AI Enforcement Actions

Legal Framework

AI enforcement actions sit at the intersection of the GDPR and the emerging EU AI Act. The GDPR's substantive provisions—particularly Article 6(1) (lawfulness of processing), Article 22 (automated decision-making), and Article 35 (data protection impact assessments)—supply the primary legal basis for regulatory action against AI deployments that fail to protect data subjects. Article 47 of the Charter of Fundamental Rights provides the constitutional floor: data subjects must retain an effective judicial remedy, including the ability to challenge outputs generated by automated systems. Where AI opacity prevents meaningful understanding of how a decision was reached, the procedural guarantees of the GDPR are effectively nullified.

Key Developments

The Court of Justice's ruling in Ligue des droits humains ASBL v Conseil des ministres established a critical threshold: AI systems whose internal workings are too opaque to explain a positive match undermine not only substantive data protection rights but also the procedural right to an effective remedy. The Court emphasized that:

"given the opacity which characterises the way in which artificial intelligence technology works, it might be impossible to understand the reason why a given program arrived at a positive match"
— Ligue des droits humains ¶195

This creates a practical enforcement vector: regulators can challenge AI deployments not merely for unlawful processing but for structurally depriving data subjects of judicial recourse. The EDPB has reinforced this enforcement posture by expanding accessibility of guidance, noting that it launched:

"a series of summaries of EDPB guidelines to help non-expert individuals and organisations identify in an easier way the most important points to consider"
— EDPB Annual Report 2024 §5

Status of the Debate

This topic is developing. No dominant doctrinal pattern has yet emerged because AI enforcement spans multiple legal instruments (GDPR, AI Act, sectoral directives) and competent authorities have only begun coordinating. The Ligue des droits humains ruling provides the strongest doctrinal anchor—linking AI opacity directly to Article 47 Charter violations—but it addresses the PNR Directive context specifically. What would resolve the open questions is a CJEU ruling on a DPA enforcement action against a private-sector AI deployment under the GDPR, clarifying whether opacity-based Article 47 reasoning extends to commercial automated processing.

Practical Guidance

• Document explainability mechanisms for every AI system processing personal data; if internal logic cannot be reconstructed for regulatory review, the deployment is vulnerable under the Ligue des droits humains reasoning on Article 47.
• Conduct DPIAs under Article 35 that specifically address opacity risks and their impact on data subjects' ability to exercise rights under Article 22.
• Maintain human-in-the-loop review of AI outputs; the Court warned that AI can "render redundant the individual review of positive matches," so demonstrable human oversight must be substantive, not merely formal.
• Track EDPB guidance summaries as enforcement priorities; DPA coordination increasingly targets sectors where AI opacity intersects with fundamental rights protections.