EU AI Act Regulatory Brief — Week of 26 October 2026

Council agrees its negotiating mandate on the Digital Omnibus GDPR reform

On 21 October 2026, the Permanent Representatives Committee (Coreper) agreed the Council of the EU's negotiating mandate on the Digital Omnibus — the package proposing targeted amendments to the General Data Protection Regulation and the ePrivacy Directive (procedure 2025/0360(COD)). The agreed text was circulated as document ST 14756/26, dated 22 October. The mandate is the Council's opening position for negotiations with the European Parliament, which has not yet voted; those negotiations have not started. None of this is law.

The Digital Omnibus on AI, which amends Regulation (EU) 2024/1689 (the AI Act), is a separate instrument: adopted by the Council on 29 June 2026, signed as Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026.

Article 88 bis (Article 88c in the Commission's proposal) — legitimate interest for AI development and operation. The Council proposes a GDPR provision under which controllers may rely on the legitimate-interest basis in Article 6(1)(f) to process personal data for developing or operating AI systems or models. Limits:

• Recital 33a indicates that developing or operating an AI system is not in itself a legitimate interest; each controller still has to carry out the case-by-case balancing test against the data subjects' rights.
• Recital 33a indicates that public authorities developing or operating AI for public-interest tasks may rely on Article 6(1)(e). The existing GDPR already bars public authorities from relying on legitimate interest for their tasks.
• The Council replaced the Commission's specific safeguards, including an unconditional right to object, with a general requirement for appropriate technical and organisational measures and a reference to the qualified right to object in Article 21 GDPR.

Article 9(2)(k) — incidental special-category data. Where AI development encounters residual special-category data (Article 9(1) GDPR), controllers would have to avoid collecting it, erase it once identified, and, where erasure is impossible or disproportionate, protect it and restrict its further processing.

Article 33 — breach notification. The deadline to notify the supervisory authority would go from 72 to 96 hours and apply only to breaches likely to result in a high risk, notified through a national entry point under a new Article 23b of the NIS2 Directive rather than the Commission's single EU-level entry point. Today's 72-hour rule still applies.

Article 25a — pseudonymised data. Pseudonymised data would not be personal data for a third party that cannot identify the data subject by means reasonably likely to be used. The Council kept the existing Article 4(1) definition of personal data and dropped the Commission's amendment to it.

Cookies: the Council deleted Articles 88a and 88b of the Commission's draft, which would have moved cookie consent rules into the GDPR. Cookie rules stay in Article 5(3) of the ePrivacy Directive.

What it means for you

If you process personal data to develop, train, fine-tune or test AI systems, you are a GDPR controller for that processing, whatever role you hold under the AI Act for the same system. An organisation that integrates a general-purpose AI model into its own AI system is the provider of that system under Article 3(3) of the AI Act; one that uses a third-party system without substantially modifying it is a deployer under Article 3(4). Either can be a GDPR controller when it processes personal data in that context.

Article 88 bis shows where the Council wants the law to go, but it has not been adopted and the Parliament's position is not yet known. Do not change your legal bases, records of processing or data processing agreements on the strength of the mandate; the current GDPR, including the case-by-case balancing test for legitimate interest, applies unchanged.

The proposed Article 9(2)(k) is a useful signal. If you train AI models on large, mixed datasets, in our view it is worth reviewing your pipeline now for incidental special-category data and documenting how you handle it: the existing data-minimisation duties already point the same way.

The 96-hour breach deadline and the pseudonymisation rule do not apply yet.

Sources

1. Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules — Council of the EU (21.10.2026)
2. Council mandate, document ST 14756/26 — Council of the EU (22.10.2026)
3. EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks — ppc.land
4. Digital Omnibus: The Council Adopts Its Position, Simplifying the GDPR Without Dismantling It? — nicfab.eu
5. Regulation (EU) 2026/1744 — EUR-Lex (24.07.2026)

Italy's AI employment decree enters into force

Italy's Legislative Decree No. 179 of 7 October 2026 (D.Lgs. 179/2026), published in the Gazzetta Ufficiale (General Series No. 234) on 8 October 2026, entered into force on 23 October 2026. It applies to any employer in Italy that uses AI systems in the decisions it covers, with no size threshold.

Article 41 of the decree (in Chapter III) requires that a final decision on hiring, changing or ending an employment relationship, a disciplinary measure or a performance evaluation must not rest solely on processing carried out by an AI system. The decision must be taken by a person with real and independent decision-making power (potere effettivo e autonomo), not one whose role is merely formal. The worker's consent does not lift this requirement.

The sanction is nullity: a decision taken in breach of the rule, including a dismissal, is void. Workers may ask for an intelligible explanation of an AI-assisted decision, including how the AI system's output influenced it and the main parameters used.

Candidate search and screening are not "final decisions" under the decree. GDPR Article 22 continues to apply separately to any solely automated pre-selection step.

How this sits with EU rules: AI systems used for recruitment and for decisions about workers, including performance evaluation, are high-risk under Annex III, point 4, of Regulation (EU) 2024/1689. An organisation that obtains such a system from a vendor and uses it without substantially modifying it is a deployer under Article 3(4); one that builds or substantially modifies its own is a provider under Article 3(3). The Italian rule binds the employer as the user of the system, from 23 October 2026. The AI Act's high-risk obligations for Annex III systems apply from 2 December 2027, the application date set by Regulation (EU) 2026/1744.

What it means for you

If you employ staff in Italy and use AI in any of these employment decisions — including a system bought from a vendor — a person with real decision-making authority must now take each final decision. In our view, a process that ends with someone formally acknowledging the AI's output will not meet that standard.

Practical steps: map every AI-assisted HR process that touches employees in Italy; check with your vendors which outputs could count as a final decision under the decree; and check the same processes against GDPR Article 22.

Nullity is a civil-law remedy enforced before the labour court. It is separate from, and does not exclude, administrative fines under the GDPR. In our view, an employee who shows a dismissal was void can seek reinstatement.

Sources

1. Decreto legislativo 7 ottobre 2026, n. 179 — Normattiva (08.10.2026)
2. D.Lgs. 179/2026: attuativo AI Act su formazione, lavoro e professioni — Altalex (20.10.2026)
3. Utilizzo di sistemi di AI in azienda: il D.Lgs. n. 179/2026 introduce nuovi obblighi — EcNews
4. Italy: from 23 October, AI hiring or firing requires a human decision maker — actuia.com

What to do this week

• Treat the Council's Article 88 bis as a possible future legal basis for AI development, but change no GDPR documentation or data processing agreements until the negotiations produce law.
• If you train AI on datasets that may contain special-category data, map that data now and document how you avoid, erase or restrict it, in line with the approach of the proposed Article 9(2)(k).
• If you employ staff in Italy and use AI in hiring, changing or ending employment, discipline or performance evaluation, confirm that a person with real decision-making authority takes every final decision, and that your process records show it.
• Review contracts for AI-based HR tools used in Italy: establish which outputs could count as a final decision under D.Lgs. 179/2026 and whether your process meets the human-decision-maker rule and GDPR Article 22.

Quick reference

Every source in this issue

1. Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules — Council of the EU (21.10.2026)
2. Council mandate, document ST 14756/26 — Council of the EU (22.10.2026)
3. EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks — ppc.land
4. Digital Omnibus: The Council Adopts Its Position, Simplifying the GDPR Without Dismantling It? — nicfab.eu
5. Regulation (EU) 2026/1744 — EUR-Lex (24.07.2026)
6. Decreto legislativo 7 ottobre 2026, n. 179 — Normattiva (08.10.2026)
7. D.Lgs. 179/2026: attuativo AI Act su formazione, lavoro e professioni — Altalex (20.10.2026)
8. Utilizzo di sistemi di AI in azienda: il D.Lgs. n. 179/2026 introduce nuovi obblighi — EcNews
9. Italy: from 23 October, AI hiring or firing requires a human decision maker — actuia.com

Compiled by Relay Labs Ltd from the sources above, which remain the authoritative text. General information about EU law, not legal advice.