AI Projects Are Expanding The DPO Role By Default
Data protection officers are often the first established governance specialists invited into an AI project. That makes sense when personal data, profiling, automated decisions, monitoring, or sensitive information is involved. It becomes a problem when the organization quietly turns the DPO into the owner of model safety, cybersecurity, product quality, procurement, ethics, and every new legal obligation.
CNIL reported that 70 percent of responding organizations use or plan to use AI, while fewer than a quarter have a formal AI strategy or policy. Fifty-five percent of DPOs said the EU AI Act already falls within their responsibility, yet only 27 percent reported good knowledge of the text and 85 percent had not received AI-specific training. The gap requires a boundary, not merely more tasks.
Role Ambiguity Weakens Independence And Accountability
A DPO is expected to inform, advise, monitor, and act independently on data-protection matters. If the same person designs the AI system, chooses the risk treatment, and approves deployment, later oversight may become self-review. Meanwhile, product and business owners can avoid accountability by describing every difficult decision as a compliance question for privacy.
AI introduces issues that overlap privacy but are not identical: accuracy, robustness, discrimination, intellectual property, cybersecurity, consumer protection, worker safety, sector rules, and operational resilience. Assigning all of them to the DPO may create a single visible owner with neither authority nor resources. A decision boundary preserves contribution while keeping responsibility where decisions are made.
Unclear Ownership Produces Delay And Blind Spots
When teams do not know who decides, reviews arrive late, issues bounce among legal, security, privacy, and product, or deployment proceeds on the assumption that silence means approval. Estimate direct cost as delayed project days multiplied by daily team cost plus repeated review hours. Separate compliance exposure and individual harm because those consequences require case-specific assessment.
An illustrative project with eight people costing an average of $900 per day loses $36,000 during a five-day ownership dispute. More importantly, the debate may still miss a risk if everyone expects the DPO to cover it. Clear routing can reduce delay, but its main value is ensuring that each material risk has an accountable decision-maker.
Diagnose The Current Governance Chain
Map AI intake, data selection, vendor review, impact assessment, design, validation, deployment, monitoring, incident response, and retirement. For each decision, identify the accountable business owner, advisers, independent reviewers, evidence required, escalation threshold, and final authority. Mark every point involving personal data or a data-subject right.
Warning signs include the DPO listed as project owner, privacy review after procurement, one combined checklist with no named decisions, no route for nonprivacy AI risks, conflicts between advisory and approval roles, and committees whose minutes record discussion but not authority. Also ask how the DPO receives information and resources without being placed under delivery pressure.
Use A Network Of Owners, Not One AI Officer
The business or product owner should remain accountable for purpose, value, and deployment. Privacy advises and monitors data-protection obligations; security owns technical security; legal interprets applicable law; risk or compliance coordinates enterprise controls; procurement manages vendor commitments; technical teams own validation; and affected operations own safe use. Smaller organizations may combine people, but should not erase the roles.
A central AI committee can resolve cross-functional issues, though it should not become a vague approval theater. For low-risk uses, a standard intake and self-service guidance may be sufficient. High-impact processing, sensitive data, automated decisions, or uncertain legal classification should trigger specialist review. The boundary must scale with consequence rather than requiring every experiment to enter the same queue.
Write The DPO Decision Boundary
Define four DPO modes: informed, consulted, formal adviser, and independent monitor. Link each mode to triggers such as personal-data use, new purpose, special-category data, profiling, automated decisions, large-scale monitoring, international transfer, data-subject impact, or a required impact assessment. State what evidence the project must provide and the response time expected.
Then define what the DPO does not own: product acceptance, model performance, general AI Act classification unless formally assigned with safeguards, cybersecurity implementation, and the business decision to deploy. Provide escalation when advice is not followed, preserve the DPO's documented view, and identify the executive who accepts residual risk. Revisit the boundary as laws and organizational roles evolve.
A Customer-Service Agent Example
Consider an illustrative customer-service agent that summarizes conversations, retrieves account data, and drafts responses. The business owner defines purpose and service levels. Security reviews access and logging. The DPO formally advises because personal data is processed, evaluates purpose and minimization, and checks whether monitoring or automated decisions affect rights. Legal reviews sector and consumer rules.
The DPO recommends excluding a sensitive field and shortening transcript retention. Product implements the changes, while an executive owner decides whether the remaining operational risk is acceptable. The DPO later monitors compliance using logs and sampling. The role is influential and independent without becoming responsible for the agent's response accuracy or overall customer experience.
Measure Whether The Boundary Improves Governance
Track AI projects routed to each DPO mode, reviews started before procurement, completeness of intake evidence, response time, advice accepted or declined, escalations, overdue mitigations, privacy incidents, data-subject complaints, and projects discovered outside intake. Also track DPO workload and training because an elegant boundary cannot work without capacity.
Review outcomes rather than celebrating review volume. A rise in consultation may reflect healthier discovery or uncontrolled demand. Sample projects to see whether the DPO received enough information and whether business owners made explicit decisions. Independence is visible when advice and exceptions remain documented even under schedule pressure.
Start With A One-Page Responsibility Map
Select three current AI use cases of different consequence and walk them through the governance chain. Write the decisions that actually arise, assign one accountable owner to each, and identify the personal-data triggers that change the DPO's role. Test the map with project managers and the DPO; ambiguous wording will surface immediately.
Provide focused AI and applicable-law training before expanding responsibilities. Publish intake examples, escalation paths, and expected evidence. Review the first ten cases after completion and adjust the boundary based on missed risks and unnecessary friction. The objective is not to reduce DPO involvement, but to make that involvement timely, independent, and useful.
Sources, Method, And Limits
This article relies on the CNIL summary of the 2025 DPO Observatory survey, published in English on September 22, 2026. CNIL reports the percentages used above and notes that the EU AI Act does not itself define a DPO role. The survey reflects respondents and should not be treated as a universal workforce census.
The decision-boundary model, cost example, and customer-service scenario are SynHy original analysis. Organizations must interpret the GDPR, EU AI Act, national implementation, employment rules, sector regulation, and professional-independence requirements with qualified counsel. Combining roles may create conflicts that require organizational safeguards or separate personnel.