The EU Council has agreed its negotiating mandate on the Digital Omnibus, including a draft GDPR article on personal data for AI development and operation

Key takeaways

• The document is a Council mandate for negotiations with the European Parliament, agreed by the Permanent Representatives Committee on 21 October 2026. It is not an adopted regulation.
• Draft Article 88bis would say processing in the context of AI development and operation "may be carried out for a legitimate interest" under Article 6(1)(f).
• Recital 33a says the applicability of Article 6(1)(f) to AI "is to be assessed on a case-by-case basis".
• The same text adds a new Article 9(2)(k) on incidental processing of residual special-category data in AI development.

What did the Council agree, and is it law?

It is not law. Council document 14756/26 is headed "Outcome of proceedings" and is dated Brussels, 22 October 2026. It says delegations will find in the Annex the text of the mandate for negotiations with the European Parliament, as agreed by the Permanent Representatives Committee at its meeting on 21 October 2026. The file is Interinstitutional File 2025/0360 (COD), the Digital Omnibus proposal that amends several instruments, including Regulation (EU) 2016/679 and Regulation (EU) 2024/1689. The document says changes compared to the Commission proposal are marked in bold and deletions in strikethrough. A mandate sets the Council's side of the negotiation. It binds nobody, and the wording can change before any final regulation.

What would Article 88bis say?

The annex inserts Article 88bis into the GDPR, titled "Processing in the context of the development and operation of AI". Read as marked, paragraph 1 would provide that processing of personal data in the context of the development and operation of an AI system or of an AI model "may be carried out for a legitimate interest of the controller or a third party in accordance with" Article 6(1)(f). Paragraph 2 would provide that paragraph 1 does not affect the controller's obligation to choose an appropriate lawful ground of processing under Article 6. Paragraph 3 would provide that, whatever the lawful ground, such processing is subject to appropriate technical and organisational measures and safeguards to protect data subjects' rights and freedoms, "including the right to object under Article 21".

Recital 33a would add the limits. It says the development and operation of an AI system or model "does not in itself constitute a legitimate interest" and that Article 6(1)(f) is assessed case by case, taking into account the underlying purpose of the processing. It keeps the reservation for interests overridden by the data subject's rights, in particular where the data subject is a child, and for laws that explicitly require consent. It recalls that Article 6(1)(e) may serve a public authority developing or operating an AI system for a public-interest task. It names data minimisation at the stage of selecting sources as an example of a safeguard.

How does the Council wording differ from the Commission text?

The redline shows the Commission's article numbered 88c, now 88bis. In the Council draft the article body would drop the Commission's wording on legitimate interests being overridden by the data subject's interests, "in particular where the data subject is a child", and on other laws that explicitly require consent. Those two points would now sit in recital 33a. The Commission's paragraph 2 listed safeguards in the article itself, including data minimisation, protection against disclosure of residually retained data, enhanced transparency and "an unconditional right to object". The Council draft would replace it with a shorter paragraph 2 on the lawful ground and a general paragraph 3 that would refer to the right to object under Article 21. We read the struck text only from the marked document, so we describe the Commission wording as it appears there.

The same annex would also add a point (k) to GDPR Article 9(2) for incidental processing of residual data, where not intended by the controller, in the development and technical operation of an AI system or model. In this draft, a new paragraph on that point would require measures to avoid collecting special categories of data and, where such data are found, erasure without undue delay or, where that is technically impossible or needs manifestly disproportionate effort, effective protection from further processing.

What happens next, and when would any of it apply?

The document describes the next step only as the negotiations with the European Parliament. It gives no timetable for the negotiations. The timing rule sits in draft Article 11 (pages 169 and 170). It would bring the Regulation into force on the third day following its publication in the Official Journal. As marked, it then lists later application dates: 18 months from entry into force for Article 3(8), points (a) to (c), Articles 6(2) and (3) and Articles 7 to 9; and 30 months from entry into force for the obligations to report via the national entry point, which the text lists by instrument. The marked text strikes out the earlier six-month application date for Article 5(2) and the earlier 24-month period for those reporting obligations. Article 88bis is inserted by Article 3 of the draft and is not among the provisions Article 11 names, so on our reading, and the document does not say this in terms, it would follow the general rule. The calendar date is unknown because it depends on a final text and its publication, which do not yet exist. Check the final wording, because this is a negotiating text.

What should AI developers, DPOs and counsel do now?

Treat this as a signal about direction, and keep working from the GDPR as it stands. If the text survives, then where relying on Article 6(1)(f), a legitimate-interest assessment for training or operating a model would still be needed, and the recital says it is case by case.

• Map which AI systems and models in use were trained or operate on personal data, and record the lawful ground you rely on today.
• Check that a documented balancing test exists for any use of Article 6(1)(f), including how data subjects can object.
• Note where special-category data could appear incidentally in training sets, and how you would find and erase it.
• Follow the negotiations with the Parliament and re-read the final text before changing any policy.

What we did not verify

What we opened: the full Council document 14756/26 from the Council document register, including the Article 88bis text and recital 33a, which we read on the rendered pages because the redline markings do not survive text extraction, on 24 and 25 October 2026, re-checking Article 11 on the rendered pages 169 and 170 on 25 October 2026.

What we did not open: the Council press release, which blocked automated access, the Commission proposal itself, the other parts of the Digital Omnibus beyond the passages cited, and any press or NGO reporting on the vote or the Parliament's timetable. The application dates are stated as marked in this negotiating text and may differ in the final text.

What we refuse to claim: that Article 88bis is agreed law, that it permits training on any personal data, or when it would apply.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Attorneys and AI regulation
• EDPB guidelines on web scraping for generative AI
• CNIL position on AI models and personal data
• Irish DPC report on AI products and legitimate interests
• Digital Omnibus and deferred AI Act deadlines