Article 88c GDPR: A New Route for AI Processing

A New GDPR Route for AI? What Organisations Should Know About Proposed Article 88c GDPR 

Companies increasingly use personal data to develop, improve, and operate AI systems. This raises an important legal question: which legal basis under the GDPR allows them to use personal data for these purposes? 

The European Commission's proposed Digital Omnibus, published on 19 November 2025, aims to provide more clarity. It introduces a new Article 88c GDPR. This provision would explicitly recognise that organisations may, under certain conditions, rely on legitimate interests when processing personal data for the development and operation of AI systems and models. At the same time, it introduces additional safeguards specifically for AI-related processing. 

This blog is part of a series on the European Commission's Digital Omnibus package. In a previous blog, we discussed the proposed changes to the legal framework for cookies. 

Proposed Article 88c GDPR: legitimate interests for AI 

The Digital Omnibus aims to simplify parts of the EU's digital framework, reduce administrative burdens, and provide businesses with more legal certainty. Proposed Article 88c GDPR forms part of that objective. It explicitly recognises that legitimate interests may be used as a legal basis for certain AI-related processing activities. 

This is relevant because obtaining valid consent can be difficult when developing AI systems. AI systems are often trained on large and complex datasets, which may contain personal data relating to many individuals. In practice, organisations may not have direct contact with all individuals whose personal data is included in those datasets, making it difficult to request valid consent from each of them. 

Legitimate interests may offer an alternative legal basis. When relying on legitimate interests, an organisation must demonstrate that it has a clear and specific legitimate purpose for using personal data, that the processing is necessary to achieve that purpose and that the same result cannot reasonably be achieved in a less intrusive way. The organisation must also ensure that its interests are not outweighed by the rights and interests of the individuals concerned. This balancing act should consider factors such as whether individuals would reasonably expect their data to be used in this way, the type of data involved, the scale of the processing, the potential impact on individuals and any safeguards implemented to mitigate risks. This assessment is usually documented in a Legitimate Interest Assessment, or LIA. 

Proposed Article 88c GDPR would provide more clarity by explicitly confirming that legitimate interests may also be used for certain AI-related processing activities. However, this would not mean that personal data may automatically be used whenever AI is involved. Organisations would still need to assess whether the use of personal data is justified in each individual's case. 

The proposal also requires organisations to implement appropriate organisational and technical measures to protect individuals. It identifies several AI-specific safeguards. Organisations would need to: 

• minimise the amount of personal data used when selecting data sources and when training and testing AI systems or models; 

• protect personal data that remains in an AI system or model from disclosure and ensure enhanced transparency towards the individuals concerned; and 
• give individuals an unconditional right to object to the processing of their personal data. 

EDPB and EDPS: clarification needed, but no broader AI exemption 

In Joint Opinion 2/2026, the European Data Protection Board and the European Data Protection Supervisor recognise that legitimate interests can already provide a legal basis for certain AI-related processing activities. This leads them to question whether a separate provision is necessary. 

At the same time, the regulators warn that Article 88c GDPR should not be interpreted as giving organisations broader permission to use personal data simply because the processing involves AI. The existing LIA under the GDPR will continue to apply. Organisations would therefore still need to show that the processing serves a legitimate interest, is necessary and that their interests are not outweighed by the rights and interests of the individuals concerned. 

The EDPB and EDPS welcome the proposed AI-specific safeguards but recommend making clear that these safeguards complement rather than replace the existing requirements of Article 6(1)(f) GDPR. They also support stronger transparency obligations and the unconditional right for individuals to object. 

What Article 88c GDPR means for AI governance and compliance and how to prepare 

Organisations do not need to wait for Article 88c GDPR to be adopted before reviewing their AI projects. Although the proposal is unlikely to reduce compliance obligations, it makes it even more important for organisations to show that their AI projects are properly governed and documented, with specific attention to the additional safeguards for AI-related processing. Organisations should therefore ensure that their LIAs also address the AI-specific safeguards described above. 

Although Article 88c GDPR is still only a legislative proposal, many of these requirements already follow the current GDPR. Organisations can therefore already review their existing LIAs for AI projects and improve them where necessary. 

In addition, organisations can already strengthen their compliance by: 

• identifying AI projects that involve personal data; 

• reviewing and documenting data sources; 

• involving legal, privacy and technical teams early in AI development; 

• strengthening data minimisation, filtering and monitoring processes; and 
• establishing clear procedures for handling objections and other GDPR rights. 

Organisations that review their existing LIAs and strengthen their AI governance now will be better prepared if the proposal is adopted. 

At Considerati, we closely monitor the legislative process and will continue to share updates as the Digital Omnibus package develops. If you would like to discuss how the proposed changes may affect your organisation's AI activities, or the broader implications of the Digital Omnibus, we would be pleased to schedule an introductory meeting.