The Council is negotiating an AI rule in the GDPR. Your balancing test is still needed.

This analysis first appeared as the weekly Praxikon newsletter.

<h2>The Council is negotiating AI in the GDPR</h2> <p>On 21 September, the privacy organisation noyb published a <a href="https://noyb.eu/en/ai-eu-member-states-plan-digital-expropriation-europeans-interest-ai-companies">leaked negotiating text</a> of the Council of the EU. It is document 12535/26 of 3 September: a revised compromise text from the Irish Presidency on the Digital Omnibus, the proposal that amends the GDPR among other laws. A new Article 88 bis governs the processing of personal data in the development and operation of AI.</p> <p>The core sits in the recitals. Such processing "may be regarded" as a legitimate interest of the controller, unless the interests or fundamental rights of the data subject prevail, in particular where the data subject is a child. Privacy organisations such as noyb and EDRi strongly oppose it: they read it as making AI a legitimate interest by default. There is no agreement within the Council either.</p> <h2>What does this mean for you?</h2> <p>First, what changes: nothing. This is a negotiating text, not law. The GDPR applies in full, the Council has not adopted a position and the European Parliament is still working on its own. If you use AI with personal data today, you cannot rely on this text.</p> <p>Second, the text itself is no free pass either. It states explicitly that you still choose an appropriate legal basis, that the balancing against the data subject's rights remains, and that appropriate safeguards are required whatever legal basis you use. Our reading: even if this provision is adopted, the work does not shift from balancing to doing nothing, but from explaining why it is allowed to demonstrating that the safeguards are in place. A documented balancing test therefore remains the core of your file.</p> <h2>Two omnibuses, do not mix them up</h2> <p>The <a href="https://eur-lex.europa.eu/eli/reg/2026/1744/oj">Digital Omnibus on AI</a> has been law since 27 July 2026. It moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), and gave the AI Act its own legal basis in Article 4a for using special categories of personal data to detect and correct bias. The broader Digital Omnibus on the GDPR, which this news is about, is still on the negotiating table. So read any report on "the Omnibus" with one question in mind: which one? Praxikon tracks the <a href="https://www.praxikon.com/en/avg/digital-omnibus">status of the GDPR file</a>.</p> <p>Also new: until <a href="https://digital-strategy.ec.europa.eu/en/news/commission-seeks-feedback-challenges-and-way-forward-area-effect-technology-copyright">3 November 2026</a>, the Commission is seeking input on topics including the use of copyright-protected content in AI. Relevant if you train AI models or hold rights yourself.</p> <h2>Action for this week</h2> <p>Take the AI applications that process personal data from your record of processing activities. For each one, note three things: which legal basis you rely on, whether there is a written balancing test if that basis is legitimate interest, and whether a DPIA was required and has actually been carried out. Wherever one of the three is missing, assign an owner and a date.</p> <p>Do you use AI features from a supplier, such as a summariser or a chat function? Then also ask whether the supplier uses your data to train its models. That processing is exactly what the negotiations are about, and the answer belongs in your balancing test.</p> <p>Would you like a DPIA or balancing test for an AI application drafted or reviewed? See <a href="https://embedai.nl/en/diensten/fria-dpia-ai-systemen?utm_source=praxikon&utm_medium=referral&utm_campaign=praxikon_weekly&utm_content=editie-2026-10-06">DPIA and FRIA support from Embed AI</a>.</p> <p>You receive this weekly AI Act update because you signed up with Praxikon or used one of our tools or templates. You can unsubscribe with one click at the bottom.</p> <p>Until next Tuesday.<br/>Zahed Ashkara<br/>Praxikon</p>