Rules
Member states want AI processing to rest on legitimate interests and pseudonymisation to be regulated differently. What the text says and what to do now.
On 21 October 2026, the ambassadors of the member states agreed a joint position on the digital omnibus, a package that amends the GDPR among other laws. Its most striking element: processing personal data for developing and operating AI may expressly rest on legitimate interests. It is a negotiating position. The GDPR itself has not changed yet.
The official text is the Council mandate, document 14756/26, dated 22 October 2026. It is an English document of 170 pages showing the changes compared with the Commission proposal: additions in bold, deletions struck through. There is no consolidated version yet. The quotations in this article come from that English text, with the deletions left out.
The European Commission submitted the proposal on 19 November 2025, under the number COM(2025) 837. The aim was simplification: less administrative burden, fewer fragmented reporting obligations and more clarity about AI. In the Commission text, the AI provision was Article 88c. The Council shortened it and renumbered it as Article 88bis.
The mandate did not come about in one go. The presidency first tabled several compromise texts, and the package covers more than the GDPR: it also touches the cookie rules, the Data Act and incident reporting. What is on the table now is the version on which the representatives of the member states agreed.
A mandate is the position with which the Council enters negotiations. The European Parliament still has to determine its own position. Parliament, Council and Commission then negotiate the final text in what is known as the trilogue. Only once both institutions adopt that text and it appears in the Official Journal does anything change for organisations.
What the Council has written down can therefore still change, in either direction. Parliament has no position on the AI provision yet. Read this article as a description of a direction, not of the rules you follow today.
In the mandate, Article 88bis has three paragraphs. They are short, and the wording matters. With the deletions removed, it reads as follows:
For an AI system, the provision refers to the definition in the AI Act. That definition is broad: an AI assistant used by an organisation falls under it too, not only the training of a large language model.
Compare the text with the Commission's and what has gone becomes clear. The Commission wrote that the processing could rest on legitimate interests "except where other Union or national laws explicitly require consent" and "where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject", "in particular where the data subject is a child". The Council struck out both phrases.
The Commission's second paragraph has also been replaced. It contained concrete safeguards: data minimisation when selecting sources and during training, protection against disclosure of data retained in a model, enhanced transparency and an unconditional right to object. In their place came the general reference to measures and the ordinary right to object in Article 21. The two recitals in which the Commission explained how the balancing should work for AI have been deleted as well.
Readings differ sharply here. The privacy organisation noyb calls the mandate a digital expropriation and reads Article 88bis as a general permission to use personal data for AI, whatever the purpose. In that reading, AI becomes a label: whatever you put into an AI system automatically acquires a lawful basis. On LinkedIn and in the trade press, the article has accordingly been summarised as "consent is no longer needed".
The text itself is more cautious than that summary. The first paragraph refers to Article 6(1)(f), and that provision already contains the balancing: the processing is only lawful if the interests of the data subject do not override it. The second paragraph says expressly that you still have to choose the right lawful basis. Lawyers who support the proposal point out that this leaves little that is new. Critics point out that a provision with nothing new in it still means something in a law: it sends a signal to courts and supervisory authorities.
Yes. As long as the provision refers to Article 6(1)(f) of the GDPR, the three-step test applies: is there a legitimate interest, is the processing necessary for it, and do the interests of the data subject not override it? Article 88bis says that AI can serve a legitimate interest. It does not say that the balancing always comes out in your favour.
The European supervisory authorities already noted this with the Commission proposal. According to noyb's summary, the EDPB and the EDPS wrote in their joint opinion that the provision does not really clarify matters: an organisation still has to go through the three steps. That applies just as much to the shorter Council text.
Anyone who bases their processing on legitimate interests has to deal with Article 21. A data subject can object, and you then stop, unless you have compelling legitimate grounds that override their interests. The unconditional right to object the Commission wanted is gone. The ordinary right to object remains, and the third paragraph mentions it in so many words.
The phrase about other law requiring consent has been deleted. That does not make such rules invalid. Professional secrecy, a confidentiality obligation from sector legislation or a rule on health data continues to apply. Special categories of personal data also fall under the prohibition in Article 9, and Article 88bis changes nothing there.
The mandate adds a new Article 25a on pseudonymisation. For organisations working with pseudonymised data, this may well be the most important part. The Commission wanted to amend the definition of personal data in Article 4 itself. The Council left that definition as it is and deals with the issue in an article of its own.
The first paragraph describes pseudonymisation as a measure to reduce risks: the data can no longer be attributed to a person without additional information, and that information is shielded by technical and organisational measures. The second paragraph is the core. Pseudonymised data is not personal data for a third party who is unable to identify the person.
Two limits follow. If that third party passes the data on to someone who can reasonably identify the person, both the transmission and the subsequent processing are processing of personal data. And a processor processing data on behalf of a controller always processes personal data and remains bound by the GDPR. The EDPB is to issue an opinion on pseudonymisation and anonymisation.
For you as an organisation, nothing changes. You hold the link between pseudonym and person, so for you it remains personal data, with all the obligations that come with it. The difference between pseudonymising and anonymising therefore still stands. An AI provider or other service provider working for you as a processor also processes personal data under the fourth paragraph.
The new article mainly helps when sharing with a genuine third party who does not hold the key and cannot obtain it. The recital to the article cites the case law of the Court of Justice as the reason, and says the question is assessed case by case: who has access, who has control and what the relationship between the parties is. What counts as personal data therefore remains a question of context.
The mandate touches more articles than the AI article. The changes that matter to most organisations are listed below. "Now" is the current GDPR; "mandate" is the Council position.
| Topic | Now | Council mandate |
|---|---|---|
| Special categories of data in AI | Prohibited unless an exception in Article 9(2) applies | New exception only for residual data you did not intend to process; erase it as soon as you find it |
| Notifying a data breach | Within 72 hours, unless a risk is unlikely | Only for a high risk, within 96 hours, via a national entry point |
| List of processing requiring a DPIA | Per country, by the supervisory authority | One European list from the EDPB; national lists apply until it exists |
| Duty to inform | Always inform at collection | Exception if the data subject already knows and the risk is not high |
| Abuse of the right of access | Refuse manifestly unfounded or excessive requests | Also refuse where an abusive intention can be demonstrated |
The new exception in Article 9 is narrow. It only covers special categories of personal data present incidentally and as residue in the data used to develop or test an AI system, where you did not intend to process them and took measures to keep them out. If you find them, you erase them. If that is not possible, you shield them. According to the recital, the exception expressly does not cover data provided to the AI system during its use. Anyone deliberately putting a file with health data before an AI assistant therefore gains nothing from it. See special categories of personal data for what applies now.
The notification duty becomes lighter: you only notify the supervisory authority of a breach likely to result in a high risk, within 96 hours. The duty to record every breach internally remains. The EDPB draws up lists of situations with and without a high risk. Until the new rule applies, the current deadline stands; see what is a data breach. For the DPIA, there will be one European list and a common template. The assessment itself remains necessary; see a DPIA for AI tools.
Not yet. First the European Parliament determines its position, in the committees and then in the plenary. The trilogue follows. According to an analysis of the mandate by legal247, adoption can be expected in 2027 at the earliest, so the major changes will not be felt before 2028.
Under the mandate, the regulation enters into force on the third day after publication. Article 88bis and Article 25a then apply immediately. The new rules for notifying a data breach only apply 18 months later, and notifying via a national entry point only after 30 months. These too are dates from the Council position, and they may shift in the trilogue.
You follow the current GDPR. A Council position is not a lawful basis. What is sensible: organise your work so that it is correct under the current rules and does not have to be redone under the new ones.
Anyone acting on the mandate now risks following rules that never arrive. Anyone recording nothing will be empty-handed under both the old and the new text.
PrivaSearch does not choose a lawful basis for you. It makes documents searchable after personal data has been replaced by pseudonyms and a colleague has checked that. The AI assistant receives only approved, pseudonymised passages with a source reference, no original files. The steps are described on How PrivaSearch works.
Your environment produces a starting document for the lawful basis, with the three-step balancing test and the right to object. That structure follows the current GDPR, and Article 88bis removes none of those steps. What it contains is described on GDPR and EU AI Act. It is a starting document, not legal advice.
On pseudonymisation, the message does not change. For your organisation, pseudonymised data remains personal data, also under Article 25a, because you hold the link. Pseudonymisation is a measure that reduces risk and counts in the balancing. It is not a route out of the GDPR. Want to see what that looks like in practice? Book a demo.
No. Article 88bis is part of the negotiating mandate of the Council of the EU of 21 October 2026. The European Parliament still has to determine its position, after which Parliament, Council and Commission negotiate the final text. Until that text has been adopted and has entered into force, the current GDPR applies.
That is already allowed if another lawful basis fits, such as legitimate interests. Article 88bis confirms that legitimate interests can be used for AI, but refers to the existing test: the interest must be real, the processing necessary and the balancing must come out in the organisation's favour. A data subject keeps the right to object.
Article 88c is the provision from the European Commission proposal of November 2025. Article 88bis is the Council version. The Council deleted the list of concrete safeguards, the unconditional right to object and the phrase about laws requiring consent. In their place came a general reference to appropriate measures and the ordinary right to object.
Only for a third party who cannot identify the person. For the organisation that pseudonymises and holds the key, it remains personal data. According to the mandate, a processor working on behalf of that organisation always processes personal data as well. The rule mainly helps when sharing with parties that have no route at all to the key.
Under the mandate, 96 hours instead of 72, and only for a breach likely to result in a high risk. That change only takes effect 18 months after the regulation enters into force. Until then, you notify a breach to the Autoriteit Persoonsgegevens within 72 hours, unless the risk to the data subjects is unlikely.
Not because of the mandate. It is sensible to record the balancing test for your AI use and to arrange the right to object, but the current GDPR already requires that. Only adjust procedures for data breaches, DPIAs and the duty to inform once the final text has been adopted and it is clear when it applies.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →