GDPR AI Training Change Wins EU Council Backing, Parliament Next

Europe's two-track rewrite of its digital rulebook

For most of the past decade, the European Union's pitch to the world on technology policy was simple: write strict rules first and let industry adjust. In 2026 that pitch is being revised in two stages. The first stage is already law and covers the AI Act. The second, which is far more contested, covers the General Data Protection Regulation (GDPR). Read side by side, the two show a bloc that is easing deadlines and legal bases while trying to keep the outline of its rules intact. Whether that outline survives the second stage is now the main open question in European tech policy.

Both stages come from the Commission's "Digital Omnibus" package of 19 November 2025, which was pitched as a simplification of the GDPR, the cookie rules and the AI Act.11 The package was split into two legislative texts. The AI portion passed quickly. The data portion, tracked as COM(2025) 837, is still being negotiated.1114

The AI Act: deadlines moved, rules kept

The AI Act amendment, Regulation (EU) 2026/1744, came into force on 27 July 2026.1 That was six days before the original deadline for high-risk systems.9 Parliament and Council reached a provisional deal on 7 May, and the Council formally approved it on 29 June.1117

The main effect is delay. High-risk obligations for stand-alone systems listed in Annex III were due on 2 August 2026 and now apply from 2 December 2027. This covers AI used in hiring, credit scoring, education, biometrics and migration.79 High-risk AI built into regulated products under Annex I, such as machinery, toys and medical devices, moves from August 2027 to 2 August 2028.37 One analysis puts the Annex III change at 16 months.6 Deployer duties, including the fundamental rights impact assessment, sit in the same part of the Act and appear to move on the same schedule.9

Accounts of the change agree to an unusual degree on one point: this is a delay, not a repeal. The ban on prohibited practices, the general-purpose AI model obligations and the Article 50 transparency rules all kept their original dates. Article 50 has applied since 2 August 2026.25 Chatbots must therefore tell people they are AI, and deepfakes must be labelled now.58 One developer guide says the high-risk rules were pushed back because standards and national authorities were not ready, not because Brussels changed its mind.8 The new dates are fixed and do not depend on standards being finished.29

The amendment also added rules. Two new prohibitions apply from 2 December 2026: one covers AI systems that generate non-consensual intimate imagery, and the other covers systems that generate child sexual abuse material.16 On the same date, generative systems that were on the market before August 2026 lose their grace period for machine-readable content marking.310 Other changes ease the burden. Some documentation and registration requirements were lightened, relief for small businesses now also covers small mid-caps, and the AI literacy duty was softened.25 Commentators disagree on how to read the registration change. One analysis stresses that providers who claim an Annex III system is not high-risk must still register it, in simplified form. It says reports describing this as an exemption are wrong.9

Industry-leaning critics say the delay does not go far enough. A piece in The National Interest argues that the basic structure is unchanged. It says firms still have to decide on investment and market entry before the Commission publishes final specifications, and that startups bear those costs most heavily.4 That criticism fits the facts: the delay adds time but does not remove obligations.

The GDPR fight: AI training as a "legitimate interest"

The bigger privacy story is the second text. On 21 October 2026, member state ambassadors in Coreper agreed the Council's negotiating mandate on the data portion of the Omnibus.14 The central provision has been renumbered Article 88 bis. It says personal data may be processed for developing and operating an AI system or model on the basis of a controller's or third party's legitimate interest under GDPR Article 6(1)(f).1420

Coverage agrees on the basic facts but splits on what they mean. Some outlets stress what has not changed. Companies would still need to pick a proper legal basis, apply safeguards and respect the Article 21 right to object, and each case would still be assessed on its merits.12 Others describe the Council text as effectively presuming that firms building or training AI have an overriding legitimate interest.13 An earlier Irish presidency draft was defended in similar terms: it was said to clarify existing law, not to create a separate regime for AI.19

This article's reading is that the critics have found the change that matters, even if "automatic consent bypass" overstates it. The Commission's original version paired the legitimate-interest route with an unconditional right to object.11 The Council text drops that and refers only to the standard Article 21 mechanism.14 Under Article 21, a company can override an objection by showing compelling legitimate grounds.16 The Council kept the provision but removed the safeguard most likely to give individuals real control. Moving from an unconditional opt-out to one that can be overridden is a real loss of protection, whatever the official language about legal clarity.

The treatment of sensitive data is a partial exception. The Council narrowed the Commission's proposed derogation in Article 9(2)(k) so that it covers only residual special-category data that ends up in training sets unintentionally. It also requires that such data be erased once identified, or locked down where erasure is not feasible.14 The European Data Protection Supervisor had pushed for stricter limits, including a return to a "strict necessity" standard.19

Where the Council pulled back

The mandate is not a list of wins for industry. The Council deleted the Commission's most criticised change, a relative definition of personal data in Article 4(1), and kept the current definition.14 Reports differ on how much of that idea survives. One earlier account of the Council draft described it as adopting a relative definition.17 A closer reading of the mandate suggests the concept moved rather than disappeared. A new Article 25a says pseudonymised data are not personal data for a third party that cannot re-identify the person.14 Civil liberties groups say this is the real danger. They warn that firms could label pseudonymised data as anonymous and place it outside GDPR protection.18

On cookies, the Council kept the rules in the ePrivacy Directive instead of moving them into the GDPR. It removed the proposed requirement for browser consent signals and cut the waiting period before a site can ask again after a refusal from six months to four.14 It also supported raising the threshold and deadline for breach notifications to 96 hours, compared with 72 hours today.1417

The politics ahead

The reaction has been strong. Max Schrems of noyb called the Council position "digital expropriation."12 His organisation has previously filed eleven complaints against Meta over AI data scraping.16 One report also notes that the mandate goes against earlier warnings from European data protection authorities.16 The EDPB and EDPS had said in February that legitimate interest can sometimes support AI development, but they also called for proper safeguards.20 Reports in early October suggested that Council approval was likely while Parliament's political groups remained far apart, and that is what happened.11

None of this is law yet. Parliament has not adopted its position, and as of late October neither of its lead committees, ITRE and LIBE, had voted.14 One timeline expects Parliament's position in February 2027.11 No date has been confirmed for trilogue talks.16 There is also time pressure. The European Council called for all omnibus packages to be agreed by the end of 2026.17 A separate roadmap aims to finish the simplification work by the end of 2027.14

Why it matters

The two stages follow the same pattern. Brussels is keeping the structure of its rules while loosening the practical parts: deadlines, legal bases and objection rights. For AI providers that means more time on high-risk compliance and, possibly, a firmer legal footing for training on European data. For individuals, the important protections are the less visible ones: a right to object that cannot be overridden, and a definition of personal data that cannot be avoided through pseudonymisation.

Until the legislation is finalised, the current GDPR still applies in full. Companies cannot treat the Council's text as permission to train on personal data.20 Advisers are telling firms to document a legitimate-interest balancing test for AI training now. Such a test is needed under current law, following EDPB Opinion 28/2024, and would still be needed under any new provision.1415 Parliament will now decide how much of the Council's position becomes law.