GDPR AI clause agreed in Council: your Azure design brief

On 21 October 2026 the Permanent Representatives Committee agreed the Council's negotiating mandate on the Digital Omnibus, the package that rewrites parts of the GDPR, the ePrivacy cookie rule and cyber incident reporting. The General Secretariat published the text the next day as document 14756/26, 179 pages with changes against the Commission proposal marked. A month ago we covered the leaked September draft of the AI clause and argued it was no free pass. The agreed mandate confirms that reading, adds a line the leak lacked, and settles enough of the surrounding articles that Swedish teams on Azure OpenAI, Foundry and Copilot can make design decisions instead of guesses.

Nothing here is law. The European Parliament has not voted in committee, trilogues have not started, and the Council's own target for the whole simplification agenda is the end of 2027. What has changed is that one of the three institutions has stopped moving.

Article 88 bis as agreed

The Commission's Article 88c is renumbered Article 88 bis and has three paragraphs in the mandate. Paragraph 1 states that processing personal data "in the context of the development and operation of an AI system" as defined in the AI Act, "or of an AI model", may be carried out for a legitimate interest of the controller or a third party under Article 6(1)(f), "where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".

Paragraph 2 is new and short. It says paragraph 1 "does not affect the obligation of the controller to choose an appropriate lawful ground of processing set out in Article 6". The Commission's four named safeguards, which sat in the old paragraph 2, are struck from the operative text.

Paragraph 3 is the line the September leak lacked. "Regardless of the lawful ground of processing pursuant to Article 6, processing in the context of the development and operation of AI shall be subject to appropriate technical and organisational measures and safeguards to protect the rights and freedoms of the data subject in accordance with this Regulation, including the right to object under Article 21." The unconditional right to object the Commission proposed is gone, but the ordinary Article 21 right is now written into the AI article rather than left implicit.

Recital 33a carries the interpretive weight. It says the development and operation of an AI system or model "does not in itself constitute a legitimate interest, and the applicability of Article 6(1)(f) to processing in the context of AI is to be assessed on a case-by-case basis, taking into account the underlying purpose of that processing". It also recalls that public authorities should look to Article 6(1)(e), the public-task basis, when they train or operate AI for a task in the public interest. Both points matter in Sweden, and both sit in a recital rather than an article.

Leak versus mandate, article by article

The September document 12535/26 and the October mandate 14756/26 differ in five places that touch AI workloads.

Two further changes are easy to miss. Article 35 has the European Data Protection Board publish a single EU-level list of processing operations that require a data protection impact assessment, within nine months of application, replacing national lists such as IMY's. And Article 12(5) lets a controller refuse an access request where "an abusive intention on the part of the data subject" is apparent.

The pseudonymisation rule moved, and that changes the architecture argument

The Commission wanted to amend Article 4(1) so that information is not personal for an entity that cannot reasonably identify the person. Member states rejected that in the spring, and the mandate keeps the definition as it stands. The idea survives in a new Article 25a, "Application of pseudonymisation and identification of a natural person", whose second paragraph provides that pseudonymised data "shall not be considered personal data for a third party if that third party is unable to identify the natural person", subject to measures that prevent other persons from identifying the data subject. The Commission's power to settle the criteria by implementing act is removed; the Board is asked for an opinion instead.

For an Azure data platform this is a more useful rule than the one it replaces, because it turns on the recipient's actual capability. The design that benefits is the one the Court of Justice already endorsed in EDPS v SRB: the pseudonymisation key lives in a separate Key Vault, in a separate subscription, owned by a team that does not operate the AI workload, and the pipeline identity has no role assignment that can read it. Under Article 25a that separation is the fact you would point to. Under current law it is still the strongest mitigation you can document. The evidence is an access review of the vault plus the Entra ID role assignments on the pipeline's managed identity.

EDRi's open letter of 24 September warned that the same data could be personal for one actor and not for another, and that protections fall away for the actor who treats it as non-personal. Expect Parliament to press on this. Treat the data as personal inside your own estate, and use Article 25a only to describe what a downstream recipient receives.

Special category data: erase, or prove you cannot

The mandate turns the residual-data idea into an operative derogation. New Article 9(2)(k) covers special categories of data that are "incidentally and residually" involved in the development and technical operation of an AI system or model. The accompanying paragraph is specific: implement measures "to avoid the collection and otherwise processing" of such data; where it is identified anyway, "erase such data without undue delay"; and if erasure "proves to be technically impossible or requires manifestly disproportionate effort", protect the data "from being further processed or processed for other purposes, used to produce outputs, from being disclosed or otherwise made available to third parties".

Read that as three engineering requirements with a paper trail attached. The detection pass before data reaches a fine-tuning job or a search index is the "measures to avoid" step; Azure AI Language PII detection and Microsoft Purview sensitive information types both produce logs you can keep. Erasure is straightforward for an index: delete the chunk and re-embed. For a trained model it is where "technically impossible" bites, since you cannot remove a record from weights after the fact. The mandate's answer is output protection: the model may not be "used to produce outputs" from that data, which in practice means a serving-side filter or blocklist and a model-card note explaining why erasure was not feasible. Decide which path each AI asset falls under before training, and record it.

Breach reporting: 96 hours, but not yet, and not to Brussels

Article 33(1) in the mandate reads: for a breach "likely to result in a high risk to the rights and freedoms of natural persons", notify "without undue delay and, where feasible, not later than 96 hours after having become aware of it", with the support of "the national entry point" established under NIS2. The Commission wanted a single EU entry point; the Council wants one per member state, with an EU-level information point for cross-border cases.

Do not touch your runbook yet. The 72-hour clock and the current threshold apply until a final regulation enters into application, which on the Council's own timetable is 2028 at the earliest. What you can do now is make the eventual change cheap. If your Microsoft Sentinel or Defender XDR playbook hard-codes the deadline and the recipient, move both into a parameter. For Swedish organisations in NIS2 scope, the same national entry point will take both the cyber incident report and the GDPR breach notification, so the two runbooks should share an owner and an evidence pack.

The cookie rule moved back to ePrivacy, and Application Insights is in scope

The Commission had moved cookie rules into the GDPR as Articles 88a and 88b, including a duty to honour machine-readable consent signals. The Council deletes both and amends Article 5(3) of the ePrivacy Directive instead. Consent is not required for a closed list of purposes: transmission, a service the user explicitly requested, first-party audience measurement that produces "aggregated information about the usage of an online service", media audience measurement, security, and contextual advertising measurement without cross-site processing. Where consent is required, refusal must work "with a single-click button or equivalent means", and after a refusal the provider may not ask again for the same purpose "for a period of at least four months". GDPR supervisory authorities take over enforcement, and member states get 24 months after adoption to transpose.

The audience measurement exemption is narrower than most analytics deployments. Recital 44d says the aggregated data "should not relate to a specific data subject and should therefore be anonymous" and must not be combined with data from other services. The Application Insights JavaScript SDK sets a persistent per-browser user cookie and a session cookie by default, which is individual-level measurement however you later aggregate it. If your Next.js front end on Azure loads Application Insights before consent, either gate the SDK behind consent or run it without cookies. The SDK supports the second option directly.

import { ApplicationInsights } from '@microsoft/applicationinsights-web';

const appInsights = new ApplicationInsights({
  config: {
    connectionString: process.env.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING,
    // No cookies until the visitor consents; page views and
    // server-correlated telemetry still arrive, without a persistent user id.
    cookieCfg: { enabled: false },
    // Belt and braces: never write the user/session cookies even if
    // another script flips cookie usage back on.
    // (blockedCookies / ignoreCookies exist since SDK 2.8.8)
  },
});
appInsights.loadAppInsights();

// After an explicit opt-in from your consent banner:
export function enableAnalyticsCookies() {
  appInsights.core.getCookieMgr().setEnabled(true);
}

The option names come from Microsoft's SDK configuration reference: disableCookiesUsage is an alias for cookieCfg.enabled, and the cookie manager's setEnabled function re-enables cookies after initialisation. Cookie-less Application Insights still gives you page performance, failed requests and server-side correlation. Decide with your DPO whether the remaining telemetry fits the first-party measurement exemption; a defensible position is that server-side request logs do and a persistent browser identifier does not.

What is still open

Parliament's file sits jointly with ITRE and LIBE under Aura Salla and Marina Kaljurand. Their draft report of 22 June drew more than 1,750 amendments, and the legislative train shows no committee vote scheduled. The Irish presidency ends on 31 December, so the file will change hands at least once before trilogue.

The critics have sharpened rather than softened. Pablo Trigo Kramcsák and Lorenzo Dalla Corte, writing on the European Law Blog on 19 October, argue that Article 88 bis amounts to a "legislative pre-assessment" of legitimate interest for a whole technology, that "operation" is undefined, and that the clarifications which matter live in a recital that will never appear in the consolidated GDPR. Their conclusion: "The shortcut remains tempting, and the Council has not resisted it." The EDPB and EDPS joint opinion from February accepted the AI clause with reservations and rejected the redefinition of personal data outright; the Council has met the second objection by leaving Article 4(1) alone, and the first only partly. A Charter challenge after adoption remains realistic, which is why every control above also holds under today's law.

The Swedish and EU angle

Sweden's negotiating line was set out to the Riksdag's traffic committee on 24 March 2026: "ett centralt ingångsvärde för det svenska förhandlingsarbetet är dock att regeringen vill se förenklingar", provided protection of personal data remains effective. Vänsterpartiet and Miljöpartiet dissented, arguing that the changes let companies decide for themselves what counts as personal data. That dissent targets the Article 25a question, so expect it to resurface when Swedish MEPs vote.

For kommuner, regioner and state agencies the most useful sentence in the mandate is in recital 33a: Article 6(1)(e) "may be regarded as a lawful ground of processing where a public authority develops, including training, or operates an AI system or an AI model used in the performance of a task carried out in a public interest". Public authorities cannot use legitimate interest for their core tasks, so Article 88 bis was never going to help a municipality's case-handling assistant. The recital points them back to the public-task basis and to national law, which in Sweden means the sector-specific registerförfattningar and the offentlighets- och sekretesslagen. A recital binds nobody, but it tells you how the Council expects supervisory authorities to read the situation.

IMY is moving on the adjacent question. On 20 October it announced guidance on cloud services for the public sector, based on a survey of 19 municipalities, regions and agencies covering information classification, providers outside Sweden and the EU, exit strategies and contractual safeguards, with publication expected in the winter of 2026/27. Department head Malin Blixt framed cloud use as raising questions of "dataskydd, suveränitet och effektivitet". For a public body running Azure OpenAI in Sweden Central, that guidance and the Omnibus ask for overlapping evidence: where the data sits, who can re-identify it, and how you leave. The EU Data Zone cost analysis covers the residency half.

Keep the AI Act separate. This mandate does not touch high-risk obligations; those moved through the AI Omnibus earlier in the year, and the EN 18286 quality management standard now sets the evidence bar for providers. A legitimate interest finding under Article 88 bis says nothing about AI Act conformity.

Decision guide: change now, prepare now, or wait

• Change now: name the purpose in every legitimate interest assessment. Recital 33a makes "we are building AI" an insufficient interest. "Reduce first-response time on support cases" is an interest. Rewrite any LIA that leads with the technology.
• Change now: wire Article 21 into the pipeline. An exclusion list read by every training and indexing job, fed from the form customers already use for objections. Article 88 bis paragraph 3 names this right, so an auditor will ask to see it.
• Change now: decide erase-or-protect per AI asset. For each index and fine-tune, record whether discovered special category data can be erased, and if not, which output control protects it. Attach the detection-pass logs.
• Change now: separate the pseudonymisation key. Different Key Vault, different subscription, different owning team, no role path from the pipeline identity. Run an access review and keep the result as the Article 25a evidence.
• Prepare now: parameterise the breach runbook. Deadline and recipient as variables in the Sentinel playbook, one evidence pack shared with the NIS2 incident process. Keep 72 hours in production.
• Prepare now: audit cookies on every public site. List what Application Insights, consent tooling and marketing tags set before consent, and move the SDK to cookie-less initialisation until consent is given. The audit costs a day and the fix is a config change.
• Wait: the DPIA list. The EU-level list replaces IMY's within nine months of application. Until then IMY's list stands; do not retire any DPIA on the strength of the mandate.
• Track: procedure 2025/0360(COD). The ITRE-LIBE committee vote and the first trilogue are the two events that change this advice. Assign an owner and a quarterly check.

The Council has told you what it wants. Parliament will tell you what it will accept, probably in 2027. Organisations that documented their balancing test in September are compliant under the agreed mandate without changing a line. Organisations that waited for a free pass have been told, in a recital, that there is not one.