The Context
Ireland’s Data Protection Commission launched a formal “large-scale inquiry” on 17 February 2026. The target is X, the social media platform. The trigger was its AI tool, Grok, generating non-consensual sexualised images of real people, including children. The platform failed to implement basic safeguards. It only reacted after media exposure and global backlash, restricting the feature to paying subscribers in January 2026. This is not a historical case study. It is an active investigation phase in Europe, with Spain initiating a parallel criminal probe. No fines have been levied yet. The storm is still building.
The Risk
This is a crisis of trust, not just compliance. For a director, the personal liability is twofold. First, the financial hammer: GDPR fines can reach 4% of global revenue. That’s a board-level catastrophe. But the second, more insidious risk is reputational. The ‘Court of Public Opinion’ delivers a verdict long before any regulator. The psychosocial damage to victims—especially minors—is profound and permanent. It erodes user trust instantly. In a New Zealand context, while GDPR is the immediate hook, a similar failure here could trigger scrutiny under the Privacy Act 2020 for interference with privacy. More critically, directors may be personally liable if such a systemic governance failure is seen as a breach of their duty of care under the Companies Act 1993. Your brand isn’t just tarnished; it becomes synonymous with harm.
The Control
Governance must be proactive, not reactive. The strategic solution is to embed ethical and safety-by-design principles at the core of any AI or high-risk product launch. This means conducting rigorous pre-emptive impact assessments that go beyond data privacy to evaluate psychosocial and reputational harm. It requires clear, auditable controls—technical guardrails that are tested for circumvention—and a crisis response plan that assumes failure will be public. Your duty is to ask the uncomfortable questions before the product goes live, not after the headlines break.
The Challenge
These are the critical questions you should be raising at the board table:
| For our highest-risk digital products, what specific, tested technical and human controls are in place to prevent them from being weaponised to cause personal harm, and who at the executive level personally attests to their effectiveness? | |
| Does our crisis playbook for a catastrophic product failure prioritise the humane support of victims and transparent public communication, or is it solely focused on legal containment and share price protection? | |
| What leading indicators—like user complaint trends or dark web chatter—are we monitoring to give us an early warning that our platform is being abused, and what is the clear escalation path to the board when those alarms sound? |