In September 2026, the Data Protection Commission (DPC) published its “Responsible Artificial Intelligence Innovation: Insights from the Data Protection Commission’s Supervision of AI (2021–2025)” (Report).

The Report is an insights and lessons-learned document that draws on the DPC’s five years of experience and engagement with organisations developing and deploying AI products and services. The Report provides the most detailed account to date of the scale, direction and practical operation of the DPC’s supervision of AI under the remit of the GDPR.

This article, the first in a series examining the Report, considers the growth and composition of the DPC’s AI-related supervisory activity, the operation of its voluntary Supervision Function and the practical effect of pre-launch regulatory engagement on AI product development and launch where the GDPR applies.

Technology Multinational Supervision Unit

The Report is based on the work of the DPC’s Technology Multinational Supervision Unit (TMSU). The TMSU operates within the DPC’s Supervision Function and engages principally with the very large, technology companies for which the DPC acts as the lead supervisory authority (for relevant cross-border processing) under the GDPR’s consistency mechanism.

The Supervision Function is separate from DPC’s complaint-handling and statutory-inquiry functions. Its engagements are generally voluntary, forward-looking, and conducted before a product or service (which processes personal data) is launched in the EU. The DPC describes this model as operating a “quasi-regulatory sandbox”, allowing it to examine proposed processing of personal data, identify significant data protection risks, and make recommendations before the relevant processing begins. The DPC undertakes this work in cooperation with other members of the European Data Protection Board, where appropriate. Its supervisory engagements focus on red-line issues, high risks, likely harms to individuals and issues that the DPC considers may prevent a product or service from proceeding in its proposed form.

Importantly, an organisation’s participation in consultations or engagements with the DPC  does not result in regulatory approval. The DPC does not confirm that a product or service complies with the GDPR, nor does it approve a controller’s legal basis, data protection impact assessment (DPIA) or technical safeguards. However, the Report indicates that this Supervision can provide controllers with an opportunity to identify and address material concerns before launch.

Although the recommendations are non-binding, they may have significant consequences. The DPC makes recommendations where it considers that a proposed product or service may not comply with the GDPR if launched in its existing form. If a controller does not address a material concern, the matter may progress beyond voluntary Supervision and the DPC may consider using its formal statutory powers (an example being the interim injunction the DPC obtained, for the first time, against X in September 2024 regarding the training of user personal data to train X’s AI model, Grok).

AI engagement statistics

Between 2021 and 2025, the TMSU engaged with controllers regarding approximately 180 AI products and services. The companies involved included Apple, Google, Meta, Microsoft, OpenAI, TikTok and X, among others.

The number of AI engagements increased tenfold during the five years. In 2021, approximately one in every 35 Supervision engagements concerned AI. By 2025, the proportion had increased to approximately one in four.

Generative AI accounted for the majority of engagements recorded. Of the approximately 180 AI engagements covered by the Report, 143, or 79%, concerned generative AI. This is notable because the DPC began separately recording generative AI only in 2023. The number of such engagements increased from 25 in 2023 to 82 in 2025.

Common supervisory issues

Among the most common issues, transparency was the most frequently cited, appearing in 72% of the DPC’s recommendations. The Report attributes its importance to the complexity and relative novelty of AI processing, which may make it difficult for individuals to understand that their data is being processed, the purposes for which it is being used and the data protection rights available to them.

In looking to the rest of the top five issues, the DPC highlighted: (1) technical and organisational measures; (2) privacy by design; (3) data minimisation; and (4) legal basis. We will go through some of these key issues in later articles in this series.

The number of recommendations made by the DPC provides further context. In 2024 and 2025, 59% of AI products and services that were launched in the EU following Supervision received DPC recommendations. The median number of recommendations was three, although one engagement resulted in 18 recommendations. The fact that a product received recommendations did not necessarily prevent or delay product launch. It indicated that the DPC had identified measures which, in its view, should be addressed in connection with the proposed processing both: (i) before launch; and (ii) the DPC’s ongoing monitoring expectations in the post-launch phase.

Timelines and product launches

The Report provides a detailed account of the effect of Supervision on product launch timelines. It states that the TMSU generally requires at least eight weeks for substantive pre-launch engagement. Controllers have not, however, always allowed that period, with many approaching the DPC substantially closer to the intended launch date. According to the DPC, late engagement may limit the time available to understand the proposed processing, test the controller’s analysis and implement any resulting recommendations.

Across the five years, 95% of the AI products and services considered through Supervision launched without delay attributable to the DPC’s engagement. Nine launches were delayed or cancelled following DPC intervention: one in 2022, one in 2023, four in 2024 and three in 2025. These figures suggest that Supervision does not ordinarily prevent launch, but may affect timelines where the DPC identifies an unresolved material issue.

What the Stats Tell Us & Future William Fry Insights

The Report provides useful insights into the scale, direction, and practical consequences of the DPC’s supervision of AI where personal data is concerned (and, by extension, the GDPR). It makes the DPC’s expectations (at each stage of pre- and post-launch) known and provides an important basis for examining how established GDPR requirements are applied to AI development and deployment in practice.

Any controller developing or deploying an AI product which processes personal data should use the Report as an important guide for GDPR compliance. Any controller consulting with the DPC should be prepared to provide complete and technically specific documentation, allow sufficient time for substantive review and demonstrate that proposed safeguards will operate across the full remit of an AI product post-launch (from product interfaces and interactions with each category of data subject).

This article is the first in a series considering the principal themes arising from the Report. Further articles will follow that examine transparency; legitimate interests and the right to object; the processing of children’s data; and practical takeaways for organisations, including good documentation, post-engagement monitoring and the broader implications of the DPC’s findings.

If you wish to discuss this topic in more detail, please contact Rachel Hayes, Conor Forde or any member of our  Technology team.

Contributed by Yashasvi Maleyvar