On October 21, 2026, the Council of the European Union’s Committee of Permanent Representatives (Coreper) agreed a negotiating mandate proposing a specific legal route for using personal data to develop or operate AI systems and models. The mandate is not an amendment to the GDPR, and the proposed route would retain requirements to choose a lawful basis and protect people’s rights.
What proposed Article 88bis would allow
The Council’s Digital Omnibus mandate would add proposed GDPR Article 88bis. It says that processing personal data to develop or operate an AI system or model could rely on legitimate interest under Article 6(1)(f). A lawful basis is the legal ground a data controller must select for processing personal data.
That route would not make AI development or operation a legitimate interest automatically. The Council’s recital says those activities are not, by themselves, a legitimate interest; the assessment would remain specific to each case. Proposed Article 88bis(2) also keeps the controller’s duty to choose an appropriate legal basis under Article 6.
The draft retains safeguards and the right to object
Proposed Article 88bis(3) would require appropriate technical and organizational measures and safeguards regardless of the Article 6 basis used. It expressly includes the right to object under Article 21 of the GDPR.
The Council text does not include the Commission proposal’s unconditional objection right. But the Article 21 right remains expressly in the Council draft, so the proposed change would not remove every right to object to AI-related processing.
The GDPR has not changed
Coreper’s agreement sets out the Council’s negotiating position, not a law in force. The Council circulated the mandate as document ST 14756/26 on October 22, 2026. The Council and European Parliament still need to agree on legislation before it can be formally adopted.
