Editor’s Note: AI, privacy and policy experts put a number on Ireland’s AI ambition, and a price tag on it. On the main stage early on day one of the Dublin Tech Summit, a law-firm partner, OpenAI’s Irish chief and a former Twitter policy head agreed the country is positioned to lead AI governance, then spent the session working through the rules that could make or break that bet. Their discussion matters well beyond Dublin.
The takeaway for cybersecurity, data privacy, compliance and eDiscovery professionals is that the operative AI regulator for most organizations is still GDPR, that Europe’s high-risk obligations are set to slip to late 2027 and 2028 under a provisional deal, and that the United States is heading into conflict rather than clarity as Washington moves to preempt state AI law.
Watch three things next: the formal adoption of the EU’s Digital Omnibus before August, Ireland’s October AI summit during its Council presidency, and the first suits from the U.S. Justice Department’s AI litigation task force. Each will reset what governance teams must document, preserve and defend.
Content Assessment: Ireland's AI regulator role gets a hard look at Dublin Tech Summit
Information - 93%
Insight - 94%
Relevance - 94%
Objectivity - 92%
Authority - 94%
93%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Ireland's AI regulator role gets a hard look at Dublin Tech Summit."
Industry News – Artificial Intelligence Beat
Ireland’s AI regulator role gets a hard look at Dublin Tech Summit
ComplexDiscovery Staff
“Ireland is the de facto regulator of AI globally.” Dr. Barry Scannell said it flatly, early on the main stage of the Dublin Tech Summit. The claim framed the discussion that followed, even as the panel turned quickly to the costs, constraints and compliance burdens behind it.
Hold on to that line. The panel on digital economies and AI strategy doubled as a frank status check on whether Europe’s rulebook helps or hobbles the businesses building on top of it, and on what the answer means for everyone who has to govern the data underneath.
The session, moderated by Business Post technology and innovation editor Charlie Taylor, landed early on day one of the summit’s 10th anniversary edition at the RDS on May 27, the second turn on the main stage after the opening conversation with Workhuman founder Eric Mosley. It gathered three sources with front-row seats to the policy fight. Scannell is a partner in the technology group at law firm William Fry and a member of Ireland’s AI Advisory Council. Emma Redmond is associate general counsel and head of privacy and data protection at OpenAI, leads the company’s Irish operation and sits on the same council. Colin Crowell is global managing director of The Blue Owl Group and the former vice president of global public policy at Twitter.
Why Ireland thinks it holds a winning hand
Taylor’s opening question was whether Ireland sits squeezed between a permissive United States and a rules-heavy European Union, or benefits from straddling both. Crowell answered first, and bluntly. Ireland’s position would be the envy of similarly situated countries, he said, especially as a post-Brexit springboard for foreign investment into the EU single market. He cited Mario Draghi’s report on European competitiveness as a sign Brussels is moving to streamline market entry, and Ireland’s turn holding the rotating presidency of the Council of the EU, which runs July 1 to Dec. 31, 2026, as a chance to shape the agenda. He leaned on a line from his grandmother to make the point: the only question that matters in any situation is “compared to what?” Ireland’s setup, he said, should be measured against the real options other countries face, not against perfection, and on that test it looks strong.
Redmond rejected the crossroads framing outright. Ireland gets the direct benefit of regulating with Europe while innovating with the United States, she said. That position was seeded when IBM arrived over 70 years ago, and the country cannot take it for granted. She reached for OpenAI’s own scale to make the point that AI has shifted from novelty to daily practice, citing over 900 million weekly active users and roughly 3 billion chats a day. Those figures track the company’s February 2026 disclosure of 900 million weekly users and about 2.5 billion daily messages.
The real AI regulator is data protection
Scannell’s headline claim came with a twist. The law most likely to govern day-to-day AI use, he contended, is not the EU AI Act but the General Data Protection Regulation. The AI Act matters for the largest general-purpose models, he said, but for most organizations actually using AI, data protection is the more pressing constraint. That places Ireland’s Data Protection Commission, the lead EU supervisory authority for many of the biggest technology firms under the one-stop-shop, near the center of global AI oversight. The DPC of today, with three commissioners and dedicated AI expertise, is a different body from the single-commissioner office that opened under GDPR, Scannell said, describing Irish regulators as facilitators rather than punishers. For practitioners, the practical takeaway is to treat GDPR-grade data governance, not the AI Act, as the first line of AI compliance.
A regulation under repair
On the AI Act itself, the mood was candid. Scannell, who advises clients on cross-border AI launches, called the rollout poor even as he defended the idea of a central framework. The EU has missed nearly every deadline it set itself, he said; guidance has ballooned, with the definition of AI alone spawning pages of explanation; and the bloc has already moved to delay its own high-risk rules. The record backs him. The European Commission’s Digital Omnibus on AI, published Nov. 19, 2025, and agreed provisionally by Parliament and Council on May 7, 2026, would push high-risk obligations from August 2026 to Dec. 2, 2027 for standalone systems and Aug. 2, 2028 for systems built into products once the package is formally adopted, which must happen before the original August deadline. The same package added a ban on AI “nudifier” apps, the deepfake tools behind a scandal Scannell said Irish authorities moved fast to address.
Redmond, whose job is to make the rules workable, urged patience. “You have to make it what you need it to be,” she said of the AI Act, making the case that clarity speeds board and business decisions and that GDPR, for all its early friction, became a template other jurisdictions copied. Her tip for the smaller firms in the room: use the tools daily to understand them, and tie every compliance question back to the specific data being processed. Scannell added a competitive angle vendors should weigh. Going all in on high-risk frameworks such as data governance, bias monitoring and human oversight is expensive, he said, but it can become a regulatory moat rivals cannot easily cross, especially in regulated domains like recruitment and HR.
The American counterpoint
Crowell drew the contrast with Washington. Corporate entities have disliked regulation “since the times of the Greeks and the Romans,” he said, but smart leaders accept guardrails because certainty attracts investment and builds consumer trust. The 1990s internet boom rode light-touch U.S. laws on liability, copyright and children’s privacy, he said; today there is no comparable federal plan. States including California and Colorado have filled the gap, and President Donald Trump’s December 2025 executive order seeking to preempt state AI laws, backed by a Justice Department litigation task force, reaches for what Scannell called “one ring to rule” them, without yet putting a national framework on the books. A patchwork of 50 state rules helps no one trying to build a national market, Crowell warned. His advice, borrowed from chess champion Garry Kasparov: “A bad plan beats no plan.”
Talent, sovereignty and the fragmentation problem
On talent, Redmond was optimistic. Skilled people chase hard problems, she said, pointing to OpenAI’s recent disproof of a geometry conjecture open since 1946, announced days before the summit, as the kind of challenge that keeps researchers awake. New roles are emerging, from forward-deployed engineers to privacy engineers, and Ireland has among the most AI engineers per capita in Europe. She cited OpenAI’s government deployments in Estonia and Greece as proof of a widening “capability overhang” between countries that adopt AI and those that hesitate, and urged Ireland to close that gap during its presidency, including a planned AI summit in Dublin in October.
Scannell flagged the harder operational reality. Launching AI products across jurisdictions requires mandatory legal reviews in each one, he said, and copyright law for AI remains unsettled, with court cases pending and no clear answer yet on training-data infringement. Singapore allows text and data mining freely; the EU does not. “If you want to play our game, you have to play our rules,” he said of the European market. The result is fragmentation, and a growing push toward standardization, with clients now asking whether vendors hold certifications such as ISO/IEC 42001 for AI management systems or credentials from the International Association of Privacy Professionals.
The thread tied back to the summit’s opening session, where Mosley made the case that once every competitor holds the same AI tools, the differentiator collapses to humans and the data describing how they work. Both conversations landed in the same place: AI’s payoff depends on governance, trust and the people steering it.
What it means for security, governance and discovery teams
For cybersecurity, information governance and eDiscovery professionals, the panel mapped the next two years of work. In the EU, the high-risk delay buys runway, not relief. Employment and HR systems stay squarely in scope, so privacy and IG teams should build data governance, bias monitoring and human-oversight records now rather than wait for Dec. 2, 2027. The Digital Omnibus also reaches into GDPR and aims to trim overlap among GDPR, the NIS2 Directive and DORA reporting, a direct concern for security teams managing incident disclosure. And because the DPC acts as lead supervisor for much of big tech, Irish decisions ripple through every multinational’s program.
In the United States, the picture is conflict, not deregulation. The clash between state statutes and Trump’s preemption order means legal and discovery teams must track diverging regimes, anticipate suits from the new Justice Department task force, and preserve the records that AI governance and copyright disputes will demand: model logs, training-data provenance and automated-decision rationales. For both regions, the agentic tooling layer Scannell described spins up fresh categories of data to secure, govern and produce. Certifications like ISO/IEC 42001 and IAPP credentials are fast becoming procurement table stakes on both sides of the Atlantic.
Which brings the panel back to where it started. Scannell closed with the day’s widest frame, saying AI may rank with the introduction of agriculture in its impact, and that the choices Ireland and every regulated business make over the next five to 10 years will shape the decades after. So return to his opening line. If Ireland really is the de facto regulator of AI, the open question is whether it can turn that claim into durable advantage, and the honest test is Crowell’s: compared to what? For the teams that secure, govern and discover the data beneath every AI system, that question now lands closer to home. If governance is becoming the real competitive edge in AI, which part of your organization is ready to own it: legal, security, privacy, or all three at once?
News sources
- Dublin Tech Summit unveils 2026 agenda for 10th anniversary edition (Business & Finance)
- Artificial Intelligence: Council and Parliament agree to simplify and streamline rules (Council of the EU)
- Artificial Intelligence Act: delayed application, ban on nudifier apps (European Parliament)
- President Trump Signs Executive Order Preempting State AI Laws and Centralizing Federal Oversight (Seyfarth Shaw LLP)
- Presidency of the Council of the European Union (Ireland.ie)
- Introducing OpenAI’s Education for Countries (OpenAI)
- OpenAI claims it solved an 80-year-old math problem, for real this time (TechCrunch)
- William Fry consultant appointed to Ireland’s AI Advisory Council (William Fry)
Assisted by GAI and LLM Technologies
Additional Reading
- HaystackID brings AI privacy and discovery stack to Dublin as European compliance pressure mounts
- Latitude59 final day in Tallinn: AI sovereignty, a driverless permit and €450,000 to three startups
- Bold Stage opens Latitude59 2026 with AI, missiles and the New Nordics bet
- Estonia opens Latitude59 with sandbox framework for legal exemptions
- Seven startups from four nations compete for Latitude59’s nearly half-million-euro investment prize
- Big tech, defense and climate to share the main stage at Latitude59 2026
- Latitude59 pitch competition draws 465 startups from 53 countries as prize pool grows to €400,000
- Baltic and Nordic Angel Networks Pool €300,000 for Latitude59 Pitch Competition as Cross-Border Startup Investing Deepens
- Latitude59 Opens Pitch Applications as Investors Raise the Bar on Operational Readiness
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

































