Editor’s Note: AI, privacy and policy experts put a number on Ireland’s AI ambition, and a price tag on it. On the main stage early on day one of the Dublin Tech Summit, a law-firm partner, OpenAI’s Irish chief and a former Twitter policy head agreed the country is positioned to lead AI governance, then spent the session working through the rules that could make or break that bet. Their discussion matters well beyond Dublin.

The takeaway for cybersecurity, data privacy, compliance and eDiscovery professionals is that the operative AI regulator for most organizations is still GDPR, that Europe’s high-risk obligations are set to slip to late 2027 and 2028 under a provisional deal, and that the United States is heading into conflict rather than clarity as Washington moves to preempt state AI law.

Watch three things next: the formal adoption of the EU’s Digital Omnibus before August, Ireland’s October AI summit during its Council presidency, and the first suits from the U.S. Justice Department’s AI litigation task force. Each will reset what governance teams must document, preserve and defend.


Content Assessment: Ireland's AI regulator role gets a hard look at Dublin Tech Summit

Information - 93%
Insight - 94%
Relevance - 94%
Objectivity - 92%
Authority - 94%

93%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Ireland's AI regulator role gets a hard look at Dublin Tech Summit."


Industry News – Artificial Intelligence Beat

Ireland’s AI regulator role gets a hard look at Dublin Tech Summit

ComplexDiscovery Staff

“Ireland is the de facto regulator of AI globally.” Dr. Barry Scannell said it flatly, early on the main stage of the Dublin Tech Summit. The claim framed the discussion that followed, even as the panel turned quickly to the costs, constraints and compliance burdens behind it.

Hold on to that line. The panel on digital economies and AI strategy doubled as a frank status check on whether Europe’s rulebook helps or hobbles the businesses building on top of it, and on what the answer means for everyone who has to govern the data underneath.

The session, moderated by Business Post technology and innovation editor Charlie Taylor, landed early on day one of the summit’s 10th anniversary edition at the RDS on May 27, the second turn on the main stage after the opening conversation with Workhuman founder Eric Mosley. It gathered three sources with front-row seats to the policy fight. Scannell is a partner in the technology group at law firm William Fry and a member of Ireland’s AI Advisory Council. Emma Redmond is associate general counsel and head of privacy and data protection at OpenAI, leads the company’s Irish operation and sits on the same council. Colin Crowell is global managing director of The Blue Owl Group and the former vice president of global public policy at Twitter.



Why Ireland thinks it holds a winning hand

Taylor’s opening question was whether Ireland sits squeezed between a permissive United States and a rules-heavy European Union, or benefits from straddling both. Crowell answered first, and bluntly. Ireland’s position would be the envy of similarly situated countries, he said, especially as a post-Brexit springboard for foreign investment into the EU single market. He cited Mario Draghi’s report on European competitiveness as a sign Brussels is moving to streamline market entry, and Ireland’s turn holding the rotating presidency of the Council of the EU, which runs July 1 to Dec. 31, 2026, as a chance to shape the agenda. He leaned on a line from his grandmother to make the point: the only question that matters in any situation is “compared to what?” Ireland’s setup, he said, should be measured against the real options other countries face, not against perfection, and on that test it looks strong.

Redmond rejected the crossroads framing outright. Ireland gets the direct benefit of regulating with Europe while innovating with the United States, she said. That position was seeded when IBM arrived over 70 years ago, and the country cannot take it for granted. She reached for OpenAI’s own scale to make the point that AI has shifted from novelty to daily practice, citing over 900 million weekly active users and roughly 3 billion chats a day. Those figures track the company’s February 2026 disclosure of 900 million weekly users and about 2.5 billion daily messages.



The real AI regulator is data protection

Scannell’s headline claim came with a twist. The law most likely to govern day-to-day AI use, he contended, is not the EU AI Act but the General Data Protection Regulation. The AI Act matters for the largest general-purpose models, he said, but for most organizations actually using AI, data protection is the more pressing constraint. That places Ireland’s Data Protection Commission, the lead EU supervisory authority for many of the biggest technology firms under the one-stop-shop, near the center of global AI oversight. The DPC of today, with three commissioners and dedicated AI expertise, is a different body from the single-commissioner office that opened under GDPR, Scannell said, describing Irish regulators as facilitators rather than punishers. For practitioners, the practical takeaway is to treat GDPR-grade data governance, not the AI Act, as the first line of AI compliance.



A regulation under repair

On the AI Act itself, the mood was candid. Scannell, who advises clients on cross-border AI launches, called the rollout poor even as he defended the idea of a central framework. The EU has missed nearly every deadline it set itself, he said; guidance has ballooned, with the definition of AI alone spawning pages of explanation; and the bloc has already moved to delay its own high-risk rules. The record backs him. The European Commission’s Digital Omnibus on AI, published Nov. 19, 2025, and agreed provisionally by Parliament and Council on May 7, 2026, would push high-risk obligations from August 2026 to Dec. 2, 2027 for standalone systems and Aug. 2, 2028 for systems built into products once the package is formally adopted, which must happen before the original August deadline. The same package added a ban on AI “nudifier” apps, the deepfake tools behind a scandal Scannell said Irish authorities moved fast to address.

Redmond, whose job is to make the rules workable, urged patience. “You have to make it what you need it to be,” she said of the AI Act, making the case that clarity speeds board and business decisions and that GDPR, for all its early friction, became a template other jurisdictions copied. Her tip for the smaller firms in the room: use the tools daily to understand them, and tie every compliance question back to the specific data being processed. Scannell added a competitive angle vendors should weigh. Going all in on high-risk frameworks such as data governance, bias monitoring and human oversight is expensive, he said, but it can become a regulatory moat rivals cannot easily cross, especially in regulated domains like recruitment and HR.

The American counterpoint

Crowell drew the contrast with Washington. Corporate entities have disliked regulation “since the times of the Greeks and the Romans,” he said, but smart leaders accept guardrails because certainty attracts investment and builds consumer trust. The 1990s internet boom rode light-touch U.S. laws on liability, copyright and children’s privacy, he said; today there is no comparable federal plan. States including California and Colorado have filled the gap, and President Donald Trump’s December 2025 executive order seeking to preempt state AI laws, backed by a Justice Department litigation task force, reaches for what Scannell called “one ring to rule” them, without yet putting a national framework on the books. A patchwork of 50 state rules helps no one trying to build a national market, Crowell warned. His advice, borrowed from chess champion Garry Kasparov: “A bad plan beats no plan.”



Talent, sovereignty and the fragmentation problem

On talent, Redmond was optimistic. Skilled people chase hard problems, she said, pointing to OpenAI’s recent disproof of a geometry conjecture open since 1946, announced days before the summit, as the kind of challenge that keeps researchers awake. New roles are emerging, from forward-deployed engineers to privacy engineers, and Ireland has among the most AI engineers per capita in Europe. She cited OpenAI’s government deployments in Estonia and Greece as proof of a widening “capability overhang” between countries that adopt AI and those that hesitate, and urged Ireland to close that gap during its presidency, including a planned AI summit in Dublin in October.

Scannell flagged the harder operational reality. Launching AI products across jurisdictions requires mandatory legal reviews in each one, he said, and copyright law for AI remains unsettled, with court cases pending and no clear answer yet on training-data infringement. Singapore allows text and data mining freely; the EU does not. “If you want to play our game, you have to play our rules,” he said of the European market. The result is fragmentation, and a growing push toward standardization, with clients now asking whether vendors hold certifications such as ISO/IEC 42001 for AI management systems or credentials from the International Association of Privacy Professionals.

The thread tied back to the summit’s opening session, where Mosley made the case that once every competitor holds the same AI tools, the differentiator collapses to humans and the data describing how they work. Both conversations landed in the same place: AI’s payoff depends on governance, trust and the people steering it.

What it means for security, governance and discovery teams

For cybersecurity, information governance and eDiscovery professionals, the panel mapped the next two years of work. In the EU, the high-risk delay buys runway, not relief. Employment and HR systems stay squarely in scope, so privacy and IG teams should build data governance, bias monitoring and human-oversight records now rather than wait for Dec. 2, 2027. The Digital Omnibus also reaches into GDPR and aims to trim overlap among GDPR, the NIS2 Directive and DORA reporting, a direct concern for security teams managing incident disclosure. And because the DPC acts as lead supervisor for much of big tech, Irish decisions ripple through every multinational’s program.

In the United States, the picture is conflict, not deregulation. The clash between state statutes and Trump’s preemption order means legal and discovery teams must track diverging regimes, anticipate suits from the new Justice Department task force, and preserve the records that AI governance and copyright disputes will demand: model logs, training-data provenance and automated-decision rationales. For both regions, the agentic tooling layer Scannell described spins up fresh categories of data to secure, govern and produce. Certifications like ISO/IEC 42001 and IAPP credentials are fast becoming procurement table stakes on both sides of the Atlantic.

Which brings the panel back to where it started. Scannell closed with the day’s widest frame, saying AI may rank with the introduction of agriculture in its impact, and that the choices Ireland and every regulated business make over the next five to 10 years will shape the decades after. So return to his opening line. If Ireland really is the de facto regulator of AI, the open question is whether it can turn that claim into durable advantage, and the honest test is Crowell’s: compared to what? For the teams that secure, govern and discover the data beneath every AI system, that question now lands closer to home. If governance is becoming the real competitive edge in AI, which part of your organization is ready to own it: legal, security, privacy, or all three at once?

News sources



Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.