EU Council's Coreper approves GDPR carve-out for AI training data

On 21 October 2026, the Council of the EU's Committee of Permanent Representatives, known as Coreper, approved a negotiating mandate on the Digital Omnibus package that adds a new Article 88a to the GDPR.

The approved text, published the next day as Council document 14756/26, still has to be negotiated with the European Parliament before it can become binding law.

What it is

The mandate covers the data-focused half of the EU's Digital Omnibus package, a proposal that was tabled on 19 November 2025 by the Commission.

That proposal lets companies rely on the GDPR's legitimate interest legal basis to use personal data for training or operating AI systems and models, subject to certain conditions.

The privacy group noyb called the mandate a 'digital expropriation' and said it approved a change to the GDPR that would put the profit-making interests of OpenAI, Anthropic, Google, Meta and SpaceX over Europeans' fundamental right to data protection.

What it requires

Article 88a of the mandate states that processing data in the context of the development and operation of an AI system or model may be carried out for a legitimate interest of the controller or a third party, under Article 6(1)(f) of the GDPR.

A companion recital adds a brake, stating that development and operation of an AI system or model do not in themselves constitute a legitimate interest, and that applying Article 6(1)(f) must be assessed case by case based on the purpose of the processing.

The Council's own press release on the mandate mentions only the safeguards added to the exemption for sensitive data, without naming AI training directly.

Because this is only a negotiating mandate, the GDPR continues to apply in full while the file remains in Council and Parliament.

What security leaders should do

Security and privacy teams should keep using the current GDPR legitimate-interest balancing test as the only basis for AI training projects until a final text is adopted, rather than assuming the carve-out already applies. Teams should track the trilogue negotiations between the Council and Parliament, since Parliament's position is still unsettled and roughly 1,840 amendments were tabled to the related draft report in August 2026.

Organizations should document how any future reliance on legitimate interest would be weighed against data subjects' rights, since the mandate preserves that balancing structure rather than removing consent outright.

Given the scale of the lobbying and criticism around this file, legal and compliance teams should also expect further amendments before any provision becomes enforceable.