EU Council backs AI carve-outs in GDPR as MEPs demand global AI treaty

Council keeps broad legal basis for AI data processing

After months of negotiations among Member States, the Council agreed its negotiating position on the Digital Omnibus on 21 October. According to CDT Europe, the text affirms legitimate interest as one of many legal bases for AI-related processing, preserving a broad approach to the use of personal data for any AI-related purpose.

The Council offers a modest mitigation: entities processing personal data for AI operation and development must comply with technical and operational safeguards, whatever legal basis they rely on.

CDT Europe also notes that the text leaves the definition of "personal data" unchanged, unlike the original European Commission proposal. It does, however, propose to narrow the scope of the General Data Protection Regulation (GDPR) in a similar way, by allowing a level of pseudonymisation that would take data outside the GDPR's scope.

A push by Germany added a new article. It would require the Commission to report six months after the text enters into force on the proportionality of GDPR obligations for SMEs engaged in "low-risk processing", and to suggest possible amendments. CDT Europe reads this as a preview of future changes that could undermine the law's reach.

Parliament rejects self-policing and Dublin summit draws criticism

In a plenary debate on 22 October, MEPs across party lines rejected self-regulation and called for international action on AI risks, according to CDT Europe. Proposals ranged from international cooperation to a global AI treaty with binding rules. The organisation describes this as a first for Europe.

Views differed on the EU AI Act as a model. MEPs Benifei and Voss called for Europe to export the Act's approach and values, while MEPs Dávid and Jongen stressed the need for new approaches to overcome the limits of the law. Several MEPs also criticised the withdrawal of the AI Liability Directive proposal in early 2025 and asked for fresh rules. This reopened the debate over the revised Product Liability Directive, which is due to be transposed into national law by December this year.

Earlier, the Irish presidency of the Council hosted an International AI Summit in Dublin. CDT Europe says the programme overwhelmingly featured policymakers and industry, with no civil society organisations or academics. Civil society organised a counter summit on workers' perspectives. The summit declaration stressed AI safety, adoption, sovereignty, and investment in infrastructure and skills, and highlighted access to environmental information. According to CDT Europe, human rights were mentioned without concrete solutions, and enforcement of EU laws was absent. It adds that Google and Microsoft questioned the relevance of existing rules at the event.

Other developments: standards, watermarking and smart glasses

The bulletin lists several further items:

• The Commission published the reference to the harmonised AI Act standard "Artificial Intelligence, Quality management system", the first finalised and endorsed standard from CEN and CENELEC's Joint Technical Committee 21. Providers following it are presumed compliant with relevant obligations, but high-risk obligations are postponed until at least December 2027.
• OpenAI announced it will begin watermarking AI-generated text in the EU. CDT Europe says the Transparency Code of Practice, which OpenAI signed, requires free public access to a detection tool, but OpenAI's tool will initially be open only to approved researchers and expert organisations. Anthropic has already announced worldwide watermarking.
• Mistral released a new model, Large 4, in early October. Ecosia reportedly dropped Mistral over model quality and environmental concerns. Mistral CEO Arthur Mensch defended building European frontier models to reduce dependencies and ensure cybersecurity.
• Lighthouse Reports filed a complaint against the Commission under the Aarhus Convention over the non-disclosure of data centres' energy data.
• More than 120 campaign organisations and trade unions urged an end to public sector contracts with Palantir.
• The European Data Protection Board criticised smart glasses over transparency towards recorded non-users, and Norway is preparing a legislative proposal for a temporary ban in privacy-sensitive public places.

What it means

The bulletin shows institutions pulling in different directions. Member States are consolidating a flexible approach to personal data in AI development, while Parliament members are pressing for binding international rules and new liability provisions. For companies, the AI Act's first harmonised standard offers a route to presumed compliance, though the high-risk deadline has slipped to at least December 2027. The views here are those of CDT Europe, an advocacy organisation, and the Council text remains a negotiating position rather than final law.