The Council has adopted its mandate on the Digital Omnibus, including rules on processing personal data for AI development

On 21 October 2026 the Permanent Representatives Committee (Coreper) approved the Council's mandate for negotiations with the European Parliament on the Digital Omnibus (2025/0360(COD)). The proposal amends, among other things, the GDPR, the ePrivacy Directive (rules on cookies), the Data Act and the rules on reporting cyber incidents. It is not the Digital Omnibus on AI, which has already been published as Regulation (EU) 2026/1744.

What matters for AI is that the mandate provides for a provision on the processing of personal data in the context of the development and operation of AI systems and models on the basis of legitimate interest under Article 6(1)(f) GDPR, with appropriate safeguards and the right to object. It also contains an exception for the incidental processing of residual special categories of data in the development and operation of AI, coupled with an obligation to remove such data or at least to protect them effectively. Instead of a single EU entry point for incident reporting, the Council proposes national entry points.

Negotiations (trilogues) can start once the European Parliament adopts its position.