Court of Rome Annuls the Garante's €15M OpenAI Fine
Christakis & Monga, European Law Blog, 2026-06-04 (DOI 10.21428/9885764c.281d569f), analysing Tribunale Ordinario di Roma, R.G. 4785/2025, decided 2026-03-18 — the corpus's first enforcement decision touching an AI system, and it is a jurisdictional reversal, not a verdict on the merits.
The case
Italy's Garante (data protection authority) issued Decision No. 755 on 2026-11-02 (2024), fining openai €15 million over GDPR violations in ChatGPT's data handling, plus a six-month Italian-media information campaign on how it trains models. OpenAI appealed. The Court of Rome annulled the entire decision on 2026-03-18 — but never reached the substance.
Why: the one-stop-shop mechanism
GDPR Article 56(1) gives the supervisory authority of a controller's main EU establishment exclusive lead-authority status over cross-border processing (the "one-stop-shop"). OpenAI Ireland Limited became the recognized single EEA establishment on 2024-02-15 — before the Garante's proceeding concluded. The court held this transferred competence to Ireland's Data Protection Commission automatically, so the Garante had no standing to issue a national fine at all, regardless of what OpenAI actually did.
The whole case turned on one word. Both sides read EDPB Opinion 8/2019 §16, which says the one-stop-shop "mainly" concerns continuing infringements. The Garante read "mainly" as a limit — transfer covers only ongoing violations, so it could keep jurisdiction over misconduct already finished before OpenAI Ireland existed. The court read "mainly" as describing frequency, not a carve-out, and transferred everything pending — including conduct that predated any EU establishment.
The governance finding: an enforcement gap
Christakis and Monga's argument is the reason this belongs in the spoke, not just a case note. A non-EEA AI provider can launch with no European establishment, draw a national DPA's investigation, then incorporate in a preferred member state (Ireland, in practice) and have the pending case redirected before any decision issues — even for conduct that happened entirely before the EU entity existed. The authors call this temporal immunity for pre-establishment conduct: the investigating authority loses the case, and the ruling never establishes that the new lead authority actually gains jurisdiction over the pre-establishment conduct either — an enforcement vacuum, not a clean handoff. They flag the incentive this creates directly: launch first, regularize later beats responsible entry, and DPAs may hesitate to invest in deep investigations that a later corporate restructuring can neutralize. The article notes DeepSeek's Article 27 EU representative does not trigger the same effect — representation isn't establishment — so this specific gap currently applies only to providers that eventually incorporate in the EU.
What this closes and what it doesn't
Answers the coverage edge directly: the regulation is GDPR itself (Art. 56 one-stop-shop, Art. 55 national competence, Art. 4(16) "establishment", Art. 33 breach notice — all pre-dating AI, applied to it), and the enforcement decision is this one — the first reasoned judicial ruling applying EDPB Opinion 8/2019 §4.3.2 to an AI provider's establishment timing. It does not answer whether GDPR's substantive rules (lawfulness, transparency, breach notification — the merits the Garante's original decision reached and the court never touched) actually bind an AI system's training or output; that question stays open, now behind a jurisdictional door nobody has opened yet.