Summary: On January 21, 2026, the EDPB and EDPS adopted Joint Opinion 1/2026 on the EU Digital Omnibus AI proposal, supporting simpler application while warning against weaker safeguards. They seek a strictly necessary basis for sensitive-data bias detection and object to removing high-risk registration because it would reduce provider accountability. They also urge lawmakers to preserve current timelines.
On January 21, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted Joint Opinion 1/2026 on the European Commission’s “Digital Omnibus on AI” proposal (2025/0359). The legislative opinion endorses the aim of making the AI Act simpler to apply — and sets firm boundaries at the same time. Several simplification measures, the two authorities caution, stand to erode fundamental-rights safeguards, weaken provider accountability, and generate fresh legal uncertainty.
Behind it sits the Digital Omnibus package the Commission tabled in November 2025, whose AI strand would push back high-risk obligations, strike certain registration requirements, and broaden the legal basis for handling sensitive personal data. Within the GDPR system, the EDPB and EDPS are the gatekeepers. Their joint opinion binds nobody, yet it reliably carries weight with the European Parliament and the Council — nowhere more than where the AI Act meets the GDPR.
Flashpoint One: Special-Category Data Placed on Too Wide a Legal Basis
Article 4a, new in the proposal, stretches the legal basis for processing special categories of personal data for bias detection and correction from high-risk AI systems out to all AI systems and models, and extends the actors from providers to deployers too. The two authorities back the idea in principle — detecting bias genuinely means touching sensitive data — but demand the ground be “clearly circumscribed.” Their asks: trade the proposal’s looser “necessary and proportionate” test for a “strictly necessary” standard, confine the ground to situations where the risk of adverse effects from bias is sufficiently serious, spell out concrete examples of qualifying non-high-risk systems, and settle how the provision meshes with GDPR Articles 6 and 9.
Developers should read this as an early warning. Even with a widened legal basis, bias detection on sensitive data will be handled as high-risk work in practice, and DPIAs alongside GDPR analysis stay on the to-do list.
Flashpoint Two: Striking the High-Risk Registration Duty Undermines Accountability
Under the proposal, a provider that concludes, under Article 6(3) of the AI Act, that an Annex III system is not truly high-risk could leave it unregistered. The EDPB and EDPS put it plainly: removal would “significantly decrease the accountability of providers” and set up an “undesirable incentive” to lean on the exemption improperly. Easing administrative burdens wins their support — but never at the price of the accountability trail.
Other simplifications draw flags too. Widening SME privileges to small mid-cap companies (SMCs) earns a warning that headcount and company size do not track the harm potential of the high-risk AI those entities offer. On AI literacy, the two authorities reject scrapping the employer duty outright, holding that Commission and Member State obligations should add to organizational responsibilities rather than stand in for them.
Sandboxes and Who Regulates What: Define the AI Office’s Remit
As for EU-level AI regulatory sandboxes, the opinion applauds their creation while observing that the draft — unlike national sandboxes under Article 57(1) — hands data protection authorities no role, and it recommends seating the EDPB at the AI Board with an advisory role and observer status. On the AI Office’s supervision of AI systems embedded in very large online platforms (VLOP/VLOSE), the opinion cautions that an “active cooperation” requirement may fall short of preserving national authorities’ independent capacity to act, and asks for a clean delimitation of which general-purpose AI models trigger exclusive AI Office competence. Where the EU institutions themselves run AI systems, exclusive competence belongs with the EDPS under Article 74(9).
What Delayed Timelines Quietly Cost
High-risk obligations would slip by up to 16 months, and Article 50(2) transparency obligations would gain a six-month grace period running to February 2, 2027. The opinion catches a knock-on effect that is easy to overlook: the longer runway lets more high-risk systems exit the AI Act through the Article 111(2) legacy-systems exception, whose cut-off would drift from August 2, 2026 to December 2, 2027. The two authorities press the co-legislators to hold the current timelines — transparency requirements above all.
What This Means for Teams Deploying AI in the EU
Three judgments. One, treat the Digital Omnibus as anything but settled: the proposal is still being negotiated under pointed supervisory criticism, so compliance planning should not bank on the delays ever taking effect. Two, any team whose bias detection touches sensitive data should make “strictly necessary” the design standard today — retrofitting later costs more. Three, written classification records for high-risk determinations (the Annex III plus Article 6(3) path) remain the accountability core for the foreseeable future; until the registration question is decided, complete records are the only safe play.