At the plenary meeting of the European Data Protection Board, held on 20 January 2026 and partly chaired from Zagreb under the leadership of the Vice-Chair of the European Data Protection Board, Zdravko Vukić, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the European Commission’s Proposal for the “Digital Omnibus on Artificial Intelligence”.
The Proposal aims to simplify the implementation of certain harmonised rules under the Artificial Intelligence Act in order to ensure their effective application.
The EDPB and the EDPS support the objective of addressing practical challenges related to the implementation of the Artificial Intelligence Act. However, administrative simplification must not result in a lower level of protection of fundamental rights. The Joint Opinion acknowledges the complexity of the AI landscape and welcomes efforts to reduce burdens for organisations. Nevertheless, certain proposed changes could weaken the protection of individuals in the context of artificial intelligence.
The European Commission’s Proposal would extend the possibility to process special categories of personal data (such as data revealing ethnic origin or health data) for the purposes of bias detection and correction to providers and deployers of all AI systems and models, subject to appropriate safeguards. The EDPB and the EDPS recommend clarifying that such data may be used for bias detection and correction only in clearly circumscribed situations where the risk of adverse effects resulting from such bias is considered sufficiently serious.
The EDPB and the EDPS advise against the proposed deletion of the obligation to register AI systems when they fall within the categories of high-risk systems, even if providers consider their systems to be “non-high-risk”. They consider that such a change would significantly undermine accountability and create an undesirable incentive for providers to unjustifiably claim exemptions in order to avoid public scrutiny.
The EDPB and the EDPS welcome the establishment of EU-level AI regulatory sandboxes to promote innovation. In order to ensure legal certainty, the Joint Opinion recommends the direct involvement of competent Data Protection Authorities (DPAs) in the supervision of data processing within sandboxes. In addition, the EDPB should be granted an advisory role and observer status in the European Artificial Intelligence Board to ensure consistency with regard to EU-level sandboxes. Furthermore, the supervisory role of the AI Office with regard to AI systems based on general-purpose AI models should be clearly delineated in the operative provisions and should not overlap with the independent supervision exercised by the EDPS over AI systems developed or used by Union institutions, bodies, offices or agencies.
The EDPB and the EDPS support the objective of streamlining cooperation between authorities or bodies responsible for fundamental rights and Market Surveillance Authorities, as well as reliance on a central point of contact to increase efficiency. However, they recommend clarifying the role of Market Surveillance Authorities as administrative points of contact for the execution and transmission of requests to providers and deployers, while ensuring that the independence and powers of Data Protection Authorities remain unaffected.
The EDPB and the EDPS also recommend maintaining the obligation for AI providers and deployers to ensure an adequate level of AI literacy among their staff. Any new obligation to foster AI literacy imposed on the Commission or the Member States should complement, rather than replace, the responsibilities of the organisations that actually develop and use these systems.
Finally, the EDPB and the EDPS express concerns regarding the proposed postponement of the application of core provisions for high-risk AI systems. In view of the rapid evolution of the AI landscape, they invite the co-legislators to consider whether the original timeline can be maintained for certain obligations, such as transparency requirements, and to minimise delays as far as possible.
