On 14 October 2025 the European Data Protection Board (EDPB) announced that its 2026 Coordinated Enforcement Framework will focus on the transparency and information duties under the General Data Protection Regulation. National data protection authorities will jointly examine whether controllers and processors adequately inform individuals about their data processing, and will aggregate the findings into an EU-level enforcement position.
Why the mechanism matters
The coordinated enforcement framework is a key EDPB tool for consistency across member states. Its features are a common topic, synchronised timing and aggregated results. For companies, the practical effect is that one authority’s enforcement position rapidly becomes an EU-wide expectation rather than an isolated local event.
Earlier rounds targeted other compliance themes. This round’s choice of transparency and information duties points directly at a long-standing weak spot: policies exist, but users cannot understand them; information is given, but not on the matters that count.
Why this matters especially for AI services
AI services face structural difficulty on transparency.
Complexity is hard to express plainly. The data processing logic in training, inference and feedback learning is not easy to explain to individuals.
Automated decision-making disclosure. The GDPR has specific information and rights requirements for automated decision-making and profiling, yet many AI products do not fully disclose the relevant logic.
Training data provenance. The source and lawfulness of training data are becoming a focus of supervision and litigation, yet this is often omitted from user notices.
Four things companies can do early
First, rewrite the core of the privacy notice. Set out purpose, method, data categories, retention period and automated decision logic in readable terms rather than a stack of legal jargon. See our GDPR and cross-border service.
Second, inventory automated decisions. Identify which features constitute automated decision-making or profiling, and put in place corresponding disclosure and objection mechanisms.
Third, prepare privacy impact assessments. For high-risk processing, the assessment document is key evidence of having met duties. See our data compliance service.
Fourth, build transparency into product design. Transparency is not only a documentation issue but an interaction issue — can users readily understand data processing within the product? See our note on the AI application ethics and security guideline.
By choosing transparency as the next unified enforcement topic, the EDPB signals that supervision is shifting from whether systems exist to whether users can genuinely understand. See our multi-jurisdiction service and our note on the UK Clearview ruling.
This article is based on the EDPB announcement of its 2026 coordinated enforcement topic and on public information. It is for general reference only and does not constitute legal advice.