After the AI Omnibus: Where the EU AI Act and GDPR Now Meet, Article by Article

The EU AI Act was never meant to replace the GDPR, and the July 2026 amendments make that explicit in the text. What the amendments do change is the plumbing between the two laws: who may process sensitive data to test for bias, how a fundamental rights impact assessment can reuse a data protection impact assessment, how much an employer must do on AI literacy, and which authority supervises which systems. For privacy teams that already run a GDPR program, those connection points are where most AI Act work will actually happen.

This guide walks through the overlaps as they stand after Regulation (EU) 2026/1744, the Digital Omnibus on AI, which was adopted on July 8, 2026, published in the Official Journal on July 24 and entered into force on July 27, 2026. Where the omnibus left a provision alone, we say so. Where an interpretation is ours rather than the legislator’s, we flag it.

The baseline rule: the GDPR still applies in full

The omnibus rewrote Article 2(7) of the AI Act. The new text says that EU law on personal data, privacy and the confidentiality of communications “applies to personal data processed in connection with the rights and obligations laid down in this Regulation,” and that, “without prejudice to Articles 4a and 59,” the AI Act “shall not affect” the GDPR, the EU institutions’ data protection regulation, the ePrivacy Directive or the Law Enforcement Directive.

Two practical consequences follow. An AI system that complies with the AI Act can still breach the GDPR, so the two assessments must both be done. And the only places where the AI Act itself supplies something the GDPR needs are the two articles named in that carve-out: Article 4a on special-category data for bias correction, and Article 59 on further processing in regulatory sandboxes. Everything else runs in parallel.

Five points where the two laws meet

1. Special-category data for bias detection: the new Article 4a

Before the omnibus, Article 10(5) let providers of high-risk AI systems exceptionally process special categories of personal data, such as health, ethnicity or religion, when strictly necessary to detect and correct bias. The omnibus deleted Article 10(5) and moved the rule into a new general provision, Article 4a, with a wider scope.

• Paragraph 1 keeps the original permission for providers of high-risk systems, tied to the data governance duties in Article 10(2)(f) and (g).
• Paragraph 2 extends it to deployers of high-risk systems and to providers and deployers of other AI systems and models, where processing is strictly necessary to address biases likely to affect health and safety, harm fundamental rights or cause prohibited discrimination. The text adds that this paragraph “does not create any obligation to conduct such bias detection and correction.”
• The conditions are cumulative. The bias work must not be achievable with other data, “including synthetic or anonymised data”; the data must be pseudonymised and protected with state-of-the-art security; access must be strictly controlled and documented; the data must not be transmitted to or accessed by other parties; it must be deleted once the bias is corrected or the retention period ends, whichever comes first; and the record of processing activities must explain why special-category data was strictly necessary.

The recitals say the legislator intends this to satisfy the “substantial public interest” condition in Article 9(2)(g) GDPR, and that Article 4a applies from the date the AI Act itself entered into application, so providers can do bias work in preparation for the high-risk obligations. Our reading is that Article 4a lifts the Article 9 prohibition but does not by itself supply an Article 6 lawful basis, so teams should still document one. The condition on the record of processing activities is also worth noticing: the AI Act now tells controllers what to write in a GDPR document. Our guide to GDPR DPIA requirements covers the companion assessment that this kind of processing will usually need.

2. DPIA and FRIA: cross-referencing is now written into the law

Article 27 requires certain deployers of high-risk systems, including public bodies and providers of public services, and deployers of credit-scoring and life and health insurance pricing systems, to carry out a fundamental rights impact assessment (FRIA) before first use. The original text already said that where a DPIA covers some of the same ground, the FRIA “shall complement” it. The omnibus replaced paragraph 4 so that a deployer may now “include cross-references to the relevant sections” of the DPIA or include relevant parts of it directly in the FRIA. The AI Office must also produce a template questionnaire, “including through an automated tool,” that lets deployers do the same.

Separately, Article 26(9), which the omnibus did not change, requires deployers of high-risk systems to use the information providers must supply under Article 13 when carrying out their DPIA. Put together, the intended workflow is clear: provider documentation feeds the DPIA, and the DPIA feeds the FRIA. The two assessments still answer different questions. A DPIA looks at risks to individuals from the processing of personal data. A FRIA looks at risks to fundamental rights from the use of the system, which can include non-discrimination, access to services and due process even when the personal data handling is sound. If you need a starting point, our FRIA example for the EU AI Act shows how the sections line up, and our piece on assessing connectors, permissions and data access explains why the model is rarely the only thing that needs assessing.

3. Automated decisions: Article 22 GDPR and AI Act oversight

The omnibus did not change this overlap, but it remains the one that generates the most confusion. Article 22 GDPR gives individuals the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to exceptions, and requires safeguards including the right to obtain human intervention. The AI Act approaches the same territory from the system side: Article 14 requires high-risk systems to be designed for effective human oversight, and Article 86 gives people affected by certain decisions based on high-risk Annex III systems a right to a clear and meaningful explanation of the role the system played.

The two are not substitutes. A high-risk system can satisfy Article 14 by design and still be deployed in a way that makes decisions “solely” automated in the GDPR sense, for example if reviewers routinely accept the output without real scrutiny. Conversely, a system outside the AI Act’s high-risk list can still trigger Article 22. Treat human oversight as an operational fact to be evidenced, not a design feature to be asserted.

4. Transparency: two notice regimes on different clocks

GDPR Articles 13 and 14 require controllers to explain processing, including meaningful information about the logic involved in automated decision-making covered by Article 22. AI Act Article 50 adds system-level transparency: telling people they are interacting with an AI system, marking synthetic content in machine-readable form, and disclosing deepfakes and certain AI-generated text. Article 50 has applied since August 2, 2026. The omnibus added a transition for generative systems already on the market before that date, which must meet the machine-readable marking duty in Article 50(2) by December 2, 2026.

In practice the privacy notice and the AI disclosure should be drafted together. People reading a chatbot disclosure will reasonably ask what happens to what they type, and the answer belongs in the privacy notice.

5. AI literacy: from “ensure” to “support”

Article 4 originally required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff. The omnibus replaced it. Providers and deployers must now “take measures to support the development of AI literacy” of staff and others operating AI on their behalf, and the text states that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The Commission and member states take on a duty to support companies, including by publishing practical examples. The obligation is lighter, but it has not disappeared, and GDPR training on data minimization and lawful use of personal data in AI tools remains a separate accountability expectation.

Who supervises what after the omnibus

Data protection authorities already had a defined role under the AI Act: for high-risk systems used in areas such as biometrics, law enforcement, migration and the administration of justice, Article 74(8) points to the data protection authority as the market surveillance authority. The omnibus adds several connection points.

• Sandboxes: national authorities must associate data protection authorities with any sandbox where innovative AI systems involve personal data (Article 57(10), as replaced).
• Fundamental rights bodies: authorities enforcing non-discrimination and other fundamental rights law gain a clearer right to request documentation from market surveillance authorities in machine-readable form, and the two must cooperate (Article 77, as amended).
• AI Office: the Commission’s AI Office becomes exclusively competent for AI systems built on a general-purpose model by the same provider, and for AI systems that are or are integrated into very large online platforms or search engines, with powers to request information, inspect premises and fine (new Articles 75a to 75d).

The result is that a single AI deployment involving personal data may now have a data protection authority, a market surveillance authority, a fundamental rights body and, for some systems, the AI Office in the picture. Coordinated, consistent documentation is the only realistic defense against inconsistent questions.

What the omnibus did not change

It did not amend the GDPR. The separate digital omnibus proposal on data protection rules, which we analyzed in our look at the proposed redefinition of personal data, is a different instrument and is not part of Regulation 2026/1744. The AI omnibus also did not remove the high-risk obligations; it moved them. Annex III high-risk rules now apply from December 2, 2027 and rules for AI embedded in regulated products from August 2, 2028. A new prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material applies from December 2, 2026.

A working checklist for privacy teams

1. Add a bias-testing line to your AI inventory: does the team plan to use special-category data, and if so, which Article 4a condition is documented and where?
2. Update your record of processing activities template with a field for the Article 4a(1)(f) justification.
3. Restructure DPIA templates for AI so sections can be cross-referenced from a FRIA without rewriting.
4. For each AI-assisted decision with significant effects, record who reviews outputs, how often they override them and what information they see.
5. Draft AI disclosures and privacy notice updates together, and check generative features against the December 2, 2026 marking deadline.
6. Replace any “AI literacy certification” goal with a documented support program: training, guidance and role-specific examples.

Captain Compliance’s EU AI Act software is designed for this kind of joined-up work: inventorying AI systems, recording role and risk classification, launching FRIA and DPIA workflows, and keeping the supporting evidence in one record. It is updated for the AI omnibus, but software supports the assessment; it does not make the legal call. For a broader view of obligations, see our EU AI Act compliance overview.

Frequently asked questions

Does Article 4a mean we can now collect sensitive data to train better models?

No. Article 4a is limited to what is strictly necessary for bias detection and correction, under cumulative safeguards, with deletion once the bias is corrected. It is not a general training permission, and the data cannot be shared with other parties.

Can one document serve as both our DPIA and our FRIA?

The amended Article 27(4) lets you cross-reference or include DPIA sections in the FRIA, which reduces duplication. But the FRIA must still cover the rights and impacts the AI Act lists, some of which a DPIA does not address. Expect to have two linked documents rather than one.

We only use a vendor’s AI tool. Does any of this apply to us?

Often, yes. Deployers have obligations under Articles 26 and 27 for high-risk systems and under Article 50 for certain transparency duties, and deployers are now expressly covered by Article 4a(2) if they choose to do bias testing. Your GDPR obligations as controller apply regardless of who built the system.

Did the omnibus delay everything?

No. It delayed the high-risk obligations. Prohibitions, general-purpose model rules, Article 50 transparency duties and governance provisions already apply, and a new prohibition starts in December 2026.

Where can I read the official text?

The amending regulation is published on EUR-Lex as Regulation (EU) 2026/1744, and the Commission’s summary of the AI omnibus lists the main changes.

The record that both regulators will read

For years privacy teams were told that the AI Act would sit on top of the GDPR. After the omnibus it is more accurate to say the two are stitched together at specific seams, and that most of the stitches are documents: the record of processing, the DPIA, the FRIA, the oversight log. A company that keeps those documents consistent will be able to answer a data protection authority and an AI regulator with the same file. One that keeps them in separate silos will find out, during its first inquiry, which version each regulator believes.