Opinion on the proposed “Digital Omnibus on AI” Regulation

On January 20, the Joint Opinion 1/2026 of the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) was published on the European Commission’s proposal for a “Digital Omnibus on AI” Regulation, which aims to simplify the implementation of the Artificial Intelligence Regulation (Regulation (EU) 2024/1689). The Proposal seeks to address certain challenges in implementing the AI Regulation through targeted simplification measures.

Although the EDPB and the EDPS support the overall objective of addressing implementation challenges and reducing administrative burdens, they warn that the pursuit of this objective should not result in a reduction in the level of protection of fundamental rights, in particular the fundamental right to the protection of personal data.

In this context, the authorities highlight the following critical issues:

1. Implementation Timetable

Under the current Article 113 of the AI Regulation, the provisions relating to high-risk AI systems in Annex III will apply from August 2, 2026, and those relating to high-risk systems in Annex I from August 2, 2027.

The Proposal provides that the rules on high-risk AI systems will apply 6 or 12 months after the Commission’s decision confirming the availability of appropriate measures to support compliance with Chapter III, but no later than December 2, 2027 for high-risk systems in Annex III and August 2, 2028 for high-risk systems in Annex I. The Commission justifies the proposed postponement with implementation challenges, such as delays in the designation of competent national authorities and conformity assessment bodies, as well as the lack of harmonized standards, guidelines, and compliance tools. The Proposal also extends the temporal scope of the grandfathering clause in Article 111(2) of the AI Regulation, under which high-risk AI systems already placed on the EU market would be largely excluded from the scope of the Regulation unless they undergo significant changes in their design, changing the deadline from August 2, 2026, to December 2, 2027.

As for providers of AI systems, including general-purpose AI systems, that generate synthetic content and have been placed on the market before August 2, 2026, the Proposal maintains that they must take the necessary measures to comply with Article 50(2) by February 2, 2027.

The EDPB and EDPS acknowledge the grounds given for the postponement but express concern about the potential impact on the protection of fundamental rights in view of the rapid evolution and transformation of technology. Furthermore, they warn that the introduction of a variable deadline could undermine legal certainty. It is therefore recommended that the measure be reconsidered, in line with concerted action by the authorities to minimize the delay as much as possible.

2. Processing of special categories of data for the detection and correction of bias

The Commission’s proposal introduces a new Article 4a, with the aim of extending the material and subjective scope of the exception to the prohibition on the processing of special categories of data (currently provided for in Article 10 of the AI Regulation). In particular, providers and controllers of non-high-risk AI systems and models would benefit from the legal basis for processing special categories of data to the extent necessary for the detection and correction of bias, provided that they are subject to appropriate safeguards.

The EDPB and the EDPS support the proposed extension, but recall that the processing of special categories of personal data is, in principle, prohibited by Union data protection law, and therefore exceptions to this prohibition must be strictly limited. To avoid potential abuse, the cases in which providers and deployers can invoke this legal basis in the context of AI systems and models that are not high risk should be clearly circumscribed and limited to situations where the risk of adverse effects caused by bias is sufficiently serious.

The EDPB and the EDPS therefore recommend that the proposal be redrafted in order to reinstate the criterion of “strictly necessary” and to clarify the scope of the exception in a recital of the Proposal. In this context, a comprehensive revision of Article 4 is proposed, reinforcing legal certainty with regard to the application of Articles 6 and 9 of the GDPR.

3. Registration and documentation

The Commission proposes to remove the registration obligation for providers of AI systems which, although covered by the high-risk categories listed in Annex III to the Regulation, do not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons.

Conversely, the entities advocate maintaining the obligation to register AI systems in the EU database for high-risk systems, even in cases where the provider has concluded that the system is not high-risk, in accordance with Article 6(3) of the AI Regulation. The recommendation is based on the objectives of the registration obligation, which is to ensure the transparency and traceability of these systems to the public and the competent authorities.

The EDPB and EDPS also express concern about the approach of simplifying the obligations relating to the security of AI systems based on the size of the company, namely the number of employees, considering the characteristics of scalability and autonomy of AI.

4. Regulatory sandboxes

The Opinion welcomes the introduction of regulatory sandboxes at EU level to support innovation and SMEs across the EEA. The recommendations therefore focus on the need to ensure greater legal certainty. In particular, the intervention of national data protection authorities with regard to regulatory testing environments in the Union should be clarified, as is the case with national testing environments.

5. Supervision by the European AI Office

The Proposal provides that the AI Office shall have exclusive competence for the supervision and enforcement of rules on AI systems based on a general-purpose AI model, where the model and the system are developed by the same provider, as well as on AI systems that constitute or are integrated into very large online platforms or very large online search engines.

The EDPB and the EDPS warn that this provision may not be sufficient to ensure the ability of competent national authorities to act if the AI Office has not done so or does not intend to do so, given the exclusivity of the competence assigned to the AI Office. Therefore, in addition to the need to clearly define the types of AI models that trigger exclusive competence, close cooperation between the AI Office and national data protection authorities is recommended.

6. Cooperation with Fundamental Rights Authorities

The proposed cooperation between market surveillance authorities and fundamental rights authorities, in particular through the exchange of information, is welcomed by the EDPB/EDPS. The recommendations in the Opinion are therefore aimed at optimising coordination, including, for example, clarifying that the role of market surveillance authorities should be strictly that of an administrative contact point for the execution and transmission of requests for information or documentation to providers and those responsible for implementation, and that they should not assess the necessity or proportionality of the request; safeguarding the independence and existing powers of data protection authorities; clarification of the relationship between the new obligation of cooperation and mutual assistance and cross-border mutual assistance for market surveillance and product compliance; or specification that market surveillance authorities should provide the information requested by fundamental rights authorities without undue delay, both at national level and in cross-border cases.

7. AI literacy

The Commission proposes to remove the general obligation to ensure AI literacy for providers and those responsible for deploying AI systems, replacing it with an obligation for the European Commission and Member States to encourage operators to take the necessary measures.

The EDPB/EDPS believe that AI literacy plays a key role in understanding the ethical and social challenges, risks, and benefits associated with AI. In this sense, relegating this obligation to the Commission and Member States could undermine this overall objective.