AI Risk FAQ
What is AI data privacy risk?
Quick answer
AI data privacy risk arises when personal, confidential, or sensitive data enters AI systems without adequate privacy protections. The main risks are: data entered into consumer AI tools (ChatGPT, Copilot personal accounts, etc.) being used for model training; data processed outside Ireland or the EU without adequate transfer safeguards; AI outputs that reconstruct confidential information; and AI systems retaining data longer than permitted. For Irish organisations, AI data privacy risk sits at the intersection of GDPR and the EU AI Act.
The main AI data privacy risk scenarios for Irish organisations
A risk assessment should examine the actual account and contract. Training use, retention and administrator controls differ between products and account types, and can change over time. Review the processing agreement and the permissions granted to connected sources. A system may expose information through excessive source permissions even where prompts are not used for training. Check international transfers where relevant, along with access controls and the ability to delete information. Avoid assuming that an enterprise label resolves every GDPR issue.
Controls for managing AI data privacy risk
Managing AI data privacy risk requires four controls working together. First, an AI use policy that defines what data can and cannot be entered into which AI tools; specifically addressing consumer vs enterprise tools, and the categories of data (personal data, client data, confidential business data) that require restricted handling. Second, an enterprise AI tool procurement process that verifies data processing terms before tools are approved for use; including checking whether data is used for training, where it is processed, and what the retention period is. Third, technical controls where feasible; enterprise agreements that disable training data use, data loss prevention tools that flag sensitive data being entered into AI tools. Fourth, employee training: the AI use policy is only effective if employees understand it and understand why it matters. The intersection of GDPR and the EU AI Act means that AI data privacy failures can attract enforcement from both the Data Protection Commission and EU AI Act supervisory authorities.
Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.
Acuity AI Advisory’s AI governance frameworks address AI data privacy risk; at the intersection of GDPR and the EU AI Act. Our AI governance service.