European Union: European Commission announced Proposal for Digital Omnibus on AI Regulation (2025/0359) including data protection regulation for "high-risk" AI systems

On 19 November 2025, the European Commission announced a Proposal for the Digital Omnibus on AI Regulation (2025/0359), which amends the EU AI Act to include a legal basis for processing special categories of personal data for bias detection and mitigation in a proposed Article 4a. The Proposal would permit providers of high-risk AI systems to process special categories of personal data to the extent necessary to ensure bias detection and correction, subject to safeguards and additional conditions. The conditions include when bias detection cannot reasonably be achieved with other, less intrusive data such as synthetic or anonymised data, the implementation of strict access controls, limits on re-use, a ban on onward disclosure and deletion once the bias is corrected or the retention period ends. The Proposal would also alter the implementation timeline of data governance obligations for high-risk AI systems, calculating implementation periods by reference to the Commission adopting a decision confirming that adequate measures in support of compliance were available. High-risk AI systems classified according to Annex III would be required to comply 6 months after the Commission decision, while high-risk AI systems classified according Article 6(1) would be required to comply 12 months after the Commission decisions. In any case, the provisions would apply at the latest from 2 December 2027 for Annex III high-risk systems, and from 2 August 2028 for Article 6(1) high-risk systems.