Observed Signal · Sep 21, 2026 · Policy Update · Source: Trending Topics (DACH/CEE Innovation & Tech) · Impact: 5/5 · Sentiment: Negative
EU Council Proposes GDPR Loosening for AI Training
The European Commission's Digital Omnibus proposal has entered a decisive phase in the Council of the EU, with leaked documents revealing proposals to legitimize the use of personal data for AI training. The Irish Presidency compromise text introduces Article 88 bis, allowing processing for 'legitimate interests' under GDPR, while German drafting suggestions go further, proposing a statutory presumption of legitimate interest for AI training, compatibility of data reuse, and exemptions from core data subject rights. Privacy organization noyb criticizes the proposals as a 'digital expropriation' of Europeans, while the Commission frames them as simplification. The Digital Omnibus must be adopted by both the Council and Parliament, with early 2027 seen as the earliest conclusion. The proposal faces potential judicial review by the CJEU.
The EU Digital Omnibus proposal could fundamentally alter GDPR for AI training, impacting all AdTech and MarTech companies operating in Europe by allowing broader use of personal data, with major implications for privacy and consent-based advertising.
Track Bitkom Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- The European Commission's Digital Omnibus proposal includes Article 88 bis, which allows personal data processing for AI development under 'legitimate interest' under GDPR.
- German drafting suggestions propose a statutory presumption that AI training is a legitimate interest and that data reuse for AI is compatible with original purposes.
- The German proposal would exempt controllers from Articles 14, 16, 17, and 18 GDPR (information duty, rectification, erasure, restriction) under certain conditions.
- noyb founder Max Schrems calls the proposal a 'digital expropriation' of Europeans, arguing it prioritizes AI companies' interests over fundamental data protection rights.
- The European Data Protection Board and European Data Protection Supervisor raised concerns about reduced protection levels in a joint opinion.
- The Digital Omnibus must be adopted by both the Council and the European Parliament, with early 2027 as the earliest realistic date.
- The compromise text also proposes redefining personal data so that it is not personal for every entity, and allowing refusal of data subject requests in cases of 'abuse'.
Connected Companies & Entities
“Bitkom, the German digital industry association, calls for 'targeted and proportionate adjustments'.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
EU Council Debates Personal Data Use for AI Training
The EU Commission's 'Digital Omnibus' is in its decisive phase in the Council of the EU, with negotiations touching the GDPR core. The Austrian privacy organization noyb has published two confidential Council documents: the Irish Presidency's compromise text and German drafting suggestions. The new article 88b allows processing of personal data for AI training based on legitimate interest, with Germany proposing a legal presumption of legitimacy. Germany also proposes exemptions from key data subject rights (information, correction, deletion, restriction) under certain conditions. Critics warn of 'digital expropriation' of Europeans, while the Commission argues for simplification and competitiveness. The final adoption is expected no earlier than early 2027, and the European Court of Justice may ultimately decide on the issue.
EU begins enforcing AI Act, tightens transparency rules
The European Commission will begin enforcing the EU AI Act on 2 August 2026 and has introduced stricter transparency requirements for AI use. Users must be able to recognize interactions with AI and identify AI‑generated or altered content (including clearly labeled deepfakes). Providers of general-purpose and high-capability AI models face additional obligations: risk assessments, security measures, documentation of training data and model architectures, and publication of summaries and copyright policies. Certain manipulative or harmful AI uses will be banned. Enforcement will be coordinated by a newly created EU Office for Artificial Intelligence together with national authorities (e.g., Bundesnetzagentur) and the European Data Protection Supervisor, supported by a scientific expert group and new reporting mechanisms. The law will be rolled out further through 2028 with additional high-risk rules phased in.
AI Omnibus Keeps Recruiting AI High-Risk
The EU's AI Omnibus, agreed by EU institutions in May 2026, amends the 2024 AI Act but provides only limited relief for companies. The package delays key compliance deadlines for high‑risk AI: obligations for standalone HR-related systems move from 2 Aug 2026 to 2 Dec 2027, and for product‑embedded AI from 2 Aug 2027 to 2 Aug 2028. Watermarking requirements for systems on the market before 2 Aug 2026 are deferred to 2 Dec 2026, while other obligations remain. The Omnibus also introduces bans and stricter duties for systems used to create sexualized or child‑abuse material (“nudifier” apps) and requires enhanced misuse‑prevention for generative image/video/audio models, effective 2 Dec 2026. It narrows some privacy barriers by allowing limited use of special-category data for bias correction under strict conditions and shifts certain compliance burdens for machinery vendors toward existing product regulations. Overall, the Omnibus grants more time but leaves core high‑risk definitions and compliance complexity largely intact.
Receive all future signals for Bitkom & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.