EDPB & EDPS issue Joint Opinion on the EU Digital Omnibus on AI

On 20 January 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) released Joint Opinion 1/2026 ("Opinion") on the European Commission's Digital Omnibus on AI proposal ("Proposal"). The Opinion highlights the dynamism and complexity of the debate surrounding the regulation of the EU AI landscape, which is caught between the conflicting priorities of promoting innovation and reducing bureaucracy for businesses on the one hand, and the interests of effective oversight by authorities and the protection of affected individuals on the other.

While the supervisory authorities express support for the Commission's objective of addressing AI Act implementation challenges, they raise substantive concerns about specific simplification measures that risk compromising the protection of fundamental rights. Notably, the Opinion echoes the EDPB's commitment to facilitating GDPR compliance while enabling responsible innovation and references the forthcoming joint EDPB-Commission guidelines on the interplay between the GDPR and the AI Act.

In detail:

1. Processing of sensitive data for bias detection

The Proposal introduces a new Article 4a extending the legal basis for processing special categories of personal data (Article 9 GDPR data) for bias detection and correction. Critically, this extension applies not merely to high-risk AI systems, but to all AI systems and models - and now encompasses deployers as well as providers.

EDPB and EDPS acknowledge that undetected bias in AI systems can present risks not only to individual data subjects but to society as a whole. However, they recall that processing special categories of personal data remains in principle prohibited under EU data protection law, and exceptions must be narrowly defined. Their key recommendations include:

• Reinstating the "strict necessity" standard (reduced in the Proposal to "necessary")

• Clearly circumscribing application to cases where the risk of adverse effects from bias is sufficiently serious

• Providing recital-level guidance with specific examples of non-high-risk systems warranting this exception

• Clarifying that data protection authorities (DPAs) retain primary supervisory competence over such processing pursuant to Article 2(7) AI Act

2. Registration and documentation

The Proposal deletes the registration obligation for providers who conclude that their Annex III AI systems are not high-risk under Article 6(3) AI Act. EDPB and EDPS firmly oppose this deletion, warning it would:

• Significantly decrease provider accountability

• Create undesirable incentives to unduly invoke the exemption without critical analysis

• Undermine public transparency, traceability, and deployer due diligence

• Impede timely response by market surveillance authorities (MSAs) and fundamental rights authorities or bodies (FRABs)

The authorities note that the projected savings are marginal and do not justify the erosion of accountability for systems that could still pose significant risks.

3. EU-Level AI Regulatory Sandboxes

EDPB and EDPS welcome the introduction of AI Office-operated sandboxes for general-purpose AI model-based systems under the new Article 57(3a). However, they identify gaps:

• Unlike national sandboxes under Article 57(10) AI Act, no provision exists for DPA involvement in EU-level sandboxes

• The identification of the competent DPA and the interplay with the GDPR cooperation mechanism remain unclear

• The EDPB should have (1) an advisory role to ensure consistency on data protection aspects, and (2) observer status at the AI Board

4. Supervision and enforcement

The Proposal grants the AI Office exclusive competence over AI systems based on general-purpose AI models (where the same provider develops both) and systems integrated into Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) under the DSA. While acknowledging centralization benefits, the authorities:

• Question whether the "active cooperation" provisions sufficiently protect national authority capacity to act independently

• Recommend clear delimitation of which general-purpose AI models trigger exclusive AI Office competence

• Urge close coordination with DPAs where fundamental rights to privacy and data protection are at risk

• Call for the EDPS's exclusive competence over EU institution AI systems (Article 74(9) AI Act) to be codified in the operative text, not merely recitals

5. AI literacy

EDPB and EDPS strongly oppose converting the mandatory AI literacy obligation (Article 4 AI Act) into a soft "encouragement" mechanism. They highlight that AI literacy ensures understanding of AI concepts, raises ethical and social awareness, and plays a key role in empowering individuals across the AI lifecycle to protect fundamental rights and support compliance. If the Commission wishes to promote AI literacy, this should complement-not replace-existing provider and deployer obligations.

6. Implementation Timeline

The Proposal delays high-risk AI rules to December 2027 (Annex III systems) and August 2028 (Annex I systems), while extending the grandfathering clause for legacy systems to December 2027. EDPB and EDPS express sincere concerns about:

• The potential impact on fundamental rights protection in a fast-evolving landscape

• Whether a moveable deadline undermines legal certainty

• The prior objection in Joint Opinion 5/2021 to exempting systems already on the market

They invite legislators to consider maintaining the current timeline for certain obligations, particularly transparency requirements.

7. Outlook

The Opinion underscores that regulatory developments at the intersection of data protection and AI continue to accelerate. The Commission's Proposal aims primarily to reduce bureaucratic hurdles for AI developers and deployers. Naturally, this prompts DPAs to caution that such initiatives must not restrict the fundamental rights of affected persons or undermine effective data protection supervision. While the expressed concerns in the Opinion do not come as a surprise, it is noteworthy that EDPB and EDPS continually stress that they welcome the Proposal’s objectives in general and indicate to continue a cooperative approach in future debates. 

The Opinion signals that intensive negotiations over the Proposal will occur throughout the year regarding the balancing of reducing administrative burden and maintaining the protection of fundamental rights in the context of AI. The forthcoming EDPB and the Commission joint guidelines on the interplay between the GDPR and the AI Act (expected to be published later this year) will be a further indicator of how these conflicting interests are being balanced within the EU. We will continue to monitor developments closely.