On 20 January 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted Joint Opinion 1/2026 on the Commission’s proposal for a Digital Omnibus on AI, which seeks to simplify the implementation of the AI Act. The proposal was tabled in 19 November 2025, including a wide range of measures to extend regulatory simplifications and reduce burdens.

The EDPB and EDPS support the general objective of addressing implementation challenges and reducing administrative burdens. However, they stress that simplification must not weaken the protection of fundamental rights, especially the rights to privacy and data protection.

A central concern is the proposed extension of the legal basis that allows providers and deployers to process special categories of personal data for bias detection and correction. While the EDPB and EDPS accept that such processing may be necessary in some cases, they warn that it must remain narrowly circumscribed. They recommend keeping the current standard of strict necessity, particularly to prevent broad or abusive reliance on this exception for non-high-risk AI systems.

They also oppose removing the obligation to register certain AI systems in the EU database when providers claim that systems listed in Annex III of the AI Act are not high-risk. In their view, this would weaken transparency and accountability and could incentivise providers to rely too easily on exemptions.

Regarding EU-level AI regulatory sandboxes, the EDPB and EDPS welcome their creation but call for clearer involvement of competent data protection authorities. They also recommend giving the EDPB an advisory role and observer status in the European Artificial Intelligence Board where data protection issues arise.

The Opinion further raises concerns about supervision by the AI Office, stressing the need to clearly delimit its exclusive competence and to preserve the EDPS’s role regarding AI systems used by EU institutions. It also warns against weakening the current AI literacy obligation for providers and deployers, arguing that AI literacy is essential for awareness of risks and compliance.

Lastly, the EDPB and EDPS express concern about delaying the application of high-risk AI rules. While acknowledging implementation challenges, they warn that postponement could affect fundamental rights protection in a rapidly evolving AI landscape and invite the co-legislators to consider maintaining the current timeline for certain obligations, such as transparency.