GDPR AI clause leak: why Article 88bis is no free pass

Council document 12535/26, a Presidency compromise dated 3 September 2026, rewrites the GDPR clause that would let companies train and run AI systems on personal data under legitimate interest. noyb published the leaked text on 21 September and Max Schrems called it "nothing but a digital expropriation of Europeans". The headline reading is that AI processing becomes lawful by default. The text is more modest than that, and the gap between the headline and the text matters for anyone in Sweden or the EU building on Azure OpenAI, Foundry or Copilot with customer data.

Nothing in the Digital Omnibus is law yet. Parliament has not voted in committee, the Council has not agreed a mandate, and trilogues have not started. What has changed is the direction of travel: the safeguards the Commission attached to AI processing are being stripped out of the binding text, and one large member state wants to go further. If your AI roadmap assumes a friendlier GDPR arrives soon, this is the week to check that assumption.

How the AI clause got here

The Commission tabled the Digital Omnibus on 19 November 2025 as COM(2025) 837, procedure 2025/0360(COD). Among many GDPR changes, it proposed a new Article 88c stating that processing personal data for the development and operation of an AI system or model can rest on legitimate interest under Article 6(1)(f). The Commission attached four safeguards to that clause:

• Minimisation. Data minimisation when selecting sources and during training and testing.
• Residual data. Protection against disclosure of personal data residually retained in a model.
• Transparency. Enhanced transparency towards data subjects.
• Objection. An unconditional right for data subjects to object to the processing of their personal data.

The text also kept carve-outs: the basis applies only "where appropriate", it yields where other Union or national law explicitly requires consent, and it names children as a case where data subject interests weigh heavily.

The Council has been rewriting this since. A June compromise (ST 10677/26, 18 June 2026) moved the AI provision into a recital saying such processing "may, in appropriate cases" constitute a legitimate interest. A COREPER II vote planned for 26 June was cancelled over unresolved issues, and the file passed to the Irish Presidency. The September text, prepared for an Antici Group meeting on 11 September, restores an operative article, renumbered Article 88 bis, but without the Commission's safeguards.

What 12535/26 actually says

Per the leaked text as reported by noyb and PPC Land, Article 88 bis provides that processing personal data "in the context of the development and deployment of an AI system or of an AI model, may be regarded as carried out for a legitimate interest of the controller", with the Article 6(1)(f) qualifier intact: "except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject".

That qualifier is the part the commentary tends to skip. The balancing test survives. What goes is everything around it:

• All four Commission safeguards are struck from the operative text, including the unconditional right to object.
• Recitals 30 and 31 are deleted. A new recital 33a keeps some of the child-protection and consent language, in non-binding form and qualified by "where appropriate".
• The cookie articles the Commission moved into GDPR (88a and 88b) are deleted and the rules go back to Article 5(3) of the ePrivacy Directive, with a new exemption for contextual advertising measurement tied to the immediate page or single search query, without profiling.

Two other threads in the same text affect AI projects. The definition of personal data is narrowed so that information "is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person". And a recital permits processing of special category data that appears "incidentally and residually" in training or validation sets, provided the controller took measures to avoid it and erases it once identified.

The German proposal is the real escalation

The more aggressive text is a German submission, WK 11020/2026 ADD 4, dated 17 August 2026. It proposes that processing "for the training and technical operation of an AI system" shall be presumed to be a legitimate interest. A presumption shifts the burden: the controller no longer needs to show the balance tips its way; someone else must show it does not. Germany also proposed that data already collected for other purposes be presumed compatible with AI use, and that the information and rectification-to-restriction rights in Articles 14 and 16 to 18 be limited where compliance is "disproportionate", dropping the word "manifestly".

This is a member-state submission, not the Presidency text. It shows where the pressure is coming from, and noyb reports informal support among a number of member states. It does not show where the final regulation lands.

Four texts, side by side

Read across the rows and one pattern stands out. Under every text except the German one, the controller still carries the burden of a documented balancing test. The Council draft makes the legal basis explicit and removes the Commission's extra obligations, which on paper leaves AI developers roughly where EDPB Opinion 28/2024 already put them in December 2024, minus the unconditional objection right.

Why "lawful by default" is the wrong planning assumption

Three reasons to keep planning against today's GDPR rather than against the most permissive draft.

Parliament is pulling the other way. The file sits jointly with ITRE and LIBE, with Aura Salla (EPP, Finland) and Marina Kaljurand (S&D, Estonia) as rapporteurs. Their draft report came out on 22 June 2026 and drew more than 1,750 amendments. Kaljurand has said she will table amendments to keep the definition of personal data intact. Whatever the Council agrees has to survive trilogue with that Parliament.

The regulators have already said where their line is. The EDPB and EDPS joint opinion of 11 February 2026 welcomed clarification of AI processing, with reservations about the design, and reserved strong criticism for the redefinition of personal data, warning it could remove processing from the GDPR's scope beyond what the Court of Justice has held. Sweden's IMY took part in that opinion. Supervisory authorities will enforce whatever the final balancing test requires, and they will read it in light of that opinion.

A regulation can still be challenged. noyb has signalled that the Court of Justice may be asked to review the final text against the Charter. A legal basis you rely on in 2027 could be narrowed by a judgment in 2029, after your model is trained on the data.

The practical position today is unchanged. The GDPR applies in full, legitimate interest for AI training still needs a documented three-step assessment, and data subject rights operate as they do now.

What this means for AI workloads on Azure

Most Swedish enterprises are not training foundation models. They are deploying them: retrieval over CRM and case data, fine-tuning a model in Foundry on support tickets, Copilot agents grounded in SharePoint. The Omnibus language covers "development and deployment", so these workloads are in scope of the clause either way. Here is how each draft element maps to typical Azure patterns.

Fine-tuning on customer data. This is the case closest to "training" in the text and the one where the old-data question bites. Tickets collected to deliver support are being reused to teach a model. Under today's rules, and under the Council text, you need an Article 6(4) compatibility assessment plus a legitimate interest assessment. Only the German proposal would presume compatibility. Budget for the assessment.

Retrieval-augmented generation. RAG does not put personal data into model weights, but it processes it at query time and often sends it across a processor boundary. The purpose is usually close to the original collection purpose, which helps. The residual-disclosure safeguard the Commission proposed maps directly to a RAG risk: an answer that surfaces one customer's data to another user. Keep document-level access trimming in your retrieval layer whatever the final law says.

Pseudonymised analytics feeding a model. The narrowed personal-data definition follows the Court of Justice's EDPS v SRB judgment of 4 September 2025, which held that strongly pseudonymised data can be non-personal for a recipient that cannot re-identify it. If your architecture keeps the re-identification key in a separate Key Vault, under a separate team and subscription, and your AI pipeline never touches it, you are building towards that test already. That design is worth doing now because the judgment applies today, independent of the Omnibus.

Special category data in training sets. The residual-data recital only helps controllers who "took measures to avoid" such data and erase it when found. That is an engineering requirement, not a legal shortcut. A PII and sensitive-data detection pass before data reaches a training or indexing job, using something like Azure AI Language PII detection or Microsoft Purview sensitive information types, plus a deletion path, is the evidence you would need.

A legitimate interest record that survives any outcome

EDPB Opinion 28/2024 sets out the three steps: a legitimate interest, necessity, and a balancing test that considers the reasonable expectations of data subjects and mitigating measures. Write it once per AI use case and keep it next to the architecture decision record. A minimal structure:

ai_use_case: support-ticket-fine-tune
phase: development | deployment
controller: <legal entity>
processors: [Microsoft (Azure OpenAI / Foundry), <others>]
region_and_data_zone: swedencentral | EU Data Zone

step_1_interest:
  statement: "Reduce first-response time on support cases"
  lawful_real_present: true

step_2_necessity:
  less_intrusive_options_considered: [synthetic data, retrieval only, anonymised set]
  why_rejected: "..."
  minimisation: [fields dropped, retention of training copy, PII scrub job]

step_3_balancing:
  data_subjects: [customers, customer employees]
  reasonable_expectations: "privacy notice section X updated YYYY-MM-DD"
  special_category_handling: [detection pass, erase-on-discovery path]
  residual_disclosure_controls: [output filtering, access trimming, eval set]
  objection_route: "form + ticket tag; excluded from next training run"
  children: none | handled via ...

compatibility_art_6_4:   # only when reusing data collected for another purpose
  original_purpose: "..."
  link_and_context: "..."
  safeguards: "pseudonymisation, key held by separate team"

review_date: <date>

Keep the objection route even though the Council text drops the unconditional right. Article 21 still applies, the Commission and Parliament may restore something stronger, and an objection path that already excludes records from the next training run is cheap to operate once the pipeline has an exclusion list.

The Swedish and EU angle

IMY's approach, in the words of Director-General Eric Leijonram in February, is a "pragmatisk, riskbaserad ansats", pragmatic and risk-based. That is good news for well-documented projects and no help for undocumented ones. IMY's guidance on GDPR and AI was last updated on 26 May 2026 and covers legal basis, transparency and automated decision-making. Read it before relying on any Omnibus draft.

Public-sector organisations have an extra constraint. Many rely on public-interest or legal-obligation bases rather than legitimate interest, and Article 6(1) excludes legitimate interest for public authorities performing their tasks. A new legitimate-interest clause for AI does little for a municipality or agency. Their path runs through national law and the offentlighets- och sekretesslagen, not through Article 88 bis.

Swedish companies that also operate in Germany should watch the German position closely. A presumption of legitimate interest in the regulation would apply EU-wide, but supervisory practice still differs by country and by authority. A permissive text does not guarantee permissive enforcement.

Keep the AI Act separate in your planning. It regulates the AI system; the GDPR regulates the personal data flowing through it. Relief under one does not reduce obligations under the other.

Other Omnibus items worth tracking

The Commission package also proposed raising the breach-notification threshold to "likely to result in a high risk" and extending the deadline from 72 to 96 hours, with a single reporting entry point shared with NIS2, DORA, eIDAS and CER. The EDPB and EDPS welcomed the higher threshold. It would reduce reporting volume for many incidents involving AI logs and prompts, but until it is adopted, 72 hours and the current threshold apply. Do not change your incident runbooks yet.

The Commission text also lets controllers refuse abusive access requests, and the Council is refining when a controller can refuse or charge. For AI systems, subject access requests about training data are a known pain point. A clearer abuse standard would help, but only for genuinely abusive requests; ordinary access requests about whether a customer's tickets trained your model still need an answer.

What to do this quarter

• 1. Inventory AI use cases that touch personal data. Fine-tunes, RAG indexes, Copilot agents with custom connectors, evaluation sets built from production data. Mark which reuse data collected for another purpose.
• 2. Write a legitimate interest record for each. Use the structure above. Where the data is reused, add the Article 6(4) compatibility section.
• 3. Build the objection path into the pipeline. An exclusion list that the training and indexing jobs read before every run.
• 4. Add a detection pass for special category data. Before training and before indexing, with logged results and an erase-on-discovery procedure.
• 5. Separate pseudonymisation keys. Different Key Vault, different subscription, different owning team. It helps under the SRB judgment now and under a narrower definition later.
• 6. Assign someone to track 2025/0360(COD). The Parliament committee vote and any Council mandate are the two events that would change this advice. Neither has a confirmed date.

For the data-residency side of the same projects, see our breakdown of the Foundry EU Data Zone premium. For governance of coding agents that read repositories containing personal data, see the consumer-plan trap for EU teams.

The leak tells you which way the Council is leaning. It does not give anyone a legal basis they lack today. Organisations that document their balancing test now will be compliant under every version of Article 88 bis on the table, including the one noyb is fighting.