Overview
- The European Commission proposed pushing enforcement of many high‑risk AI obligations from August 2026 to December 2027, covering uses in biometrics, hiring and exams, health, creditworthiness, utilities, traffic and law enforcement.
- Draft GDPR changes would allow firms to train AI models under a "legitimate interest" basis, clarify when anonymized information is no longer personal data, and permit large datasets that may contain sensitive details if identifiers are reasonably removed.
- Cookie consent would be simplified so users can set preferences once—such as a single click lasting six months or via browser or operating‑system settings—with fewer pop‑ups and continued explicit consent before accessing data stored on devices.
- The package includes reduced documentation for small and medium‑sized firms, exemptions from some cloud‑switching rules, and a new European Business Wallet, with Commission estimates of sizable compliance and administrative cost savings.
- The proposals require approval by EU countries and the European Parliament, drawing praise from industry and fierce criticism from 127 civil society groups who call it a rollback of digital rights, as the Commission insists this is simplification, not deregulation.