Le cadre RGPD IA n’a pas encore changé. Le projet d’article 88 bis préciserait que certaines utilisations de données personnelles pour développer ou exploiter une intelligence artificielle peuvent reposer sur l’intérêt légitime, sans consentement systématique. Mais ce fondement resterait soumis à un test strict, au droit d’opposition et à toutes les autres obligations du Règlement général sur la protection des données.
Does the GDPR already authorize legitimate interest for AI?
Legitimate interest is already one of the six legal bases provided for by Article 6 of the GDPR for processing personal data. In 2026, a company can therefore use it for certain artificial intelligence projects, provided that it demonstrates a specific interest, the necessity of the processing, and an acceptable balance with individuals’ rights.
A legal basis is the legal justification authorizing an organization to collect or use personal data. Consent is only one basis among others: the GDPR also provides for a contract, a legal obligation, the protection of vital interests, a task carried out in the public interest, and legitimate interest.
Legitimate interest therefore does not mean “sufficient commercial interest.” According to Opinion 28/2024 of the European Data Protection Board, devoted to AI models, the interest pursued must be lawful, clearly formulated, and genuine. The processing must then be necessary and weighed against individuals’ freedoms, reasonable expectations, and the possible consequences for them.
An internal tool that classifies customer requests does not present the same risks as a system scraping public profiles to automatically evaluate candidates. In the latter case, mass collection, profiling (analysis intended to predict behavior), and the potential impact on access to employment make the justification much more difficult.
What would Article 88 bis change for the GDPR and AI?
The draft Article 88 bis would explicitly confirm that processing personal data for the development or operation of an artificial intelligence system or model may be based on legitimate interest. This clarification would reduce legal uncertainty, but would create neither a new legal basis nor general authorization to train AI with all available data.
The text appears in the ST 14756/26 negotiating mandate adopted by representatives of the Member States on October 21, 2026, as part of the Digital Omnibus. Recital 33a of the Council’s mandate specifies that the mere fact of developing or operating artificial intelligence does not, in itself, constitute a legitimate interest.
The distinction changes a great deal. A company could not enter “AI development” in its records and consider the matter closed. It would have to explain the specific objective: detecting fraud, improving a search function, assisting a customer service department, or securing software, for example.
The proposal would not eliminate the other legal bases either. Performance of a contract may be appropriate for a feature requested by the user; a legal obligation may justify certain checks; consent would still be required when another European or national law imposes it. For use of ChatGPT integrated into the browser for business, the first question therefore remains the nature of the data transmitted and the purpose pursued.
Is the European text already applicable to companies?
Article 88 bis is not applicable as of October 27, 2026. The Council of the European Union has adopted a negotiating position, not a final law. The European Parliament must adopt its own position, after which the two institutions must agree on a common text before its formal adoption, publication, and entry into application.
The Council of the European Union still indicated on October 27, 2026, that negotiations were awaiting the Parliament’s position. Their outcome could retain, modify, or remove certain provisions. Moreover, a political agreement date would not necessarily be the application date: the final text could provide for a transition period.
Le piège, pour un décideur non juriste, consiste à confondre un mandat du Conseil avec une réforme acquise. Une présentation commerciale affirmant que « le consentement n’est plus nécessaire pour l’IA » serait fausse en 2026. Elle resterait trop générale même si l’article 88 bis était adopté dans sa rédaction actuelle.
From an agency’s perspective, the reflex is to frame a project according to the law applicable on the launch date, then plan for monitoring and a review clause. Waiting for a hypothetical simplification can hold up a product for months; anticipating it as though it had already been adopted creates the opposite risk.
How should the legitimate interest of an AI project be justified?
Justifying the legitimate interest of an artificial intelligence project requires a written three-step analysis: define the interest pursued, demonstrate that the processing is necessary, and balance that interest against individuals’ rights. The draft Article 88 bis would maintain this method, along with data minimization, transparency, security, and the controller’s accountability.
Necessity requires looking for a less intrusive option. If a model can operate with anonymized or synthetic data, or data limited to a few fields, collecting users’ complete history becomes difficult to defend. Anonymization must genuinely prevent reidentification; masking a name or replacing an identifier often constitutes mere pseudonymization.
A process that can be used by management, the data protection officer, and the technical team generally follows these steps:
- describe a specific purpose and the lawful interest of the company or a third party;
- inventory the data, their sources, recipients, and retention period;
- check whether another legal basis or a less intrusive method would be more appropriate;
- assess the effects on individuals, their reasonable expectations, and vulnerable populations;
- provide technical and organizational safeguards, understandable information, and an effective objection mechanism;
- retain the decision and review it whenever the model, data, or purpose changes.
In the projects we handle, we often see the same blind spot: the team documents the purchased tool but not the data actually entered by employees. An assistant authorized for generic texts can become risky as soon as someone copies a contract, medical record, or excerpt from the customer file into it. A VPN used with ChatGPT encrypts part of the transmission, but resolves neither the legal basis nor the provider’s reuse of the data.
Which AI projects pose the greatest GDPR risks?
The most difficult GDPR AI projects to base on legitimate interest use sensitive data, information concerning children, mass web collection, or profiling that produces significant effects. The risk also increases when reuse surprises individuals, lacks transparency, or does not allow effective objection.
| Use of AI | Determining factor | Assessment of legitimate interest | Priority measure |
|---|---|---|---|
| Search in an internal document database | Limited professional documents and controlled access | Potentially feasible depending on the purpose and data | Filter documents and log access |
| Customer service assistant | Conversations containing personal data | Possible after an analysis of necessity and balance | Reduce the data sent to the model |
| Automated B2B prospecting | Profiling, third-party sources, and contacts’ expectations | More demanding justification | Inform clearly and allow objections |
| Recruitment or candidate scoring | Significant effect on individuals | High risk; in-depth analysis required | Human oversight and impact assessment |
| Training through large-scale web scraping | Volume, origin, and unexpected reuse | Difficult to defend without strong safeguards | Trace sources and exclude unjustified data |
| Processing health data | Special category under Article 9 | Article 6 alone is not sufficient | Also identify a valid exception under Article 9 |
The Digital Omnibus addresses so-called special categories of data separately, such as health data, political opinions, or biometric data. The Council’s 2026 mandate contemplates a narrowly defined exemption where such data appear incidentally and residually during training, testing, validation, or technical operation.
This exemption would not cover sensitive data deliberately required for the system’s purpose. A medical AI intentionally trained on health records should still fall under a separate Article 9 GDPR exception. Honestly, trying to fit a core business need into the “incidental” category would be a fragile legal strategy.
Security remains independent of the choice of legal basis. The Council’s mandate requires appropriate technical and organizational measures, regardless of the legal basis selected. Access management, encryption, limited retention, and provider monitoring must therefore be addressed, as they are for protecting data entrusted to a processor or the securing artificial intelligence API keys.
What are the consequences for the budget, timelines, and contracts?
Legitimate interest does not eliminate the compliance costs of an artificial intelligence project. It mainly shifts the effort toward documentation, data architecture, informing individuals, and handling objections. The budget and timeline also depend on the volume of data, its sensitivity, the providers involved, and the impact of automated decisions.
A prototype without personal data and a production deployment connected to a CRM are not the same project. The latter requires, at a minimum, mapping data flows, verifying the processor agreement, retention periods, transfers outside the European Economic Area, and the provider’s settings. A data protection impact assessment may also become necessary when the processing presents a high risk.
The right to object under Article 21 of the GDPR must also be taken into account. The Council’s 2026 mandate would retain this ordinary regime rather than the specific and unconditional right to object contemplated in an earlier version. Nevertheless, the company must receive the request, stop the processing when the conditions require it, and be able to locate the data concerned.
The right approach is rarely to choose a legal basis in order to accelerate the launch. With a constrained budget, it is better to reduce data sources and limit the product’s first version than to fund a subsequent overhaul of storage, information, and contracts. The choice of infrastructure, including a GPU server intended for AI, should follow this mapping rather than precede it.
Defining the processing, responsibilities, and data flows before development avoids most unpleasant surprises. An outside perspective can be especially helpful in connecting legal requirements with functional, technical, and contractual choices without turning compliance into a permanent obstacle.
FAQ on the GDPR, AI, and legitimate interest
Is consent required to train an artificial intelligence system?
Consent is not always required to train an artificial intelligence system. In 2026, the data controller must select an appropriate legal basis for the purpose and, where applicable, comply with the additional rules governing sensitive data.
Can a company use its customers’ data in ChatGPT?
Using customer data in ChatGPT depends on the purpose, legal basis, contract with the provider, data transfers, and retention settings. A company should not autorize this practice without mapping the information sent and limiting the data to what is strictly necessary.
Does Article 88 bis abolish the right to object?
The draft Article 88 bis does not eliminate the right to object. The 2026 Council mandate maintains the regime under Article 21 of the GDPR, which requires an analysis of the request and may oblige the controller to stop processing.
Can public data on the internet be freely used by AI?
Publicly accessible personal data remains protected under the GDPR. Collecting it for artificial intelligence requires a legal basis, a specific purpose, appropriate information, and an assessment of the person’s reasonable expectations.
Is the Digital Omnibus a final European law?
The Digital Omnibus is not yet a final law as of October 27, 2026. The mandate adopted by the Council must still be negotiated with the European Parliament before any potential joint text, its final adoption, and publication.