Case Library
AI go-global compliance cases: enforcement decisions and illustrations
Verified public enforcement and regulatory decisions with official sources, plus a few fictional illustrations, for benchmarking market-entry paths, data localization, AI governance and customer due-diligence preparation.
Verified public enforcement and regulatory decisions (20)
Subjects and figures checked against the regulator’s own publication; sources are linked.
TikTok fined EUR 530 million for failing to demonstrate essential equivalence under Chinese law
TikTok Technology Limited (Ireland)
TikTok relied on the EU Standard Contractual Clauses plus supplementary measures to let staff in China remotely access the personal data of EEA users. As lead supervisory authority the Irish DPC examined whether those transfers were lawful and whether users were adequately informed about them.
What it means for exporters →
Meta fined EUR 1.2 billion for continuing EU–US transfers after Schrems II
Meta Platforms Ireland Limited
After the CJEU’s Schrems II judgment, Meta continued to transfer EU/EEA users’ personal data to the US for the Facebook service, relying on the 2021 Standard Contractual Clauses together with supplementary measures it had implemented itself. The Irish DPC opened its inquiry in August 2020.
What it means for exporters →
DPC uses its urgent High Court power for the first time; X’s undertaking on Grok training data is made permanent and the proceedings are struck out
X (operator of the X social platform)
X used personal data contained in the public posts of EU/EEA users to train its AI tool Grok. The Irish DPC considered the processing gave rise to significant risk to individuals’ fundamental rights and freedoms, noting that X only put in place the enhanced mitigation measures it itself accepted were necessary months after the processing began, and did not roll them out to all users immediately.
What it means for exporters →
OpenAI fined EUR 15 million and ordered to run a six-month public information campaign (the decision was set aside by the Court of Rome at first instance)
OpenAI (provider of the ChatGPT service)
The Italian Garante investigated the processing of personal data in the ChatGPT service, covering the March 2023 data breach, the legal basis for training the model on user data, transparency towards users, and the protection of minors.
What it means for exporters →
DeepSeek hit with an urgent processing-limitation order after arguing EU law did not apply to it
Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence
The DeepSeek chatbot was downloaded by millions within days of launch. On 28 January 2025 the Italian Garante sent an information request to the two Chinese companies, flagging a possible risk to the data of millions of people in Italy.
What it means for exporters →
Luka Inc. fined EUR 5 million over Replika, with a separate inquiry opened into the model’s training lifecycle
Luka Inc. (US operator of the Replika chatbot)
Replika offers a written and voice interface letting users generate a virtual companion cast as a confidant, therapist, romantic partner or mentor. The Italian Garante had already ordered the application blocked in February 2023 and continued investigating the infringements as they stood on 2 February 2023.
What it means for exporters →
Character.AI fined EUR 158,000 for notice shortcomings and late DPIA and EU representative, with a 120-day reporting duty
Character Technologies Inc. (US operator of Character.AI)
Character.AI is a generative AI service that lets users, including minors, create and chat with virtual characters. The Italian Garante opened an own-initiative investigation.
What it means for exporters →
Clearview AI fined EUR 30.5 million by the Dutch DPA, with up to EUR 5.1 million in non-compliance penalties
Clearview AI (US facial recognition provider with no establishment in the EU)
Clearview sells facial recognition services to intelligence and investigative agencies: customers submit camera images to identify the people in them. To do this Clearview automatically scrapes photos from the internet into a database of more than 30 billion images and converts each face into a unique biometric code, without the knowledge or consent of the people concerned.
What it means for exporters →
Korean PIPC’s corrective recommendations to DeepSeek: no separate consent for transfers, user input sent to Volcano, no domestic agent
Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
DeepSeek launched its R1 LLM chatbot in Korea on 15 January 2025 with a privacy policy available only in Chinese and English. The PIPC sent an inquiry on 31 January 2025 and ran a technical analysis with the Korea Internet & Security Agency (KISA), which found third-party data transfer traffic and insufficient transparency in the privacy policy.
What it means for exporters →
Temu fined KRW 1.369 billion by the Korean PIPC for unlawful cross-border transfers and RRN processing, plus KRW 17.6 million for undisclosed offshore processing and no domestic agent
Whaleco Technology Limited and Elementary Innovation Pte. Ltd. (operators of the Temu platform)
The PIPC has been investigating overseas direct purchase services since 2024. Temu is an online marketplace connecting sellers and buyers; user data is managed by Whaleco Technology Limited and seller data by Elementary Innovation Pte. Ltd., so the PIPC sanctioned both entities.
What it means for exporters →
Japan’s PPC issues an Art. 147 APPI caution to OpenAI: keep special care-required data out of training corpora and publish the purpose of use in Japanese
OpenAI, L.L.C. and OpenAI OpCo, LLC
As generative AI services spread in Japan, the Personal Information Protection Commission published an alert on their use on 2 June 2023, and at the same time published the summary of a caution it had issued on 1 June 2023 under Art. 147 APPI to OpenAI, L.L.C. and OpenAI OpCo, LLC, the developer and provider of ChatGPT.
What it means for exporters →
Didi fined RMB 8.026 billion by the CAC over 16 findings, with RMB 1 million each on its chairman and president
Didi Global Inc.
In July 2021, to guard against national data security risk, safeguard national security and protect the public interest, the Cybersecurity Review Office opened a cybersecurity review of Didi under the National Security Law, the Cybersecurity Law and the Measures for Cybersecurity Review. Based on the review conclusions and the problems and leads it uncovered, the Cyberspace Administration of China opened a case investigation into the suspected violations.
What it means for exporters →
Phase two of the CAC “Qinglang” AI campaign: 5.61 million items of unlawful content removed and 2,400-plus apps handled
The CAC “Qinglang: Rectifying Misuse of AI Applications” campaign
The CAC ran phase two of its campaign against misuse of AI applications, focused on using AI to produce and publish false information, spread violent or vulgar content, impersonate others and harm the rights of minors. It directed provincial cyberspace authorities to push key rectification tasks and required platforms to clear AI-generated unlawful and harmful content and to deal with offending accounts and mobile applications.
What it means for exporters →
Rite Aid banned from facial recognition for five years and ordered to delete the algorithms built from the data
Rite Aid Corporation (US pharmacy chain)
In a complaint filed in federal court, the FTC alleged that from 2012 to 2020 Rite Aid deployed AI-based facial recognition in hundreds of stores to identify customers who might be shoplifting or behaving problematically, without reasonable measures to prevent consumer harm. The company worked with two vendors to build a database of "persons of interest", collecting tens of thousands of images, many of them low quality and sourced from store security cameras, employee phone cameras and even news stories.
What it means for exporters →
FTC’s Operation AI Comply brings five cases at once: unsubstantiated AI claims are law violations
DoNotPay, Inc.; Rytr LLC; Ascend Ecom and its operators; Ecommerce Empire Builders and its CEO; FBA Machine/Passive Scaling and its operator
The FTC launched a law-enforcement sweep called Operation AI Comply against operations that use AI hype to supercharge deceptive or unfair conduct, or that sell AI technology usable in deceptive and unfair ways, announcing five cases at once.
What it means for exporters →
Evolv pursued by the FTC over exaggerated AI screening claims; school customers allowed out of multi-year contracts
Evolv Technologies (Massachusetts-based AI security screening vendor)
Evolv Express is an AI-powered security scanner used in thousands of schools as well as venues such as stadiums and hospitals; schools make up half of its business, with Express scanners in over 800 schools across 40 states. Its marketing emphasised AI and positioned the product as a high-tech alternative to traditional metal detectors.
What it means for exporters →
American Honda fined USD 632,500 by the CPPA over how it designed its privacy rights flows
American Honda Motor Co.
The case arose from the CPPA Enforcement Division’s ongoing review of the data-privacy practices of connected vehicle manufacturers and related technologies.
What it means for exporters →
Cadence fined USD 95 million by BIS after its Chinese subsidiary’s staff transferred EDA technology to Entity List parties
Cadence Design Systems Inc.
The U.S. Bureau of Industry and Security investigated Cadence over illegal exports of electronic design automation (EDA) hardware and software and semiconductor design technology to parties on the Entity List, including the National University of Defense Technology (NUDT) and Tianjin Phytium Information Technology (Phytium).
What it means for exporters →
Bosch fined USD 36 million for shipping FDP-covered foreign-produced items to Huawei, with credit for its voluntary self-disclosure
Robert Bosch GmbH (Stuttgart, Germany)
The U.S. Bureau of Industry and Security investigated shipments by Bosch of foreign-produced items to Huawei Technologies Co. and its affiliates. The items were micro-electro-mechanical systems (MEMS) sensor products and automotive software with broad consumer applications in smartphones, wearables and automobiles.
What it means for exporters →
Keurig fined USD 1.5 million by the SEC for omitting key facts behind its recyclability statements
Keurig Dr Pepper Inc.
In its annual reports for fiscal years 2019 and 2020, Keurig stated that testing with recycling facilities "validate[d] that [K-Cup pods] can be effectively recycled". In fiscal year 2019, K-Cup pod sales made up a significant percentage of net sales in its coffee systems segment, and earlier research by a Keurig subsidiary indicated that environmental concerns were a significant factor for certain consumers deciding whether to buy a Keurig brewing system.
What it means for exporters →
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.
Illustrative cases (fictional, for demonstration)
Note: the companies in this section are fictional and the metrics are illustrative; nothing here is a statement of fact about any real company.
Sample Enterprise A (demo)
How to establish AI smart city solutions in the Middle East while meeting local data sovereignty and privacy regulations
Sample Enterprise B (demo)
How to use AI to address language barriers and educational equity in resource-scarce African markets
Sample Enterprise C (demo)
How to adapt autonomous driving to strict local traffic laws, driving conventions and aging-society mobility needs
Sample Enterprise D (demo)
Building trusted AI cloud services under Europe's strictest data protection (GDPR) and ESG regulatory environment
Sample Enterprise E (demo)
How to operate warehouse logistics AI business compliantly under the EU AI Act while maintaining commercial competitiveness
Sample Enterprise F (demo)
Providing inclusive financial services for underbanked populations while addressing biometric data ethics and regulatory requirements
Sample Enterprise G (demo)
How to enter European automotive OEM supply chains while meeting functional safety and EU emission regulations
Sample Enterprise H (demo)
How to establish differentiated advantages in the global LLM market while meeting multi-jurisdictional AI safety compliance