The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have released a Joint Opinion on the European Commission’s proposal for the so-called ‘Digital Omnibus on AI,’ aimed at simplifying the implementation of certain harmonised rules under the AI Act.

While supporting the objective of easing practical challenges, both bodies stressed that administrative simplification must not come at the cost of fundamental rights protection. The Joint Opinion highlights the complexity of the AI landscape and welcomes efforts to streamline procedures for businesses, particularly SMEs, but cautions that some proposed changes could weaken safeguards for individuals.

“Innovation and efficiency are crucial and can coexist with maintaining accountability of AI providers. We welcome EU-level regulatory sandboxes and simplified procedures to promote innovation and support SMEs in Europe. However, Data Protection Authorities must maintain a central role when it comes to the processing of individuals’ personal data,” said EDPB Chair Anu Talus. She added that cooperation between DPAs, the AI Office, and Market Surveillance Authorities is essential to provide legal certainty while upholding fundamental rights.

European Data Protection Supervisor Wojciech Wiewiórowski echoed these points, noting: “Simplification is welcome when it clarifies obligations, empowers individuals, and strengthens trust. A careful balance needs to be kept by reducing administrative burden where possible, without undermining the protection of fundamental rights. Furthermore, we must ensure that the role of the AI Office is clearly defined and does not affect the independent supervision of EU institutions’ own use of AI systems.”

Key recommendations from the Joint Opinion include specifying that special categories of personal data may only be used for bias detection and correction in limited circumstances where risks are significant. The EDPB and EDPS also advise against removing the registration requirement for high-risk AI systems, warning that it could undermine accountability and incentivize providers to avoid scrutiny.

The opinion welcomes the creation of EU-level AI regulatory sandboxes to foster innovation but calls for the direct involvement of DPAs in supervising data processing within these sandboxes. The EDPB should have an advisory role and observer status at the European Artificial Intelligence Board to ensure consistent oversight. The supervisory role of the AI Office should be clearly delineated, especially regarding general-purpose AI systems, without overlapping with the EDPS’s independent oversight of Union institutions.

The Joint Opinion also recommends clarifying the role of Market Surveillance Authorities as administrative contact points while preserving the independence and powers of DPAs. It stresses that AI providers and deployers must continue to ensure AI literacy among their staff, with any obligations for the Commission or Member States complementing, but not replacing, organisational responsibilities.

Finally, the EDPB and EDPS expressed concern over proposed delays to core obligations for high-risk AI systems. They urge co-legislators to consider maintaining original timelines for key requirements, such as transparency, given the rapid pace of AI development.