EU member states agreed their negotiating position on the Digital Omnibus on 21 October 2026. The package, first proposed by the European Commission in November 2025, amends the GDPR, the ePrivacy Directive, the Data Act and NIS2. The AI Act changes were split off and adopted separately earlier in the year.
What the Council changed for AI
The Commission had proposed writing into the GDPR that legitimate interest can be the legal basis for processing personal data to train AI models. The Council has removed that amendment. Instead, a new recital says that developing or operating an AI system or model is not in itself a legitimate interest, and that each case must be assessed on its own purpose.
The Council also narrowed the proposed permission to process special category data, such as health or ethnicity data, in AI development. It would apply only to incidental, residual data that is technically impossible, or disproportionately difficult, to remove. A separate exemption for biometric verification is limited to one-to-one comparisons, not searches against a database.
Other changes
The Council's text also:
- reinstates the right not to be subject to solely automated decisions, with exceptions and added safeguards;
- keeps the plan to report only high-risk personal data breaches, but swaps the single EU reporting portal for national entry points;
- moves the cookie consent exemptions into the ePrivacy Directive and cuts the gap before re-asking for consent from six months to four; and
- strengthens trade secret protection under the Data Act.
Next steps
The European Parliament has yet to adopt its own position. Addleshaw Goddard says negotiations between the two institutions are not expected to start before March 2027.
Why it matters financially
For AI developers training on European data, the Council's text keeps legal uncertainty, and so compliance and litigation costs, higher than the Commission had promised. GDPR fines can reach 4% of global annual turnover, so whether training can rest on legitimate interest is a commercial question for every model builder operating in the EU. No final outcome is expected until well into 2027.