AI-Generated Content and the Irish DPC's View

The DPC has not published a special rulebook for AI-generated marketing content, and no responsible guide pretends otherwise. What it has done is make its position clear through supervision: its AI Insights Report, published 25 September 2026, documents a significant increase in AI engagements driven by generative AI. The rules that apply to AI content are the rules that already exist.

The rules that apply to AI content

  1. GDPR governs the inputs. If customer data enters an AI tool, you need a lawful basis and a data processing agreement, and training on your data must be switched off unless you have a specific basis for it. The full checklist is our GDPR guide.
  2. Transparency governs the outputs. The EU AI Act requires disclosure where AI content interacts with customers, and honest labelling is the safer commercial choice regardless.
  3. Accuracy is still your liability. AI drafts do not move liability for published claims. The human review point is the legal control, which is why our AI content ops guide makes fact-checking non-negotiable.

The pattern the DPC’s supervision rewards

The businesses that stay safe are the ones with the boring habits: data inventories, processing agreements, human approval on anything customer-facing, and a documented review chain. None of it is exotic, all of it is evidence, and evidence is what supervision asks for. The responsible AI guide assembles the habits into one page.

The practical publishing rules

  • Draft with AI, verify with humans, publish with accountability.
  • Label AI where customers interact with it directly.
  • Never feed customer data into tools without the lawful basis and agreement.
  • Keep a short register of what AI the business uses, reviewed quarterly.

The bottom line

The DPC’s message on AI is the same as its message on everything: AI is not a loophole, and the data underneath obeys the same law. The businesses treating AI content as a workflow with review points, rather than a fire-and-forget generator, are the ones that never need to learn the lesson twice.

Read next: Responsible AI in Ireland: data, GDPR and the DPC

← Back to blog