Rome court annuls 15 million euro fine against OpenAI

The annulment of the fine

On March 18, 2026, the Court of Rome completely annulled a decision by the Italian data protection authority, known as the Garante. The original order had imposed a €15 million fine on OpenAI and required the company to run a six-month public information campaign across radio, television, and the internet.

The Garante had originally issued the fine because it found OpenAI failed to notify the authority of a 2023 data breach. The authority also claimed OpenAI lacked a legal basis for training ChatGPT on personal data and failed to provide adequate age verification for children under 13.

While the court did not find that OpenAI had complied with the General Data Protection Regulation (GDPR), it ruled that the Garante was no longer the authority entitled to make the decision. The court's ruling was based entirely on the grounds of jurisdiction rather than the merits of the privacy violations.

How the one-stop-shop works

The core of the dispute involves the GDPR's one-stop-shop mechanism, which is designed to streamline regulation for companies operating across multiple EU countries. Under this rule, the supervisory authority of a company's main or single establishment has exclusive competence over cross-border processing.

In this case, the Irish Data Protection Commission formally recognized OpenAI Ireland Ltd as the company's single establishment in the European Economic Area on February 15, 2024. Because this recognition happened while the Italian investigation was still active, the court ruled that the file should have been moved to Dublin.

The court relied on a European Data Protection Board opinion which suggests that competence can switch to a new lead authority at any point until a final decision is adopted. The court held that any pending proceeding must be transferred with the establishment, regardless of when the specific violations occurred.

A technicality of timing

A major point of contention was whether the Italian authority could keep the parts of the investigation that concerned conduct completed before the Irish establishment existed. The Garante argued that it should keep the finished parts of the file, but the court disagreed with this split.

The court ruled that the word 'mainly' in the relevant European guidelines describes the type of cases where these rules usually apply, but it does not exclude completed infringements. This means that even if a breach happened before OpenAI had a recognized Irish headquarters, the entire file must still move to the Irish authority.

OpenAI welcomed the decision, stating it has always been committed to respecting user privacy. The Garante has not yet commented on the ruling, and the court did not provide a full explanation for its decision until the grounds were published in May 2026.

The enforcement gap

Legal experts have raised concerns that this ruling might create an enforcement gap for certain types of violations. For example, a data breach notification is a one-time duty that occurred in 2023, long before the Irish establishment was recognized or incorporated.

Some scholars argue that the Irish authority might not have the legal power to adjudicate a notification that was owed to the Italian authority years prior. They suggest this could leave certain pre-establishment conduct effectively unenforceable because the 'venue' for the crime has shifted to a body that wasn't in charge when the event happened.

Because this was a first-instance judgment by a single judge, the legal status of these pre-establishment conducts remains unsettled. There is currently no clear consensus on whether the Irish authority can step in to enforce rules for actions that took place before their jurisdiction was established.

What happens next

The €15 million fine is currently gone, and the order for a public media campaign has been removed. However, the Garante has not removed the case from its records entirely, but rather set it aside as a matter of procedure.

The outcome of the case is not yet fully closed because the Garante may still appeal the decision to a higher court. Additionally, it is unclear if the Irish Data Protection Commission will take up the transferred file and issue a new ruling on the training practices and data breaches.

For now, the case serves as a reminder of how corporate headquarters and official recognitions shape the landscape of AI regulation. The question of who holds the power to punish AI companies for past actions remains a significant legal hurdle for European regulators.

The legal landscape

This ruling is significant because it was the only final GDPR enforcement decision produced in Europe during the initial launch period of generative AI. By annulling the fine, the court has effectively moved the goalposts for how these companies are held accountable for early data practices.

The Italian firm Rödl & Partner noted that the judgment should not be read as a green light for OpenAI's practices. Instead, it is a procedural transfer of competence, meaning the legal fight over the merits of the case is simply moving to a different desk in Dublin.

Observers will now watch to see if the Irish authority can successfully navigate the complexities of a file that contains both ongoing and completed violations. The final resolution will depend on whether the Irish regulators can assert authority over events that predated their official recognition as the lead supervisor.

The impact on AI training

The original Italian decision was notable for its specific requirements regarding how ChatGPT is trained on personal data. The Garante had demanded a high level of transparency, requiring OpenAI to explain how users can object to, rectify, or erase their data from training sets.

By annulling the decision, the court has left these specific requirements in limbo. OpenAI's practices regarding training data and age verification remain under scrutiny, but the immediate pressure from the Italian government has been lifted by the jurisdictional shift.

The case highlights the tension between national regulators who want to protect their citizens and the EU's desire for a unified regulatory environment. As more AI companies establish European headquarters, the 'one-stop-shop' will become the primary battleground for data privacy rights.

Regulatory uncertainty

The lack of a clear explanation from the court at the time of the ruling created a period of uncertainty for both the company and the regulators. It took several months for the full grounds to be published, revealing the specific reliance on the European Data Protection Board's opinions.

This delay underscores how complex the intersection of national law and EU-wide regulations can be. While the court's logic seems clear on the surface, the practical application to historical data breaches remains a point of heavy debate among legal scholars.

As the case moves forward, it will serve as a precedent for how other AI companies might structure their European presence to manage regulatory risk. The strategic placement of a 'single establishment' is now a critical factor in how companies navigate the growing web of AI oversight in the European Economic Area.

The role of the DPC

The Irish Data Protection Commission (DPC) is now the primary body responsible for overseeing OpenAI's activities in the EU. They will be tasked with reviewing the Italian Garante's findings and deciding how to proceed with the investigation into ChatGPT's data practices.

The DPC must navigate the fact that some of the allegations involve events that happened before they were the designated lead authority. This could lead to a complex legal process where they must determine which violations they have the power to sanction and which must be left to the Italian authorities.

The DPC's decisions will set the tone for how generative AI is regulated across the entire European Economic Area. Their approach will influence not only OpenAI but every other AI company looking to operate legally and transparently within the European market.

Summary of the ruling

To summarize, the Court of Rome did not rule that OpenAI did nothing wrong. It ruled that the Italian authority was the wrong person to ask for the punishment. The €15 million fine and the media campaign order are currently voided because the law says the Irish authority should be in charge.

The case is a technical victory for OpenAI in terms of the immediate fine, but it does not provide a permanent shield against regulation. The underlying issues of data transparency, breach notification, and age verification are still valid legal questions that need to be answered by the correct authority.

The situation remains fluid as the Garante considers its next steps and the Irish DPC prepares to receive the file. For the average user, this means the rules governing how your data is used to train AI are still being negotiated in the halls of European law.

The path forward

The next major milestone will be the official receipt and review of the file by the Irish Data Protection Commission. They will need to determine which parts of the Italian investigation they can legally proceed with and which parts may be outside their jurisdiction.

Legal experts are already suggesting that a preliminary reference to the Court of Justice might be necessary to resolve the 'enforcement gap.' This would provide a definitive answer on whether an authority can punish conduct that happened before it was granted lead status.

Until that happens, the regulatory environment for generative AI in Europe remains in a state of transition. This case serves as a blueprint for how jurisdictional maneuvers can delay or redirect the enforcement of major data privacy laws against global technology firms.

Corporate strategy in the EU

This case highlights a growing trend of tech companies using the one-stop-shop to consolidate their regulatory oversight. By establishing a single headquarters in a country like Ireland, companies can theoretically deal with one regulator instead of dozens across the continent.

However, as this case shows, the timing of that establishment matters immensely. If a company waits too long to establish a headquarters while being investigated, they may find themselves in a jurisdictional tug-of-war between different national authorities.

For the AI industry, this means that corporate structure is just as important as the technology itself. How a company chooses to organize its European operations will directly dictate which laws apply and which regulators have the power to issue multi-million euro fines.

The Garante's position

The Italian Garante remains silent on the court's decision, but its original stance was one of significant concern over AI's impact on children and data privacy. The authority had been proactive in seeking to protect Italian citizens from the potential risks of unmonitored AI training.

The fact that the court annulled their decision based on a procedural point rather than a failure of their investigation is a blow to the authority's immediate goals. They will now have to work with the Irish DPC to ensure that the concerns they raised are eventually addressed.

The Garante's experience serves as a warning to other national regulators. It shows that even if a regulator identifies clear violations, the procedural rules of the GDPR can shift the power of enforcement to another country, potentially slowing down the pace of regulation.

Transparency and the user

One of the original orders from the Garante was aimed at making AI more transparent for the general public. It wanted OpenAI to clearly explain how it collects data and how users can opt out of having their information used to train its models.

While the fine was annulled, the underlying demand for transparency remains a core part of the GDPR. Users can still expect that the Irish DPC will eventually have to address whether OpenAI's current practices meet the required standards for information and consent.

For the curious reader, this case illustrates that the fight for AI accountability is not just about money. It is about establishing the rules of the road for how personal information is handled in the age of generative models, regardless of which country's court is currently holding the gavel.

Conclusion of the ruling

The Court of Rome's decision was a procedural move that had a massive financial impact. By annulling the €15 million fine, the court prioritized the strict interpretation of EU jurisdictional rules over the immediate enforcement of a specific penalty.

While OpenAI won this round, the underlying legal challenges regarding their training methods and data privacy remain. The case has simply moved from one desk in Rome to another in Dublin, where the next chapter of the regulatory battle will be written.

This story serves as a reminder that in the world of AI regulation, the details matter. From corporate headquarters to the specific wording of international guidelines, every piece of the puzzle shapes how the technology will be governed.

The Irish DPC's role

The Irish Data Protection Commission (DPC) is now at the center of the OpenAI regulatory story in Europe. They will be tasked with reviewing the Italian Garante's findings and deciding how to proceed with the investigation into ChatGPT's data practices.

The DPC must navigate the fact that some of the allegations involve events that happened before they were the designated lead authority. This could lead to a complex legal process where they must determine which violations they have the power to sanction and which must be left to the Italian authorities.

The DPC's decisions will set the tone for how generative AI is regulated across the entire European Economic Area. Their approach will influence not only OpenAI but every other AI company looking to operate legally and transparently within the European market.

Impact on AI development

For AI developers, this case underscores the importance of early and clear establishment of European headquarters. Companies must be mindful of how their corporate structure interacts with the GDPR's jurisdictional rules, especially during active investigations.

The ruling suggests that while a company can move its 'lead' authority, it cannot easily escape the scrutiny of the regulators. The move to Ireland doesn't erase the past actions of the company; it only changes which office is responsible for looking into them.

As AI technology continues to evolve, the legal frameworks surrounding it will become increasingly sophisticated. This case is a prime example of the technical and procedural hurdles that companies must clear to ensure their growth is not hampered by unexpected jurisdictional shifts.

Data breach notifications

A specific point of contention in this case was a 2023 data breach that OpenAI failed to report within the required time window. Because this happened before the Irish establishment was recognized, the court's ruling creates a question of who is responsible for punishing that specific failure.

The Garante felt it had the right to punish this because the breach affected Italian citizens. However, the court's logic suggests that because the file is moving to Ireland, the Italian authority might lose the power to enforce the penalty for that specific incident.

This highlights a potential loophole in the one-stop-shop mechanism. If a company can move its headquarters after a violation occurs, it might be able to shift the responsibility for that violation to an authority that has no jurisdiction over the past events.

The future of GDPR enforcement

This case will likely lead to more clarity on how the one-stop-shop mechanism handles 'continuing' versus 'completed' infringements. The court's interpretation of the word 'mainly' in the European guidelines will be a key point of reference for future litigation.

Regulators may seek to tighten the rules to prevent companies from using jurisdictional shifts to delay or avoid penalties. The goal of the GDPR is to ensure that companies are held accountable, and this case shows how procedural technicalities can complicate that goal.

For the broader AI industry, the message is clear: the regulatory environment is still being built. Every court ruling and every jurisdictional shift helps define the boundaries of what is permissible in the era of large language models.

Final thoughts on the court

The Court of Rome's decision was a procedural move that had a massive financial impact. By annulling the €15 million fine, the court prioritized the strict interpretation of EU jurisdictional rules over the immediate enforcement of a specific penalty.

While OpenAI won this round, the underlying legal challenges regarding their training methods and data privacy remain. The case has simply moved from one desk in Rome to another in Dublin, where the next chapter of the regulatory battle will be written.

This story serves as a reminder that in the world of AI regulation, the details matter. From corporate headquarters to the