Executive Vice-President Henna Virkkunen, in a written answer on 27 July 2026, declined to take a position on the Spanish Tax Agency's reported acquisition of Cellebrite Pathfinder Enterprise, a forensic AI tool used to process data from taxpayers' electronic devices. Virkkunen stated that the European Commission does not actively monitor the tools deployed by national tax administrations and that there is currently no obligation under the AI Act to notify the Commission of the use of AI systems.
The answer was given to a parliamentary question from MEP Alvise Pérez (NI), who had raised concerns about risks to privacy, proportionality, the presumption of innocence, and data protection from the use of such tools. Virkkunen noted that from December 2027, the AI Act will require providers and public authorities to register high-risk AI systems in an EU database before deployment. However, classification of a system as high-risk remains the responsibility of the provider, and oversight will fall to Spanish market surveillance authorities. Natural and legal persons may lodge complaints under Article 85 of the AI Act.
On data protection, Virkkunen pointed to existing EU law — the General Data Protection Regulation and the Law Enforcement Directive — which set principles for processing personal data regardless of technology. Enforcement, she stressed, lies with national data protection authorities and courts, not the Commission. The answer contained no concrete proposals, targets, or deadlines beyond the already legislated AI Act timeline. It effectively deferred all substantive assessment to Spanish authorities, signalling that the Commission sees its role as limited to framework-setting rather than direct oversight of national tax enforcement tools.