EDPB and EDPS Joint Opinion on EU AI Act Implementation
On January 21, 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) issued a Joint Opinion in response to the European Commission’s Proposal for the ‘Digital Omnibus on AI’. This proposal aims to facilitate the effective application of harmonized rules under the EU AI Act by streamlining administrative processes for organizations deploying artificial intelligence (“AI”) systems across the EU.
Support for Administrative Simplification
The Joint Opinion reflects broad support for the European Commission’s efforts to address practical challenges organizations face under the AI Act. However, the EDPB and EDPS emphasize that any administrative simplification must not compromise fundamental rights protections.
Key Recommendations
In the Joint Opinion, the EDPB and EDPS highlighted several specific concerns regarding the Proposal and made various recommendations:
- Processing Special Categories of Data: The proposed extension allowing providers and deployers of AI systems to process sensitive personal data (e.g., ethnicity or health information) for bias detection and correction should be limited to situations where the risk of harm from bias is serious and appropriate safeguards are in place.
- Registration of High-Risk AI Systems: The removal of the obligation to register AI systems, even if claimed to be ‘non-high risk’, is discouraged. The EDPB and EDPS warn that this could reduce accountability and lead organizations to classify systems as lower risk to avoid public scrutiny.
- Supervision of Regulatory Sandboxes: While regulatory sandboxes to promote innovation are welcomed, the EDPB and EDPS recommend that competent Data Protection Authorities be directly involved in the supervision and enforcement of data processing within these sandboxes. They also suggest amending the AI Act to grant the EDPB an advisory role on the European Artificial Intelligence Board.
- Role of the AI Office: The responsibilities of the AI Office in supervising AI systems, especially those based on general-purpose models, must be clearly defined and should not overlap with the independent oversight of AI systems used by EU institutions, which is the responsibility of the EDPS.
- Market Surveillance Authorities’ Role: The function of Market Surveillance Authorities should be clarified as administrative points of contact, ensuring their roles do not impact the independence or powers of Data Protection Authorities.
- AI Literacy Responsibilities: Providers and deployers of AI must ensure their staff possess adequate AI literacy. Any new obligations placed on the European Commission or Member States to foster AI literacy should support, not replace, these responsibilities.
- Postponement of High-Risk AI Provisions: The Joint Opinion expresses concern regarding proposed delays in implementing essential requirements for high-risk AI systems. The EDPB and EDPS urge lawmakers to minimize these delays, especially for critical obligations like transparency requirements, given the rapid pace of AI development.
For further details, you can read the press release here and the full Joint Opinion here.
