EU AI Act Delay Takes Hold as GDPR AI-Training Fight Intensifies

Two parts of one package, now moving at different speeds

Europe's effort to simplify its digital rulebook has split in two. The part dealing with the AI Act is now law and gives companies more time to meet the regulation's hardest requirements. The part rewriting the GDPR is still open, and the arguments over it are getting more heated. Compliance teams that treat these as one story could misread what they owe regulators. That includes when they owe it and under which law.

The European Commission proposed both measures on November 19, 2025. One was the Digital Omnibus, COM(2025) 837, which amends data law. The other was the Digital Omnibus on AI, COM(2025) 836.22 The AI measure moved quickly because the AI Act's application dates were close. Negotiators reached a trilogue deal on May 7, 2026, and Parliament approved it on June 16.21 The data measure, which carries the GDPR changes, is still under negotiation.21 As of mid-October, it is waiting for both a Council mandate and a vote in Parliament's committees before trilogue talks can begin.22

What the AI Omnibus actually changed

The AI amendment became Regulation (EU) 2026/1744. It was published in the Official Journal on July 24, 2026 and took effect on July 27.4 Its main change is a delay. Obligations for stand-alone high-risk systems listed in Annex III were due on August 2, 2026 and now apply from December 2, 2027, sixteen months later.2 Annex III covers areas such as hiring, credit scoring, education, law enforcement and border control. AI built into products already covered by EU safety law, listed in Annex I, now has until August 2, 2028, a year beyond the original date.2

The reporting agrees on why. The harmonised technical standards and guidance needed to show compliance were not ready, and neither were the national authorities.69 The Commission had originally designed a conditional mechanism. High-risk duties would start once the supporting tools existed, with the December 2027 and August 2028 dates as fallbacks.2 Legal commentators broadly call the result a deferral rather than a dismantling. Gibson Dunn's summary is that the law's structure and core duties remain intact.7

The delay is narrow, and much of the AI Act is untouched:

• Prohibited practices under Article 5 have applied since February 2025 and still do.10
• Obligations for general-purpose AI models have applied since August 2025. The Commission gained fining powers over them on August 2, 2026.2
• Article 50 transparency rules still apply from August 2026. These include telling people they are dealing with a chatbot and labelling deepfakes.57
• Maximum fines are unchanged: up to €35 million or 7% of global turnover for prohibited practices, and up to €15 million or 3% for most other breaches.2

The new law also takes some things away and adds others. The AI literacy duty in Article 4 survives but is weaker: companies must now "support" literacy rather than "ensure" it. National AI regulatory sandboxes have slipped a year, to August 2027.2 The law also creates new obligations.

The December 2026 deadline

The most immediate pressure point is December 2, 2026, not 2027. Generative AI systems already on the market before August 2, 2026 get until that date to add machine-readable markers to their outputs, such as watermarks or metadata. Systems launched after August 2 had to comply from day one.2 The same date brings two new Article 5 bans. One covers AI systems that generate child sexual abuse material. The other covers systems that create non-consensual intimate depictions of identifiable people, the so-called nudifier apps.2 According to Orrick's reading, the ban covers systems designed for those outputs and also systems where such outputs are reasonably foreseeable and safeguards are inadequate.2 That wording reaches general-purpose image tools as well as purpose-built apps, which makes it harder to claim the ban doesn't apply.

Some widely shared guidance is out of date. An analysis from earlier in 2026, written while the measure was still a proposal, put the marking grace period at February 2, 2027.1 The final text uses December 2, 2026.26 Other compliance guides still describe the high-risk delay as pending,8 or say the AI Act reached "full enforcement" in August 2026.18 Teams relying on material from before the summer should check their dates against the adopted regulation.

The extra time comes with a catch. High-risk systems placed on the market before the new dates fall under the rules only if they are substantially modified later. The delay therefore gives companies up to sixteen more months to ship under the lighter regime.2 Whether regulators will tolerate firms rushing products out before December 2027 has not yet been tested.

Why critics say the delay still costs

The criticism comes from two directions. Civil-society and digital-rights groups say that delaying high-risk duties by more than a year leaves people facing consequential automated decisions without the impact assessments, human oversight and transparency the Act was meant to guarantee.6 The EDPB and EDPS, the EU's data protection bodies, also raised concerns about the delay.8

From the industry side, a commentary in The National Interest argues that the Omnibus leaves the regulatory structure intact. Companies, it says, still have to make investment and market-entry decisions before the Commission's final specifications exist, and startups bear the heaviest burden.3 Both critiques reach the same conclusion from opposite sides: the delay changes the timetable but not the substance. That matches the view of law firms and compliance advisers, who say the extra months should be used to build documentation, risk-management and human-oversight systems, not to stop work.210

The GDPR fight over AI training data

The more consequential privacy story is in the data Omnibus. The Commission proposed a new Article 88c stating that developing and running AI systems can rely on "legitimate interest" under Article 6(1)(f) of the GDPR, meaning companies would not need consent.22 Its original version came with four safeguards, including an unconditional right to object.27

On September 21, the privacy group noyb published leaked Council documents. The main one was Presidency compromise text 12535/26, dated September 3.21 In that draft the clause is renumbered Article 88 bis and the Commission's specific safeguards are removed, including the unconditional right to object.27 Max Schrems, noyb's founder, called it "a digital expropriation of Europeans."22 A German submission from August went further. It proposed that AI training be presumed to be a legitimate interest,27 and that reusing data collected for other purposes be presumed compatible with the original purpose.30

The sharpest disagreement in the coverage is over how to read this. noyb says the text effectively makes AI data use lawful by default.29 More cautious analyses point out that the draft says such processing "may be regarded as" a legitimate interest and keeps the override where a person's rights prevail. That is the structure of the existing balancing test.21 A later Council mandate adds a recital stating that developing an AI system "does not in itself constitute a legitimate interest," and that each case must be assessed on its own facts. That mandate also refers back to the general right to object under Article 21.25

Our view is that the cautious reading is legally correct about the text as it stands, and noyb is right about the direction. In the Council drafts, the balancing test survives on paper while the safeguards that would have made it workable are disappearing. The German presumption would reverse who has to prove what. Under it, the person whose data is used would have to show why the processing should not go ahead.27 If that version prevails, it would be the real change.

The definition of personal data is the second flashpoint, and it may matter more over time. The Council keeps the Commission's "relative" definition: information is not personal data for an entity that cannot reasonably identify the person behind it.25 Supporters say this simply writes the Court of Justice's 2025 EDPS v SRB ruling into law.22 Data protection authorities disagree. They have urged lawmakers to reject the change, saying it goes beyond a technical fix and does not accurately reflect the case law.21 One commentary on the Council talks says this point commands relatively broad agreement there,23 which suggests it is more likely to survive than the AI clause.

The Council text also raises the breach-notification threshold, extends the notification deadline to 96 hours,25 and moves cookie consent rules back into the ePrivacy Directive with new exemptions.26

What compliance teams should take from this

Parliament is pulling in a different direction from the Council. The rapporteurs on the data file are Aura Salla and Marina Kaljurand. Their draft report drew more than 1,750 amendments, and Kaljurand has said she will try to keep the definition of personal data intact.27 EU leaders have asked for all pending omnibus packages to be agreed by the end of 2026,25 but trilogue talks have not yet started.27

For now, the GDPR applies unchanged. Relying on legitimate interest to train AI still requires a documented balancing test.21 Companies are therefore dealing with two timelines. AI Act duties are fixed, with the next deadline in seven weeks. The GDPR rules governing the data those systems run on are still being negotiated, and companies should not plan around a more permissive version until it is adopted.