EU member states’ ambassadors (Coreper) agreed the Council’s mandate for negotiations with the European Parliament on the Digital Omnibus proposal (interinstitutional file 2025/0360(COD)) at their meeting on 21 October 2026. The text was circulated on 22 October as Council document ST 14756/26. The proposal amends the GDPR, the ePrivacy Directive, the NIS2 Directive, the AI Act and other digital laws.

The AI and personal-data clause

The Council text adds a new Article 88bis to the GDPR, headed “Processing in the context of the development and operation of AI”. In the Council version:

  • Processing of personal data in developing and operating an AI system (as defined in the AI Act) or an AI model may be carried out for a legitimate interest of the controller or a third party under GDPR Article 6(1)(f), “where appropriate”.
  • That does not apply “where other Union or national laws explicitly require consent”, or where the interests or fundamental rights of the person concerned override it, “in particular where the data subject is a child”.
  • Whatever the legal basis, the processing must be subject to appropriate technical and organisational safeguards, “including the right to object under Article 21”.

In plain terms: a company training or running an AI model on data that includes Europeans’ personal information would not need each person’s consent, if it can show its interest is legitimate and not outweighed by the person’s rights, and people keep a right to object.

Delegations will find in the Annex the text of the mandate for negotiations with the European Parliament … as agreed by the Permanent Representatives Committee at its meeting on 21 October 2026. — Council document ST 14756/26

What happens next

This is the Council’s opening position. The European Parliament must adopt its own, and the two then negotiate a final text with the Commission. Nothing in Article 88bis applies until a regulation is adopted and published in the Official Journal.

Citizen impact: For people in the EU, this is the clause that decides whether AI developers must ask before using their personal data or can rely on “legitimate interest” and leave them to object. Canadians and Americans using EU-based services would feel it too. It is not law yet.

What this piece refuses

We do not say “the EU approved” looser rules: only the Council’s negotiating mandate is agreed. We do not summarise the whole omnibus (cookies, incident reporting, the definition of personal data) here; the Council text marks changes against the Commission proposal and we limit ourselves to the clause we checked word by word.

Bottom line

Member states want AI training and operation on personal data to be possible under legitimate interest, with safeguards and an objection right. Parliament has its say next.