The Data Protection Commission published its AI Insights Report on 25 September 2026. The report records what Ireland's data protection supervisory authority drew from its supervision of AI products and services between 2021 and 2025. It is a supervisory publication rather than a binding instrument, and the Commission offers it as guidance for controllers.
The duties the Commission applied come from Regulation (EU) 2016/679, the General Data Protection Regulation, given effect in Ireland by the Data Protection Act 2018. Two themes run through the report. The first is reliance on legitimate interests as the lawful basis for training AI models, which Article 6(1)(f) allows only where the controller's interests survive a balance against the rights and freedoms of the people whose data is processed. The second is the quality of the transparency information given to those people.
The Commission states that it engaged with controllers on the creation, launch and deployment of approximately 180 AI products and services, and names Airbnb, Apple, Deepseek, Google, LinkedIn, Meta, Microsoft, OpenAI, Pinterest, TikTok and X among the companies involved. The systems reviewed covered large language models, age assurance, facial recognition, recommender systems, personalisation and agents. The Commission reports that these engagements secured improvements in lawful basis, transparency, data minimisation and the protection of children.
Most engagements closed with recommendations rather than formal enforcement, and the Commission records its readiness to intervene urgently where risks to individual rights are not satisfactorily mitigated. The report sets no deadline. Its weight falls on any group whose main establishment in the European Union sits in Ireland, because it shows what the Commission expects to see before an AI product launches rather than after a complaint.
Licentium advises AI developers and deployers on the data protection duties that attach to model training and product launch. Work we undertake includes legitimate interests assessments for training data, transparency notices for AI features, data protection impact assessments, age assurance and child protection reviews, and preparation for supervisory engagement with lead authorities in the European Union.