Ireland’s DPC Report: What Five Years of AI Regulation Means for Global Enterprises and Professional Services

The regulatory landscape for artificial intelligence is maturing rapidly. As enforcement bodies move from theoretical guidelines to active supervision, organisations can no longer rely on vague assurances from software vendors.

A recent publication from Ireland’s Data Protection Commission (DPC) provides a clear window into how privacy regulators are scrutinising AI deployment in practice. For international professional services firms, global enterprises, and smaller businesses alike, the message is unequivocal: compliance obligations apply to every organisation handling personal data through AI, regardless of whether you build models or simply buy them off the shelf.

Inside the DPC’s Five-Year AI Supervision Insights

In September 2026, the DPC released a comprehensive report titled "Responsible Artificial Intelligence Innovation, Insights from the Data Protection Commission's Supervision of AI (2021–2025)". The document summarises half a decade of active oversight, offering practical visibility into regulatory expectations.

According to the news release, the DPC engaged with data controllers on approximately 180 AI products and services between 2021 and 2025. Over this period, regulators assessed thousands of pages of technical documentation, briefings, risk assessments, and organisational measures.

Two recurring themes dominated the DPC's supervisory focus: * Lawful basis: The use of legitimate interests as a legal basis for AI training. * Transparency: The critical need for robust transparency regarding novel and frequently opaque data processing activities.

Despite the technical complexity of the systems reviewed, the DPC’s findings highlight core data protection principles in action. The regulator noted that it successfully secured concrete improvements in lawful bases, transparency measures, data minimisation, and the protection of children. Crucially, the DPC asserted that innovation and rigorous data protection are not mutually exclusive—and confirmed that it will intervene urgently where risks to individuals are not adequately mitigated.

Beyond Big Tech: The Reality for Professional Services and Enterprises

It is easy for business leaders to view reports on AI supervision through the lens of multinational technology giants training foundational models. However, the regulatory exposure extends much further down the corporate chain.

Any international firm—whether a legal practice, management consultancy, financial institution, or global enterprise—that inputs client or staff personal data into an AI tool is acting as a data controller. Consequently, you carry direct compliance obligations under data protection laws.

If your organisation uses third-party AI applications for document review, client communications, HR screening, or workflow automation, you must be able to answer two fundamental questions that regulators are actively examining: 1. What is your lawful basis for processing personal data through this tool? 2. What do you tell individuals (clients, employees, and stakeholders) about how their data is processed?

Relying on vendor marketing materials is insufficient. Global enterprises and professional services firms must secure documented, verifiable answers to these questions to satisfy multi-jurisdictional compliance mandates.

Practical Steps for International Compliance

Navigating multi-jurisdictional AI obligations requires a structured, evidence-based approach. Drawing from the DPC’s supervisory insights, organisations should review their current AI integration practices against several key operational areas.

Audit Your Tool Inventory and Data Flows

You cannot govern what you cannot see. Map every AI tool currently utilised across your business units, identifying where client data, proprietary information, and staff personal data enter these systems. Determine whether data inputs are retained by vendors for model training or discarded after processing.

Establish Documented Lawful Bases

For every deployment involving personal data, establish and record the appropriate lawful basis under applicable privacy frameworks. If your organisation relies on legitimate interests, be prepared to document balancing tests that weigh your business objectives against the fundamental rights and freedoms of data subjects.

Prioritise Granular Transparency

Opaque processing mechanisms are a primary regulatory trigger. Ensure that privacy notices, client engagement terms, and internal employee policies clearly and accurately articulate how AI tools interact with personal data. Transparency must be proactive, clear, and easy to understand.

Enforce Data Minimisation

Review the types of data fed into AI applications. Implement strict internal guidelines to prevent the unnecessary input of sensitive personal data, financial details, or confidential client records into generative AI environments unless robust data processing agreements and technical safeguards are firmly in place.

Partner with Ops Intel

As regulatory scrutiny intensifies globally, managing AI compliance across multiple jurisdictions demands specialist expertise and rigorous documentation. Organisations must bridge the gap between adopting innovative technologies and maintaining absolute adherence to data protection standards.

At Ops Intel, we help international professional services businesses and global enterprises navigate complex AI compliance obligations with confidence. Our team provides expert guidance on risk assessments, technical and organisational measures, lawful basis evaluations, and compliance documentation.

To find out how we can help your organisation operationalise responsible AI innovation, visit Ops Intel.