{ "meta": { "buildDate": "2026-08-20", "lastVerified": "2026-08-20", "enforcementStart": "2026-08-02", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "note": "Every record is verified against a named source. Counts are a floor, not a ceiling: authorities publish on their own timetable and some decisions are never announced.", "source": "https://www.gage.academy/tools/eu-ai-act-enforcement-tracker", "attribution": "GAGE (Global Academy of Generative-AI Education), EU AI Act Enforcement Tracker", "documentation": "https://www.gage.academy/tools/eu-ai-act-enforcement-tracker/data", "methodology": "https://www.gage.academy/tools/eu-ai-act-enforcement-tracker/method" }, "actions": [ { "id": "AIT-2022-0001", "slug": "garante-clearview-ai-facial-recognition-fine", "title": "Garante fines Clearview AI 20 million euro over its facial recognition database", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5(1)(a)", "role": "violated" }, { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "9", "role": "violated" }, { "instrument": "AI_ACT", "article": "5", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Clearview AI Inc.", "sector": "biometric_identification", "hq_country": "US" }, "ai_system": "Clearview AI facial recognition search engine", "date_announced": "2022-03-09", "date_decision": "2022-02-10", "fine_amount_eur": 20000000, "fine_original": { "amount": 20000000, "currency": "EUR" }, "corrective_measures": [ "delete the biometric and personal data of people in Italy", "stop any further collection and processing of that data", "designate a representative in the European Union" ], "summary": "Italy's data protection authority fined Clearview AI 20 million euro for building a searchable biometric database out of images scraped from the open web, including images of people in Italy who had never heard of the company. The Garante found the processing had no legal basis, that special category biometric data was processed outside every Article 9 gateway, and that data subjects were never informed. The decision rejected Clearview's argument that scraping publicly accessible images placed the processing outside the reach of the GDPR: publication does not make a face free to index, and the purpose of the processing was monitoring the behaviour of people in Italy. Alongside the fine, the authority ordered the company to erase the data of people located in Italy, to stop collecting further images of them, and to appoint an Article 27 representative in the Union. The case matters far beyond Italy. Three European authorities fined the same company on the same facts inside two and a half years, and the pattern set here, that a training or reference dataset assembled by scraping is a processing operation like any other, is the reasoning European regulators carried into the generative AI cases that followed. Under the AI Act, the untargeted scraping of facial images to build recognition databases is now itself a prohibited practice under Article 5.", "key_facts": [ "Fine of 20 million euro, decision of 10 February 2022, announced 9 March 2022.", "Deletion order covering the biometric data of all people in Italy.", "Order to designate a representative in the European Union.", "Same company was later fined by the French and Dutch authorities on comparable facts." ], "timeline": [ { "date": "2022-02-10", "event": "Garante adopts decision no. 50 imposing the fine and corrective measures" }, { "date": "2022-03-09", "event": "Decision published and announced" } ], "appeal": { "status": "none", "notes": "No annulment recorded. The company has publicly disputed European jurisdiction over its processing." }, "sources": [ { "name": "Garante, provvedimento del 10 febbraio 2022 (doc. web 9751362)", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9751362", "type": "primary", "date": "2022-02-10" }, { "name": "EDPB national news, Italian SA fines Clearview AI 20 million euro", "url": "https://www.edpb.europa.eu/news/national-news/2022/facial-recognition-italian-sa-fines-clearview-ai-eur-20-million_en", "type": "primary", "date": "2022-03-09" } ], "related_ids": [ "AIT-2022-0002", "AIT-2023-0002", "AIT-2024-0003" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2022-0002", "slug": "cnil-clearview-ai-facial-recognition-fine", "title": "CNIL fines Clearview AI 20 million euro and orders it to stop processing data on people in France", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "12", "role": "violated" }, { "instrument": "GDPR", "article": "15", "role": "violated" }, { "instrument": "GDPR", "article": "17", "role": "violated" }, { "instrument": "AI_ACT", "article": "5", "role": "adjacent" } ], "authority_id": "cnil", "target": { "name": "Clearview AI Inc.", "sector": "biometric_identification", "hq_country": "US" }, "ai_system": "Clearview AI facial recognition search engine", "date_announced": "2022-10-20", "date_decision": "2022-10-17", "fine_amount_eur": 20000000, "fine_original": { "amount": 20000000, "currency": "EUR" }, "corrective_measures": [ "stop collecting and processing data on people in France without a legal basis", "erase the data already held on those people within two months", "answer access and erasure requests properly, on penalty of 100,000 euro per day of delay" ], "summary": "The French authority fined Clearview AI 20 million euro and ordered it to stop collecting and using images of people in France, eight months after Italy reached the same conclusion on the same product. The CNIL had first issued a formal notice in November 2021 and found that the company had simply not responded to it. Three failures carried the decision. The processing had no legal basis, because the legitimate interest the company relied on could not outweigh the intrusiveness of indexing a person's face without their knowledge. Rights were not workable in practice: access requests were limited to twice a year, restricted to data collected in the preceding twelve months, and often left unanswered. Erasure requests went the same way. The decision attached a penalty payment of 100,000 euro for each day of delay beyond two months, a mechanism that later produced a second, separate financial decision in May 2023 when the company still had not complied. For a tracker built around the AI Act, this record is the clearest early demonstration that a corrective order is not the end of an enforcement action but the start of a second phase, and that the amount an authority announces on day one is rarely the amount that ends up being owed.", "key_facts": [ "Fine of 20 million euro, decision of 17 October 2022.", "Order to cease collection and to erase French data within two months.", "Penalty payment of 100,000 euro per day of delay attached to the order.", "The company had already ignored a formal notice issued in November 2021." ], "timeline": [ { "date": "2021-11-26", "event": "CNIL issues a formal notice to comply" }, { "date": "2022-10-17", "event": "Restricted committee adopts the 20 million euro sanction and the injunction" }, { "date": "2022-10-20", "event": "Decision published" }, { "date": "2023-05-10", "event": "CNIL imposes a further 5.2 million euro in accrued penalty payments for non compliance" } ], "appeal": { "status": "none", "notes": "No annulment recorded." }, "sources": [ { "name": "CNIL, Facial recognition: 20 million euros penalty against Clearview AI", "url": "https://www.cnil.fr/en/facial-recognition-20-million-euros-penalty-against-clearview-ai", "type": "primary", "date": "2022-10-20" } ], "related_ids": [ "AIT-2022-0001", "AIT-2023-0002", "AIT-2024-0003" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2023-0001", "slug": "garante-openai-chatgpt-temporary-limitation", "title": "Garante orders ChatGPT off in Italy, then lifts the order four weeks later", "status": "confirmed", "action_type": "interim_measure", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5(1)(d)", "role": "violated" }, { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "8", "role": "violated" }, { "instrument": "GDPR", "article": "13", "role": "violated" }, { "instrument": "AI_ACT", "article": "50", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "OpenAI, L.L.C.", "sector": "generative_ai", "hq_country": "US" }, "ai_system": "ChatGPT", "date_announced": "2023-03-31", "date_decision": "2023-03-30", "fine_amount_eur": null, "fine_original": null, "corrective_measures": [ "publish a notice explaining how personal data is used to train the models", "provide a way for people to object to that training use", "put an age gate in place at sign up", "run an information campaign about the processing" ], "summary": "The Italian authority ordered an urgent, temporary limitation on OpenAI's processing of data about people in Italy, which took ChatGPT offline in the country from 31 March 2023. It was the first time a European regulator had reached into a general purpose generative system and stopped it. The order named four concerns: no information given to users or to the people whose data appeared in the training corpus, no identified legal basis for training, factual inaccuracy in model outputs measured against the accuracy principle in Article 5(1)(d), and no age verification on a service its own terms restricted to users over thirteen. OpenAI did not litigate. It published a training notice, opened an objection route, added an age gate at sign up and agreed to an information campaign, and the Garante lifted the limitation on 28 April 2023. The service was back after twenty nine days. This record is the origin point of European generative AI enforcement and it set the pattern that has held ever since: authorities move first with interim measures rather than fines, compliance is negotiated quickly, and the underlying legal questions about training data are left for a later decision. That later decision came in November 2024, and a court annulled it in March 2026.", "key_facts": [ "Urgent temporary limitation adopted 30 March 2023, in effect 31 March 2023.", "First order by a European authority to stop a general purpose generative AI service.", "Lifted on 28 April 2023 after four remedial measures were put in place.", "No fine attached to this order. The fine came in a separate 2024 decision." ], "timeline": [ { "date": "2023-03-30", "event": "Garante adopts the urgent limitation order" }, { "date": "2023-03-31", "event": "ChatGPT becomes unavailable in Italy" }, { "date": "2023-04-11", "event": "Garante sets out the conditions for the service to return" }, { "date": "2023-04-28", "event": "Limitation lifted, service restored in Italy" } ], "appeal": { "status": "none", "notes": "The measure was complied with rather than challenged." }, "sources": [ { "name": "Garante, provvedimento del 30 marzo 2023 (doc. web 9870832)", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870832", "type": "primary", "date": "2023-03-30" }, { "name": "Garante press release, ChatGPT: Garante privacy, riapre la piattaforma in Italia", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9881490", "type": "primary", "date": "2023-04-28" } ], "related_ids": [ "AIT-2024-0007", "AIT-2024-0002", "AIT-2025-0001" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2023-0002", "slug": "cnil-clearview-ai-overdue-penalty", "title": "CNIL charges Clearview AI a further 5.2 million euro for ignoring the erasure order", "status": "confirmed", "action_type": "corrective_order", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "58(2)", "role": "cited" }, { "instrument": "AI_ACT", "article": "5", "role": "adjacent" } ], "authority_id": "cnil", "target": { "name": "Clearview AI Inc.", "sector": "biometric_identification", "hq_country": "US" }, "ai_system": "Clearview AI facial recognition search engine", "date_announced": "2023-05-10", "date_decision": "2023-04-13", "fine_amount_eur": 5200000, "fine_original": { "amount": 5200000, "currency": "EUR" }, "corrective_measures": [ "liquidate the accrued daily penalty payments attached to the October 2022 injunction" ], "summary": "Seven months after the 20 million euro sanction, the French authority liquidated the penalty payments that had been running since the injunction went unheeded, and charged Clearview AI a further 5.2 million euro. The company had not proved that it had stopped collecting data on people in France, had not shown that it had erased what it held, and had not made access and erasure rights usable. Each day past the two month deadline had carried 100,000 euro, and the CNIL closed the meter and issued the bill. Nothing in this decision reopens the merits. It is purely about non compliance with a corrective order, which is what makes it useful as a record. Enforcement trackers that only count headline sanctions understate the real exposure, because a European authority can keep charging for as long as an order is ignored, and the second bill here was a quarter of the first. Under the AI Act the same architecture exists: Article 99 penalties sit alongside the market surveillance powers to restrict, withdraw and recall a system, and the AI Office can impose periodic penalty payments of its own. An operator that treats a corrective order as optional will meet the same escalation under the new regime that Clearview met under the old one.", "key_facts": [ "Additional 5.2 million euro, decision of 13 April 2023, announced 10 May 2023.", "This is an accrued penalty payment, not a second sanction on the merits.", "It follows the 100,000 euro per day mechanism attached in October 2022.", "Total French exposure across both decisions: 25.2 million euro." ], "timeline": [ { "date": "2022-12-17", "event": "Two month compliance deadline from the October 2022 injunction expires" }, { "date": "2023-04-13", "event": "CNIL liquidates the accrued penalty payments" }, { "date": "2023-05-10", "event": "Decision announced" } ], "appeal": { "status": "none", "notes": "No annulment recorded." }, "sources": [ { "name": "CNIL, Facial recognition: the CNIL imposes an overdue penalty payment of 5.2 million euros against Clearview AI", "url": "https://www.cnil.fr/en/facial-recognition-cnil-imposes-overdue-penalty-payment-eu52-million-against-clearview-ai", "type": "primary", "date": "2023-05-10" } ], "related_ids": [ "AIT-2022-0002", "AIT-2022-0001", "AIT-2024-0003" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0001", "slug": "garante-municipality-of-trento-ai-surveillance-fine", "title": "Garante fines the Municipality of Trento 50,000 euro over three AI street surveillance projects", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5(1)(a)", "role": "violated" }, { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "35", "role": "violated" }, { "instrument": "AI_ACT", "article": "5", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Comune di Trento", "sector": "public_sector", "hq_country": "IT" }, "ai_system": "Marvel, Protector and Precrisis research projects: AI analysis of street camera and microphone feeds", "date_announced": "2024-01-11", "date_decision": "2023-12-11", "fine_amount_eur": 50000, "fine_original": { "amount": 50000, "currency": "EUR" }, "corrective_measures": [ "delete the data gathered under the projects", "stop the processing carried out under the projects" ], "summary": "The first European fine against a public authority for an AI surveillance deployment, and the smallest amount in this tracker. Trento took part in three European research projects that pointed machine learning at street camera and microphone feeds to detect events such as raised voices or people in difficulty. The Garante found the anonymisation the city relied on was not anonymisation at all, that there was no adequate legal basis for the processing under Italian law, that the impact assessments were inadequate, and that information given to people in the monitored areas was insufficient. The city was fined 50,000 euro and ordered to delete what had been collected. The amount is not the point. The point is that a research project, run by a mid sized city, with academic partners and European funding, was still a live processing operation and was enforced as one. Under the AI Act the same deployment would sit in a different place again: real time remote biometric identification in public spaces is a prohibited practice under Article 5 with limited exceptions, and public authority deployers of high risk systems carry a fundamental rights impact assessment duty under Article 27. Municipalities are on the hook as deployers, and this record is the earliest evidence that authorities will act on it.", "key_facts": [ "Fine of 50,000 euro against a municipality, announced 11 January 2024.", "First European fine over an AI powered urban surveillance deployment.", "Covered three EU funded research projects: Marvel, Protector and Precrisis.", "The authority rejected the city's claim that the data had been anonymised." ], "timeline": [ { "date": "2023-12-11", "event": "Garante adopts the decision" }, { "date": "2024-01-11", "event": "Decision announced" } ], "appeal": { "status": "none", "notes": "No annulment recorded." }, "sources": [ { "name": "Garante, provvedimento dell'11 gennaio 2024 (doc. web 9978728)", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9978728", "type": "primary", "date": "2024-01-11" } ], "related_ids": [ "AIT-2022-0001", "AIT-2026-0002" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0002", "slug": "noyb-openai-hallucination-complaint-austria", "title": "noyb complains to the Austrian authority that ChatGPT invents facts about real people", "status": "confirmed", "action_type": "complaint", "regime": [ "GDPR" ], "ai_act_relevance": "context", "provisions": [ { "instrument": "GDPR", "article": "5(1)(d)", "role": "cited" }, { "instrument": "GDPR", "article": "16", "role": "cited" }, { "instrument": "GDPR", "article": "15", "role": "cited" } ], "authority_id": "dsb-at", "target": { "name": "OpenAI, L.L.C.", "sector": "generative_ai", "hq_country": "US" }, "ai_system": "ChatGPT", "date_announced": "2024-04-29", "date_decision": null, "fine_amount_eur": null, "fine_original": null, "corrective_measures": [], "summary": "The privacy group noyb filed a complaint with the Austrian data protection authority arguing that a generative model which states a false date of birth for a real, identifiable person is processing inaccurate personal data, and that the accuracy principle in Article 5(1)(d) and the right to rectification in Article 16 apply to it exactly as they apply to a database. OpenAI's position, that it could not correct a specific output without retraining and could only block the name, is precisely what the complaint targets: a controller does not escape the rectification duty by choosing an architecture in which rectification is inconvenient. The complaint also raises Article 15, because the complainant could not obtain the source of the incorrect statement. This record is included as context rather than as an enforcement action. No authority has decided it. It sits in the tracker because it frames the single unresolved question underneath most generative AI enforcement in Europe, and because the AI Act does not answer it: the Act regulates transparency, risk management and documentation, while accuracy about named individuals stays a GDPR question. Any operator reading the AI Act as a complete compliance perimeter for a chatbot that discusses real people is reading half the file.", "key_facts": [ "Complaint filed with the Austrian data protection authority on 29 April 2024.", "Filed by noyb, the Vienna based privacy litigation group, on behalf of a public figure.", "Central claim: model output about a named person is personal data and must be accurate.", "No decision issued. This is a complaint stage record, not an enforcement action." ], "timeline": [ { "date": "2024-04-29", "event": "Complaint filed with the Austrian data protection authority" } ], "appeal": { "status": "none", "notes": "Not applicable at complaint stage." }, "sources": [ { "name": "noyb, ChatGPT provides false information about people, and OpenAI can't correct it", "url": "https://noyb.eu/en/chatgpt-provides-false-information-about-people-and-openai-cant-correct-it", "type": "primary", "date": "2024-04-29" } ], "related_ids": [ "AIT-2023-0001", "AIT-2024-0007", "AIT-2024-0008" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0003", "slug": "dutch-dpa-clearview-ai-fine", "title": "Dutch authority fines Clearview AI 30.5 million euro, the largest AI adjacent fine on record", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "9", "role": "violated" }, { "instrument": "GDPR", "article": "12", "role": "violated" }, { "instrument": "GDPR", "article": "14", "role": "violated" }, { "instrument": "GDPR", "article": "27", "role": "violated" }, { "instrument": "AI_ACT", "article": "5", "role": "adjacent" } ], "authority_id": "ap-nl", "target": { "name": "Clearview AI Inc.", "sector": "biometric_identification", "hq_country": "US" }, "ai_system": "Clearview AI facial recognition search engine", "date_announced": "2024-09-03", "date_decision": "2024-05-16", "fine_amount_eur": 30500000, "fine_original": { "amount": 30500000, "currency": "EUR" }, "corrective_measures": [ "stop the violations, on pain of non compliance penalties of up to 5.1 million euro", "appoint a representative in the European Union" ], "summary": "The Dutch authority imposed 30.5 million euro on Clearview AI, the largest fine in this tracker, and attached up to 5.1 million euro in further non compliance penalties if the company did not stop. The findings mirror Italy and France: an illegal database of biometric data built by scraping faces from the internet, no legal basis, no information given to the people in it, access rights obstructed, and no representative appointed in the Union. Two things make this record distinct. First, the authority said publicly that it was investigating whether the company's directors could be held personally liable, which is a route European regulators have rarely taken and one that survives into the AI Act era. Second, the authority was candid about the enforcement gap: a company with no European establishment, that ignores three national regulators in a row, is difficult to collect from. That candour is the reason this record belongs in an AI Act tracker. Article 99 gives national authorities fines of up to 35 million euro or 7 percent of worldwide turnover for prohibited practices, and untargeted facial scraping is now one of them. The legal ceiling is not the constraint. Reaching an operator that has no presence in the Union is the constraint, and the Clearview sequence is the evidence.", "key_facts": [ "Fine of 30.5 million euro, decision dated 16 May 2024, announced 3 September 2024.", "Largest AI adjacent fine currently on this tracker.", "Up to 5.1 million euro in further penalties attached if the violations continue.", "The authority stated it was examining personal liability of the company's directors." ], "timeline": [ { "date": "2024-05-16", "event": "Autoriteit Persoonsgegevens adopts the fining decision" }, { "date": "2024-09-03", "event": "Decision announced publicly" } ], "appeal": { "status": "none", "notes": "The company stated it does not consider itself subject to the GDPR. No annulment recorded." }, "sources": [ { "name": "Autoriteit Persoonsgegevens, Dutch DPA imposes a fine on Clearview because of illegal data collection for facial recognition", "url": "https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition", "type": "primary", "date": "2024-09-03" }, { "name": "Autoriteit Persoonsgegevens, decision text", "url": "https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai", "type": "primary", "date": "2024-09-03" } ], "related_ids": [ "AIT-2022-0001", "AIT-2022-0002", "AIT-2023-0002" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0004", "slug": "irish-dpc-google-palm-2-inquiry", "title": "Irish DPC opens a cross border inquiry into Google over the PaLM 2 model", "status": "confirmed", "action_type": "investigation", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "35", "role": "cited" }, { "instrument": "AI_ACT", "article": "53", "role": "adjacent" } ], "authority_id": "dpc-ie", "target": { "name": "Google Ireland Limited", "sector": "generative_ai", "hq_country": "IE" }, "ai_system": "Pathways Language Model 2 (PaLM 2)", "date_announced": "2024-09-12", "date_decision": null, "fine_amount_eur": null, "fine_original": null, "corrective_measures": [], "summary": "Ireland's Data Protection Commission opened a statutory inquiry into whether Google carried out a data protection impact assessment before processing the personal data of people in Europe to develop PaLM 2. The question is narrow and it is deliberately narrow. Rather than litigate whether training a foundation model on scraped web data has a legal basis, the DPC asked whether the controller did the assessment that Article 35 requires before high risk processing begins. That is a documentary question with a documentary answer, and it is the same shape as the obligations the AI Act now places on general purpose model providers: Article 53 requires technical documentation, a training data summary and a copyright policy, and the AI Office can demand them under Article 91. The inquiry has not concluded. It is on this tracker because it is the lead regulator of most large model providers in Europe testing the process obligation rather than the substance, and because whatever the DPC concludes about pre deployment assessment will shape how the AI Office reads Article 53 documentation duties on the same models. As of the last verification date no decision or fine has been published.", "key_facts": [ "Statutory inquiry announced 12 September 2024 under section 110 of the Irish Data Protection Act 2018.", "Scope: whether a data protection impact assessment was carried out before processing for PaLM 2.", "Cross border inquiry, so any draft decision goes through the Article 60 cooperation procedure.", "No decision, finding or fine published as of 20 August 2026." ], "timeline": [ { "date": "2024-09-12", "event": "DPC announces the commencement of the inquiry" } ], "appeal": { "status": "none", "notes": "Not applicable while the inquiry is open." }, "sources": [ { "name": "Data Protection Commission, statement on the commencement of an inquiry into Google Ireland Limited", "url": "https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-launches-inquiry-google-ireland-limited", "type": "primary", "date": "2024-09-12" } ], "related_ids": [ "AIT-2025-0002", "AIT-2024-0005" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0005", "slug": "irish-dpc-x-grok-training-undertaking", "title": "Irish DPC takes X to the High Court over Grok training data and secures an undertaking", "status": "confirmed", "action_type": "interim_measure", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "6", "role": "cited" }, { "instrument": "AI_ACT", "article": "53", "role": "adjacent" } ], "authority_id": "dpc-ie", "target": { "name": "Twitter International Unlimited Company", "sector": "platform_ai", "hq_country": "IE" }, "ai_system": "Grok large language models, trained on public posts from X", "date_announced": "2024-08-08", "date_decision": "2024-09-04", "fine_amount_eur": null, "fine_original": null, "corrective_measures": [ "stop using EU and EEA user posts collected between 7 May and 1 August 2024 for Grok training", "delete the data collected in that window" ], "summary": "The Irish authority went to the High Court under section 134 of the Data Protection Act 2018 to suspend X's use of European users' public posts as Grok training data, the first time the DPC had used that urgent power against any controller. The trigger was that the platform had begun using the posts by default, with the opt out placed where most users would never find it. X gave an undertaking rather than fight the application, agreeing to stop the processing and to delete what had been collected between 7 May and 1 August 2024, and the proceedings were struck out in September 2024. No finding of infringement was made and no fine was imposed, which is exactly why the record matters. It is the clearest European example of an authority obtaining a training data outcome in weeks by using an urgency route instead of a multi year inquiry. The same speed is available under the AI Act. Article 93 lets the AI Office require a provider to take measures, and Implementing Regulation (EU) 2026/1755 gives it an interim measures procedure. Operators planning for enforcement on an inquiry timescale are planning for the wrong instrument. The substantive question about the lawfulness of the training was then reopened separately in April 2025.", "key_facts": [ "High Court proceedings issued 8 August 2024 under the urgency power in section 134.", "First use of that power by the DPC against any controller.", "X undertook to stop the processing and delete the 7 May to 1 August 2024 data.", "Proceedings struck out on 4 September 2024. No finding of infringement, no fine." ], "timeline": [ { "date": "2024-08-08", "event": "DPC issues urgent High Court proceedings against X" }, { "date": "2024-09-04", "event": "X gives an undertaking, proceedings struck out" }, { "date": "2025-04-11", "event": "DPC opens a full statutory inquiry into the same training activity" } ], "appeal": { "status": "none", "notes": "Resolved by undertaking rather than by decision." }, "sources": [ { "name": "Data Protection Commission, DPC welcomes conclusion of proceedings against X", "url": "https://www.dataprotection.ie/en/news-media/press-releases/DPC-welcomes-conclusion-of-proceedings-against-X", "type": "primary", "date": "2024-09-04" } ], "related_ids": [ "AIT-2025-0002", "AIT-2026-0001", "AIT-2024-0004" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0006", "slug": "garante-foodinho-algorithmic-management-fine", "title": "Garante fines Foodinho 5 million euro over the algorithms that manage its riders", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5(1)(c)", "role": "violated" }, { "instrument": "GDPR", "article": "9", "role": "violated" }, { "instrument": "GDPR", "article": "22", "role": "violated" }, { "instrument": "GDPR", "article": "32", "role": "violated" }, { "instrument": "AI_ACT", "article": "6", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Foodinho S.r.l. (Glovo group)", "sector": "gig_work", "hq_country": "IT" }, "ai_system": "Rider scoring, assignment and identity verification systems", "date_announced": "2024-11-22", "date_decision": "2024-10-24", "fine_amount_eur": 5000000, "fine_original": { "amount": 5000000, "currency": "EUR" }, "corrective_measures": [ "stop tracking rider location outside working time", "stop the unlawful use of biometric identity checks", "give riders a workable route to contest automated decisions", "correct the security and data sharing failures identified" ], "summary": "The Italian authority fined the Glovo subsidiary Foodinho 5 million euro, its second sanction against the same company, over the systems that assign work to and score food delivery riders. The findings read as a catalogue of what goes wrong when management is automated without governance: location data collected outside working hours, biometric checks used to verify rider identity without a valid basis, automated decisions affecting people's earnings with no meaningful human review, rider data shared with third parties, and security controls that let personal data be exposed. The Article 22 finding is the one that carries forward. A scoring system that decides who gets offered work is an automated decision with legal or similarly significant effect, and the right to contest it is not satisfied by a support inbox. Under the AI Act the same systems are candidates for Annex III high risk classification in employment and worker management, which brings human oversight under Article 14, logging under Article 12 and a deployer duty to inform affected workers under Article 26. The rules that apply from December 2027 are stricter than the ones Foodinho was fined under, and the conduct is already unlawful today.", "key_facts": [ "Fine of 5 million euro, announced 22 November 2024.", "Second Garante sanction against the same company, after a 2.6 million euro fine in 2021.", "Findings include Article 22 automated decision making without meaningful contestability.", "Worker management AI is an Annex III high risk category under the AI Act from December 2027." ], "timeline": [ { "date": "2024-10-24", "event": "Garante adopts the decision" }, { "date": "2024-11-22", "event": "Decision announced" } ], "appeal": { "status": "none", "notes": "No annulment recorded." }, "sources": [ { "name": "Garante, provvedimento del 24 ottobre 2024 (doc. web 10077053)", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10077053", "type": "primary", "date": "2024-11-22" } ], "related_ids": [ "AIT-2026-0002", "AIT-2024-0001" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0007", "slug": "garante-openai-fine-annulled-court-of-rome", "title": "Garante fines OpenAI 15 million euro, and the Court of Rome annuls the decision in full", "status": "annulled", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5(1)(a)", "role": "violated" }, { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "8", "role": "violated" }, { "instrument": "GDPR", "article": "13", "role": "violated" }, { "instrument": "GDPR", "article": "33", "role": "violated" }, { "instrument": "GDPR", "article": "56", "role": "cited" } ], "authority_id": "garante", "target": { "name": "OpenAI, L.L.C.", "sector": "generative_ai", "hq_country": "US" }, "ai_system": "ChatGPT", "date_announced": "2024-12-20", "date_decision": "2024-11-02", "fine_amount_eur": 15000000, "fine_original": { "amount": 15000000, "currency": "EUR" }, "corrective_measures": [ "run a six month information campaign across Italian radio, television, newspapers and the internet explaining how the models are trained and how people can object" ], "summary": "This is the record that explains why an enforcement tracker must carry appeal status as a first class field. In November 2024 the Italian authority fined OpenAI 15 million euro for training ChatGPT without an identified legal basis, failing to notify a March 2023 data breach, giving inadequate information to users, and having no age verification. It attached an unusual remedy: a six month public information campaign across Italian media. The fine was announced on 20 December 2024. On 21 March 2025 the Court of Rome suspended it. On 18 March 2026 the same court annulled the decision in full, holding that once OpenAI Ireland was established in February 2024 the Irish authority became lead supervisory authority under the one stop shop in Article 56, and the Italian authority no longer had competence to decide the case on its own. The reasoning turned on competence, not on whether the processing was lawful. Nothing in the judgment says training ChatGPT on European personal data was permissible. It says the wrong regulator decided. Any tracker or news report that still counts 15 million euro as a standing European AI fine is reporting a number that no longer exists.", "key_facts": [ "Fine of 15 million euro plus a media campaign order, decision 2 November 2024, announced 20 December 2024.", "Suspended by the Court of Rome on 21 March 2025.", "Annulled in full by the Court of Rome on 18 March 2026 on one stop shop competence grounds.", "The annulment decided competence, not the lawfulness of the underlying processing.", "This amount is excluded from confirmed fine totals on this tracker." ], "timeline": [ { "date": "2024-11-02", "event": "Garante adopts the fining decision" }, { "date": "2024-12-20", "event": "Decision announced" }, { "date": "2025-01-20", "event": "OpenAI states it will appeal" }, { "date": "2025-03-21", "event": "Court of Rome suspends the decision" }, { "date": "2026-03-18", "event": "Court of Rome annuls the decision in full for want of competence" } ], "appeal": { "status": "annulled", "notes": "Court of Rome, judgment of 18 March 2026. The court held that the establishment of OpenAI Ireland in February 2024 engaged the one stop shop mechanism and displaced the Italian authority's competence." }, "sources": [ { "name": "Garante press release, Intelligenza artificiale: il Garante privacy sanziona OpenAI", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432", "type": "primary", "date": "2024-12-20" }, { "name": "Wilson Sonsini, OpenAI Prevails in Landmark Italian AI and GDPR Enforcement Case", "url": "https://www.wsgr.com/en/insights/openai-prevails-in-landmark-italian-ai-and-gdpr-enforcement-case.html", "type": "secondary", "date": "2026-03-25" }, { "name": "European Law Blog, Establish, Then Escape? How the Court of Rome, the One-Stop-Shop and a Single Word Opened an AI Enforcement Gap", "url": "https://www.europeanlawblog.eu/pub/92oig1ws", "type": "secondary", "date": "2026-04-01" } ], "related_ids": [ "AIT-2023-0001", "AIT-2024-0002", "AIT-2026-0003" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2024-0008", "slug": "edpb-chatgpt-taskforce-report", "title": "EDPB ChatGPT Taskforce publishes the common European position on generative AI", "status": "confirmed", "action_type": "other", "regime": [ "GDPR" ], "ai_act_relevance": "context", "provisions": [ { "instrument": "GDPR", "article": "5(1)(d)", "role": "cited" }, { "instrument": "GDPR", "article": "6(1)(f)", "role": "cited" } ], "authority_id": "edpb", "target": { "name": "OpenAI, L.L.C.", "sector": "generative_ai", "hq_country": "US" }, "ai_system": "ChatGPT", "date_announced": "2024-05-23", "date_decision": null, "fine_amount_eur": null, "fine_original": null, "corrective_measures": [], "summary": "Not an enforcement action, and included as context because it is the document the national authorities in this tracker are working from. After Italy's 2023 order, the European Data Protection Board set up a taskforce to coordinate the national investigations into ChatGPT and published its interim report on 23 May 2024. Three positions in it shape everything that followed. Publicly accessible data is not free data: web scraping for training requires a legal basis and legitimate interest has to survive a real balancing test with safeguards. Output about a named person falls under the accuracy principle, and a disclaimer that the system may be wrong does not discharge it. Transparency has to reach the people whose data was in the training corpus, not only the people using the product. The report deliberately did not resolve the hardest questions, and two years later they are still open. Its practical value for anyone reading this tracker is that it tells you what the next decision will argue before the decision exists, and it is the bridge between GDPR practice and the AI Act, because the Act's transparency and documentation duties assume a lawful basis for the data underneath and do not supply one.", "key_facts": [ "Interim report of the EDPB ChatGPT Taskforce, published 23 May 2024.", "Coordinates the national investigations into the same service across member states.", "Positions taken on scraping, accuracy of output about named people, and transparency.", "Context record. No enforcement measure and no fine attaches to it." ], "timeline": [ { "date": "2023-04-13", "event": "EDPB establishes the ChatGPT Taskforce" }, { "date": "2024-05-23", "event": "Interim report published" } ], "appeal": { "status": "none", "notes": "Not applicable." }, "sources": [ { "name": "EDPB, Report of the work undertaken by the ChatGPT Taskforce", "url": "https://www.edpb.europa.eu/our-work-tools/our-documents/other/report-work-undertaken-chatgpt-taskforce_en", "type": "primary", "date": "2024-05-23" } ], "related_ids": [ "AIT-2023-0001", "AIT-2024-0007", "AIT-2024-0002" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2025-0001", "slug": "garante-deepseek-processing-limitation", "title": "Garante blocks DeepSeek in Italy over transfers to China and missing information", "status": "confirmed", "action_type": "ban", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "13", "role": "violated" }, { "instrument": "GDPR", "article": "14", "role": "violated" }, { "instrument": "GDPR", "article": "44", "role": "violated" }, { "instrument": "AI_ACT", "article": "50", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Hangzhou DeepSeek Artificial Intelligence Co. Ltd and Beijing DeepSeek Artificial Intelligence Co. Ltd", "sector": "generative_ai", "hq_country": "CN" }, "ai_system": "DeepSeek assistant", "date_announced": "2025-01-30", "date_decision": "2025-01-30", "fine_amount_eur": null, "fine_original": null, "corrective_measures": [ "definitive limitation on processing the personal data of users located in Italy" ], "summary": "Two days after asking the companies behind DeepSeek what data they collected, where it was stored and on what basis, the Italian authority received an answer it described as wholly inadequate and imposed an urgent, definitive limitation on the processing of data about users in Italy. The app came out of the Italian app stores the same week. The grounds were transfer and transparency rather than model behaviour: no adequate guarantee for the transfer of personal data to the People's Republic of China under Chapter V of the GDPR, and no proper information to users about what was being collected. The companies had also argued that they were not established in the Union and that European law did not reach them, an argument the authority rejected on the same territorial scope reasoning that had already been used against Clearview. This record is the fastest action in the tracker, decided within days of the service's rise, and it is the template for how European regulators are likely to handle a fast growing model service from outside the Union. Under the AI Act the same speed exists for market surveillance authorities, which can restrict, withdraw or recall a system from the Union market without waiting for a full infringement decision.", "key_facts": [ "Urgent definitive limitation on processing, adopted 30 January 2025.", "Grounds: no adequate guarantees for transfers to China, and inadequate information to users.", "Imposed two days after the authority's request for information.", "The app was withdrawn from Italian app stores in the same week." ], "timeline": [ { "date": "2025-01-28", "event": "Garante sends a request for information to the two DeepSeek companies" }, { "date": "2025-01-30", "event": "Garante adopts the urgent limitation, provvedimento doc. web 10098477" }, { "date": "2025-02-06", "event": "Garante opens a formal investigation into the same processing" } ], "appeal": { "status": "none", "notes": "No annulment recorded." }, "sources": [ { "name": "Garante, provvedimento del 30 gennaio 2025 (doc. web 10098477)", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10098477", "type": "primary", "date": "2025-01-30" } ], "related_ids": [ "AIT-2023-0001", "AIT-2026-0003" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2025-0002", "slug": "irish-dpc-x-grok-llm-training-inquiry", "title": "Irish DPC opens a full inquiry into X over training Grok on European users' posts", "status": "confirmed", "action_type": "investigation", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5", "role": "cited" }, { "instrument": "GDPR", "article": "6", "role": "cited" }, { "instrument": "AI_ACT", "article": "53", "role": "adjacent" } ], "authority_id": "dpc-ie", "target": { "name": "X Internet Unlimited Company", "sector": "platform_ai", "hq_country": "IE" }, "ai_system": "Grok large language models", "date_announced": "2025-04-11", "date_decision": null, "fine_amount_eur": null, "fine_original": null, "corrective_measures": [], "summary": "Having settled the urgent question by undertaking in 2024, the Irish authority came back to the substantive one and opened a statutory inquiry into whether X lawfully processed the public posts of European users to train the Grok models. This is the inquiry that reaches the merits: not whether an impact assessment was filed, but whether there was ever a valid legal basis for using a platform's user generated content as model training data by default. Ireland is the lead supervisory authority for X, so the outcome binds through the Article 60 cooperation procedure across the Union rather than in one member state. The stakes are not confined to one platform. Almost every large platform that also ships a model has the same architecture and the same defence, and a finding either way sets the European position on the largest single source of training data in existence. As of the last verification date the inquiry is open, with no draft decision published. The AI Act does not answer this question either: Article 53 makes a provider document and summarise its training data, and says nothing about whether the underlying collection was lawful.", "key_facts": [ "Statutory inquiry announced 11 April 2025 under section 110 of the Data Protection Act 2018.", "Scope: the lawfulness of processing public posts of EU and EEA users to train the Grok models.", "Ireland is lead supervisory authority, so any decision runs through the Article 60 procedure.", "No decision, finding or fine published as of 20 August 2026." ], "timeline": [ { "date": "2024-09-04", "event": "Earlier High Court proceedings resolved by undertaking" }, { "date": "2025-04-11", "event": "DPC announces the commencement of the statutory inquiry" } ], "appeal": { "status": "none", "notes": "Not applicable while the inquiry is open." }, "sources": [ { "name": "Data Protection Commission, Announcement of commencement of inquiry into X Internet Unlimited Company", "url": "https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc", "type": "primary", "date": "2025-04-11" } ], "related_ids": [ "AIT-2024-0005", "AIT-2026-0001", "AIT-2024-0004" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2025-0003", "slug": "garante-replika-luka-fine", "title": "Garante fines Luka Inc. 5 million euro over the Replika companion chatbot", "status": "under_appeal", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "5", "role": "violated" }, { "instrument": "GDPR", "article": "6", "role": "violated" }, { "instrument": "GDPR", "article": "8", "role": "violated" }, { "instrument": "GDPR", "article": "13", "role": "violated" }, { "instrument": "AI_ACT", "article": "50", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Luka Inc.", "sector": "companion_chatbot", "hq_country": "US" }, "ai_system": "Replika AI companion", "date_announced": "2025-05-19", "date_decision": "2025-04-10", "fine_amount_eur": 5000000, "fine_original": { "amount": 5000000, "currency": "EUR" }, "corrective_measures": [ "identify and document a valid legal basis for the processing", "put an effective age verification mechanism in place", "correct the privacy information given to users" ], "summary": "The Italian authority fined the developer of Replika 5 million euro and reaffirmed the block it had imposed on the service in February 2023. Two findings carried the decision. There was no valid legal basis identified for processing user data at the time the service launched in Italy, and the privacy information given to users was inadequate. There was no working age verification: the app stated it was not for minors and did nothing to check, while offering a companion that engages in emotionally intimate conversation. A separate investigation into how the underlying language model was trained was left open. The record is marked under appeal, because the company has opposed the decision before the Italian courts and the outcome is not yet known. That flag is not decoration. The OpenAI record on this tracker shows what happens when an announced European AI fine meets a court, and until this one is finally decided the 5 million euro is a claim rather than a settled figure. Companion chatbots are also the clearest near term test of AI Act Article 50: a system that simulates a relationship has to tell the person that they are interacting with an AI system.", "key_facts": [ "Fine of 5 million euro, decision of 10 April 2025, announced 19 May 2025.", "Findings: no valid legal basis, inadequate privacy information, no age verification.", "The February 2023 block on the service in Italy was reaffirmed.", "Under appeal before the Italian courts. Counted separately from confirmed totals here.", "A parallel investigation into how the underlying model was trained remains open." ], "timeline": [ { "date": "2023-02-02", "event": "Garante orders an urgent limitation on Replika's processing in Italy" }, { "date": "2025-04-10", "event": "Garante adopts the fining decision" }, { "date": "2025-05-19", "event": "Decision announced" }, { "date": "2025-07-01", "event": "Company opposes the decision before the Italian courts" } ], "appeal": { "status": "pending", "notes": "Opposition filed before the Italian courts. No judgment published as of 20 August 2026." }, "sources": [ { "name": "EDPB national news, AI: the Italian Supervisory Authority fines company behind chatbot Replika", "url": "https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en", "type": "primary", "date": "2025-05-19" }, { "name": "Garante press release, Intelligenza artificiale: sanzione a Luka Inc., la società che gestisce il chatbot Replika", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10131055", "type": "primary", "date": "2025-05-19" } ], "related_ids": [ "AIT-2026-0003", "AIT-2024-0007" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2026-0001", "slug": "commission-x-grok-dsa-proceedings", "title": "Commission extends its DSA proceedings against X to cover Grok", "status": "confirmed", "action_type": "investigation", "regime": [ "DSA" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "DSA", "article": "34", "role": "cited" }, { "instrument": "DSA", "article": "35", "role": "cited" }, { "instrument": "AI_ACT", "article": "50", "role": "adjacent" } ], "authority_id": "european-commission", "target": { "name": "X (Twitter International Unlimited Company)", "sector": "platform_ai", "hq_country": "IE" }, "ai_system": "Grok, deployed inside the X platform and as its recommender system", "date_announced": "2026-01-26", "date_decision": "2026-01-26", "fine_amount_eur": null, "fine_original": null, "corrective_measures": [], "summary": "The Commission extended the formal proceedings it had opened against X in December 2023 to cover the deployment of Grok inside the platform, including the switch to a Grok based recommender system. The question is whether X assessed and mitigated the systemic risks that the Digital Services Act requires a very large online platform to handle under Articles 34 and 35, specifically the dissemination of illegal content, gender based violence, and serious effects on physical and mental wellbeing, arising from generative features built into the service. The proceedings carry the DSA penalty ceiling of 6 percent of worldwide turnover, higher than any tier in the AI Act. That is the reason this record sits in an AI Act tracker. Where a generative system is embedded in a designated platform, the Commission can reach it under the DSA today, with a bigger stick, without waiting for the AI Act's own timeline, and the AI Office's competence under Article 88 was expanded by the Digital Omnibus to reach AI in very large platforms as well. Anyone modelling their exposure as a single act is modelling it wrong. No finding of infringement has been made and no fine imposed.", "key_facts": [ "Formal proceedings extended on 26 January 2026, Commission press release IP/26/203.", "Extends the proceedings originally opened against X in December 2023.", "Scope: systemic risk assessment and mitigation under DSA Articles 34 and 35 for Grok features and the Grok based recommender.", "DSA penalty ceiling is 6 percent of worldwide turnover, above every AI Act tier.", "No finding of infringement and no fine as of 20 August 2026." ], "timeline": [ { "date": "2023-12-18", "event": "Commission opens formal DSA proceedings against X" }, { "date": "2025-09-01", "event": "Commission sends a request for information about Grok features" }, { "date": "2026-01-26", "event": "Proceedings extended to cover Grok and the Grok based recommender" } ], "appeal": { "status": "none", "notes": "Not applicable while proceedings are open." }, "sources": [ { "name": "European Commission, Commission investigates Grok and X's recommender systems under the Digital Services Act (IP/26/203)", "url": "https://ec.europa.eu/commission/presscorner/detail/en/ip_26_203", "type": "primary", "date": "2026-01-26" } ], "related_ids": [ "AIT-2025-0002", "AIT-2024-0005" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2026-0002", "slug": "garante-myndoor-emotion-inference-warning", "title": "Garante warns Myndoor over workplace emotion inference, citing AI Act Article 5(1)(f)", "status": "confirmed", "action_type": "warning", "regime": [ "GDPR", "AI_ACT" ], "ai_act_relevance": "direct", "landmark": "First published decision by a European authority that expressly invokes a prohibition in Article 5 of the AI Act.", "provisions": [ { "instrument": "AI_ACT", "article": "5(1)(f)", "role": "cited" }, { "instrument": "GDPR", "article": "6", "role": "cited" }, { "instrument": "GDPR", "article": "9", "role": "cited" }, { "instrument": "GDPR", "article": "88", "role": "cited" } ], "authority_id": "garante", "target": { "name": "Myndoor S.r.l.", "sector": "workplace_ai", "hq_country": "IT" }, "ai_system": "Slack and Microsoft Teams plug in inferring employee stress from message content", "date_announced": "2026-05-14", "date_decision": "2026-05-14", "fine_amount_eur": null, "fine_original": null, "corrective_measures": [ "formal warning that sending aggregated stress reports to employers would breach the GDPR and the AI Act" ], "summary": "A Milan area startup built a plug in for Slack and Microsoft Teams that read the emotional content of workplace messages and reported inferred stress levels to employers. The Italian authority issued a formal warning under provvedimento no. 342 of 14 May 2026 rather than a fine, putting the company on notice that shipping the product as designed would breach both the GDPR and the AI Act. The AI Act citation is what makes this the most significant record on the tracker. Article 5(1)(f) prohibits placing on the market, putting into service or using AI systems to infer the emotions of a natural person in the workplace, outside narrow medical and safety exceptions, and that prohibition has applied since 2 February 2025. This is the first published European decision to invoke it. It is a warning, not a penalty, and the Garante is a data protection authority rather than a designated market surveillance authority under the AI Act, so the record is properly read as a data protection authority applying the AI Act as context to a GDPR assessment. It is not a fine under Article 99 and it does not make the count of AI Act fines anything other than zero. It is, however, the moment the prohibition stopped being theoretical.", "key_facts": [ "Formal warning, provvedimento no. 342 of 14 May 2026. No financial penalty.", "First published European decision expressly invoking AI Act Article 5(1)(f).", "Article 5(1)(f) prohibits inferring emotions of a natural person in the workplace, in force since 2 February 2025.", "Issued by a data protection authority, not by a designated AI Act market surveillance authority.", "Still not an Article 99 fine. The count of AI Act fines remains zero." ], "timeline": [ { "date": "2025-02-02", "event": "AI Act Article 5 prohibitions become applicable across the Union" }, { "date": "2026-05-14", "event": "Garante adopts provvedimento no. 342, the formal warning to Myndoor" } ], "appeal": { "status": "none", "notes": "A warning carries no penalty to appeal." }, "sources": [ { "name": "Garante, provvedimento n. 342 del 14 maggio 2026", "url": "https://www.garanteprivacy.it/web/guest/home/docweb", "type": "primary", "date": "2026-05-14" }, { "name": "PPC Land, Italy warns AI startup: Slack stress-detection plug-in may violate two EU laws", "url": "https://ppc.land/italy-warns-ai-startup-slack-stress-detection-plug-in-may-violate-two-eu-laws/", "type": "secondary", "date": "2026-06-02" } ], "related_ids": [ "AIT-2024-0006", "AIT-2024-0001" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" }, { "id": "AIT-2026-0003", "slug": "garante-character-ai-minor-protection-fine", "title": "Garante fines Character.AI 158,000 euro over age checks and protection of minors", "status": "confirmed", "action_type": "fine", "regime": [ "GDPR" ], "ai_act_relevance": "adjacent", "provisions": [ { "instrument": "GDPR", "article": "8", "role": "violated" }, { "instrument": "GDPR", "article": "13", "role": "violated" }, { "instrument": "GDPR", "article": "27", "role": "violated" }, { "instrument": "GDPR", "article": "35", "role": "violated" }, { "instrument": "AI_ACT", "article": "50", "role": "adjacent" } ], "authority_id": "garante", "target": { "name": "Character Technologies, Inc.", "sector": "companion_chatbot", "hq_country": "US" }, "ai_system": "Character.AI companion chatbot platform", "date_announced": "2026-07-09", "date_decision": "2026-07-03", "fine_amount_eur": 158000, "fine_original": { "amount": 158000, "currency": "EUR" }, "corrective_measures": [ "make age verification actually work", "stop previously blocked minors from simply registering again", "set the profiles of minors to private by default", "report the measures adopted within 120 days" ], "summary": "The most recent fine in this tracker, and the smallest against a private company. The Italian authority fined Character Technologies 158,000 euro over its companion chatbot platform, finding that the privacy information given to users was inadequate, that safeguards for minors and the age verification behind them did not work, that the data protection impact assessment was carried out late, and that the company appointed a representative in the Union late. The corrective orders are more demanding than the amount suggests: make age checks effective, close the re registration loophole that let a blocked minor sign up again, make minors' profiles private by default, and report back within 120 days. That reporting deadline is the part to watch, because it lands in November 2026 and non compliance opens a second phase in the same way the Clearview injunction did in France. Read next to the Replika fine from the year before, the direction is unmistakable. Italy has now sanctioned two companion chatbot providers on adjacent facts, both times about children, and both times about the gap between a terms of service age limit and a working age gate. The AI Act adds a duty on top of this from 2 August 2026: Article 50 requires that a person be told they are interacting with an AI system.", "key_facts": [ "Fine of 158,000 euro, decision of 3 July 2026, announced 9 July 2026.", "Findings: inadequate privacy information, ineffective age verification, late impact assessment, late appointment of an EU representative.", "Orders include private by default profiles for minors and a report within 120 days.", "The 120 day compliance report falls due in November 2026.", "Second Italian sanction against a companion chatbot provider in fourteen months." ], "timeline": [ { "date": "2026-07-03", "event": "Garante adopts the fining decision" }, { "date": "2026-07-09", "event": "Decision announced" }, { "date": "2026-11-06", "event": "120 day deadline for the company to report the measures adopted" } ], "appeal": { "status": "none", "notes": "No opposition recorded as of 20 August 2026." }, "sources": [ { "name": "Garante press release, Character.AI: sanzione del Garante privacy", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb", "type": "primary", "date": "2026-07-09" }, { "name": "TechNadu, Italy's Garante Fines Character AI Owner 158,000 euro for GDPR Breaches", "url": "https://www.technadu.com/italy-fines-character-ai-owner-e158000-over-gdpr-and-child-protection-failures/630737/", "type": "secondary", "date": "2026-07-10" } ], "related_ids": [ "AIT-2025-0003", "AIT-2024-0007" ], "date_added": "2026-08-20", "last_verified": "2026-08-20", "last_modified": "2026-08-20" } ] }