how it happened
- whoAI servicelaunched in Italy
- the gapno clear lawful basisno age checks
- the resultservice blockedrestored after fixes
what everyone assumed
The general-purpose AI tools arrived faster than anyone expected, and the working assumption across a lot of companies was that the rules had not caught up, so there was room to adopt first and sort out compliance later. Regulators move slowly, the reasoning went, and a new technology buys itself a grace period while the authorities study it. The belief was that the enforcement clock had not started yet.
what happened
The tool reached Italian users and processed their personal data the way it processed everyone’s, as training and input, without a clear lawful basis spelled out to the people typing. There was no obvious age check at the door. The transparency notices did not map onto what the system was actually doing with the data. None of this looked like an incident; it looked like a product working normally, in a market where the relevant law, the GDPR, had applied in full since 2018.
step by step
- the service processes Italian users' dataNo clear lawful basis, no age check, notices that do not match what happens.the assumption breaks here
- 31 March 2023the Garante orders a restrictionThe service goes dark in Italy.
- 11 April 2023specific measures demandedWith a deadline of 30 April.
- 28 April 2023changes made, service reinstatedThe GDPR had applied in full since 2018.
how it surfaced
On 31 March 2023 the Italian data protection authority, the Garante, ordered a temporary restriction on the processing of Italian users’ personal data, and the service went dark in Italy. The order cited the absence of a lawful basis, the inaccuracy of some generated personal data, the transparency gap, and the missing age verification. On 11 April the Garante set out the specific measures required, with a deadline of 30 April. The company made the changes, and on 28 April 2023 the service was reinstated in Italy. The grace period had only ever been an assumption.
The enforcement clock for an AI tool is not the age of the tool; it is the age of the law it touches.
A regulator does not need a new statute to act when the data-protection rules already apply to whatever the tool is doing with people’s data.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA regulator asks questions, or bans the tool in your market overnight.what it costs youYour team loses the tool mid-project and you are explaining your data use to an authority.
- or it goes like thisit happenedSamsung, 2023howEngineers paste code and notes into a free chatbot to get help.what leavesconfidential code and meeting noteswho ends up with itan AI vendor on consumer terms
- or it goes like thisit happenedDeepSeek exposed database, 2025howThe AI vendor leaves its own database open.what leaveseveryone's chats and the vendor's keyswho ends up with itanyone on the internet
sources
- "Stop to ChatGPT: lack of a legal basis for the processing of users' personal data," Garante per la protezione dei dati personali, provision of 30/31 March 2023.
- "ChatGPT: OpenAI reinstates service in Italy after meeting the Garante's requirements," Garante, 28 April 2023.
- "Italy's Garante imposes and then withdraws a ban on ChatGPT," Privacy Laws & Business, April 2023.
your turn
what you can do about it
this week
For one AI tool your teams use, write down what personal data it processes and under what lawful basis.
Somewhere in your company a new AI tool is probably in use under the same quiet assumption, that the rules have not caught up, so the compliance question can wait. The question the quiet months ask is which existing law already applies to it today, before any AI-specific one arrives. The Garante acted on rules that had been in force for five years, and the answer to that question was available the whole time.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →