; the highest was 18. Nine launches across 2022 to 2025 were delayed or cancelled because of DPC interventions, and the report says 95% of AI engagements launched without delay caused by the DPC.
How does the DPC test a legitimate interests claim for AI training?
Through the controller's Legitimate Interests Assessment, read against EDPB Opinion 28/2024. The report says that Opinion treated Article 6(1)(f) as "a possible legal basis for training AI". Everything below is the DPC's stated approach in a non-binding report, not a new rule.
The report lists what it weighs when assessing an LIA: transparency and the data subject's reasonable expectations; how easy it is to exercise rights, and any friction in request forms; the stated interest; necessity; compatibility with the original purpose; whether less intrusive options exist; mitigation measures; and the controller's own balancing test.
Two positions stand out. On historical data, one case study describes the DPC recommending that a controller not train generative AI on data collected before 2014, because older privacy policies gave users too little basis to expect it; the controller narrowed its dataset. On objection, the report says it is insufficient to offer an objection form only when training begins.
Outside the report's original 2021 to 2025 scope, the DPC adds a view formed in the first half of 2026 on private messages. Relying on legitimate interests to train on them sets a very considerably higher threshold, and "this threshold will be very difficult to achieve in the context of the use of private messaging data for AI training purposes". That is the regulator's assessment, stated in a non-binding document, not a decided case.
What can the DPC do beyond recommending?
Its existing powers, which the report describes but does not create. The executive summary refers to the DPC's readiness to "urgently intervene where risks to individuals' rights are unsatisfactorily mitigated".
The report points to section 134 of the Data Protection Act 2018, which lets the Commission ask the Irish High Court to suspend, restrict or prohibit processing where it considers there is an urgent need to act. One case study describes an application under section 134 made on 08 August 2024. The report also describes voluntary pause requests before processing starts, and formal inquiries under Article 58 of the GDPR.
What would a DPO or AI-product counsel take from it?
The report imposes nothing, so what follows is our reading of its practical signals. The DPC says that, in general, "a minimum 8-week lead time is necessary to enable the DPC to engage substantively". It reports that controllers who came early with good documentation were predominantly able to launch without DPC-caused delay, and that high-level compliance statements without evidence led to requested pauses.
It also states the DPC's view that training a new AI model will likely require a Data Protection Impact Assessment. For counsel preparing an Article 6(1)(f) file, the report's LIA list and its case studies on notice periods, objection forms and historical data show what the regulator has asked other controllers to fix before launch.
What we did not verify
What we opened: the full text of the report PDF published at dataprotection.ie (cover dated September 2026), including the executive summary, the sections on Supervision, recommendations, noncompliance, legal basis, right to object, children and automated decision-making, and Appendix A; and the DPC latest-news listing that dates the publication item September 25, 2026.
What we did not open: EDPB Opinion 28/2024, the Data Protection Act 2018, the DPC's earlier press releases on its Google and X inquiries, the High Court record of the 2024 section 134 application, and the DPC's Regulatory Strategy. We did not see the internal statistics behind the report's charts, and the bar values in its figures did not survive our text extraction.
What we refuse to claim: we do not call the 180 engagements approvals, clearances or findings of infringement; we do not treat the report's case studies or its list of ongoing inquiries as final findings of infringement against any named company; we do not say the report creates new GDPR duties; we do not extend its statistics beyond the Technology Multinational Supervision Unit; and we do not predict how the DPC will treat any future product. The report names controllers in some case studies and inquiry lists; we do not repeat those names in connection with outcomes here.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
The DPC's AI insights report is non-binding and approves nothing, but it shows how Ireland's lead regulator reads a Legitimate Interests Assessment for AI training: notice before training, an objection route that works before processing starts, and scrutiny of old data and private messages. Teams engaging the DPC on an AI launch would, on the report's account, plan for at least 8 weeks and complete documentation.
Source File
https://www.dataprotection.ie/sites/default/files/uploads/2026-09/DPC-AI-Insights-Report-AC.pdf
Open the report PDF and confirm: the full title and September 2026 date on the cover; "approximately 180 AI products and services" and the 143 and 37 split in the Supervision of AI section; the never-approve statement in What does Supervision engagement entail?; the conditional recommendation wording and the "non-binding in nature" sentence in Supervision Recommendations and Analysis; and the LIA list under Legal Basis. Then check the DPC latest-news page for the September 25, 2026 publication item.
Recommendations are made where the DPC has formed the view that the proposed/planned processing may not be GDPR compliant, should the product or service launch as currently designed. ยท Data Protection Commission, Responsible Artificial Intelligence Innovation report, September 2026
FAQ
Is the DPC AI insights report binding?
No. It is a supervisory report. It says the DPC's recommendations are non-binding in nature, and it creates no new GDPR obligation. The underlying GDPR and Data Protection Act 2018 duties already apply.
Did the DPC approve about 180 AI products?
No. The report counts approximately 180 AI products and services the DPC engaged with from 2021 to 2025. It states that the DPC will never approve or state that a product is GDPR compliant through Supervision.
Does the report say legitimate interests can support AI training?
It says EDPB Opinion 28/2024 treated Article 6(1)(f) as a possible legal basis for training AI, and it describes how the DPC assesses each Legitimate Interests Assessment. For private messages, it says the threshold will be very difficult to achieve.
When was the report published?
The cover is dated September 2026, and the DPC news item announcing publication is dated September 25, 2026. The report sets no deadline.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.