Overview
- High‑risk AI obligations move roughly 16 months to December 2027 from August 2026, covering uses in biometrics, hiring, credit, health services, exams, utilities, transport and law enforcement.
- The proposal clarifies when data is considered non‑personal and expands a legitimate‑interest basis so companies can train AI on large datasets, including those containing sensitive information if identifiers are reasonably removed.
- Cookie consent would be streamlined so users can set preferences once via a single click lasting six months or through browser and operating system settings, reducing repeat pop‑ups.
- Small firms would face lighter documentation for AI compliance and could save significant costs, with measures such as exemptions from some cloud‑switching rules and a new cross‑EU 'European Business Wallet' for digital filings.
- Industry and U.S. pressure were cited in coverage as drivers for the shift, while 127 civil groups condemned the plan as a major rollback of digital rights; the Commission insists privacy safeguards remain intact.