The EU has changed how its two biggest digital rulebooks fit together. Regulation (EU) 2026/1744, known as the AI Omnibus, amends the AI Act and shifts where it overlaps with the GDPR. This AI Act GDPR amendments explained guide walks through what the source analysis highlights: a new Article 4a on bias-detection data, fundamental rights impact assessments (FRIAs) that can reuse GDPR data protection impact assessments (DPIAs), softer AI literacy duties, and new supervision arrangements.

The source material is a short summary, so this post sticks to those headline changes and avoids guessing at details it does not spell out. Where the finer print matters, we say so.

What the AI Omnibus changed in the AI Act

According to the summary, Regulation (EU) 2026/1744 "rewired" the overlap between the AI Act and the GDPR. Four changes stand out:

  • Bias-detection data (Art 4a): a new provision addressing the handling of data for detecting bias in AI systems.
  • FRIAs reusing DPIAs: fundamental rights impact assessments can build on the DPIAs organisations already carry out under the GDPR.
  • Softer AI literacy: obligations around AI literacy have been relaxed.
  • New supervision: changes to how oversight is organised.

The broader context is a push to simplify EU digital rules. If you want that wider picture, our explainer on what the EU Digital Omnibus changes for cookies, GDPR and AI covers the simplification package in more depth.

Bias-detection data under Article 4a: what it means for your personal data

Bias testing is a real tension point. To check whether an AI system treats groups unfairly, developers often need data about characteristics such as ethnicity, health or other sensitive attributes. The GDPR places tight limits on processing that kind of data. Article 4a is the AI Act's answer: it allows bias-detection data handling within the AI framework.

For ordinary people, the practical question is whether your data could be used to test an AI system. The summary confirms the provision exists, but it does not set out the safeguards, conditions or limits attached to it. That detail matters. Purpose limitation, data minimisation and security are the kinds of protections to look for in the regulation text and in how organisations describe their practices.

The intent, auditing AI for discrimination, is a legitimate one. The privacy risk lies in whether the permission is narrow and well controlled, or broad and loosely policed. Readers should treat that as an open question until they have seen the operative wording.

How FRIAs and GDPR DPIAs now work together

A DPIA is the GDPR assessment an organisation performs when processing is likely to pose a high risk to people's rights. A FRIA is the AI Act's assessment of how a high-risk AI system could affect fundamental rights. Before the change, an organisation could face two overlapping paperwork exercises.

Under the AI Omnibus, FRIAs can reuse DPIAs. In plain terms, work done for one assessment can feed the other, which should reduce duplication.

There are upsides and caveats:

  • Upside: one well-done assessment can serve both regimes, which may encourage more thorough work rather than box-ticking twice.
  • Caveat: a DPIA focuses on data protection risks. A FRIA is meant to look wider, including discrimination and other rights. Reusing a DPIA only helps if the wider questions are still genuinely asked.

What privacy-conscious users gain and lose

Likely gains

  • Clearer rules for bias testing, which can help catch discriminatory AI before it affects you.
  • Less duplicated assessment work, which may free organisations to focus on quality.
  • Continued GDPR rights. The summary describes an adjusted overlap, not a repeal of the GDPR.

Possible losses or uncertainties

  • A new legal route to handle sensitive data for bias detection, with safeguards that need scrutiny.
  • Softer AI literacy duties, which may mean staff using AI tools get less mandated training.
  • New supervision arrangements, whose effect on enforcement and complaint handling is not detailed in the source.

What This Means For You

Nothing in the summary suggests your core GDPR rights, such as access, deletion and objection, have disappeared. What has changed is the machinery around AI systems: how data may be used to test them, how risk assessments are combined, and who watches over them.

If you interact with AI systems used in hiring, lending, education or public services, the new rules could affect how your data is used for fairness testing and how thoroughly your rights are assessed. The details will depend on the full regulation text and on how national authorities apply it.

Actionable takeaways

  • Read privacy notices for AI language. Look for whether an organisation says it uses personal data to test or improve AI, including bias detection.
  • Ask about assessments. You can ask a company whether it has carried out a DPIA or a FRIA for AI systems that affect you, and how the two relate.
  • Use your GDPR rights. Access, objection and erasure requests remain available.
  • Wait for the details. Treat the headline changes as a starting point and check the regulation text for safeguards on Article 4a.

To keep building context, start with our Digital Omnibus explainer, then review how the organisations holding your data describe their AI and impact assessment practices. With this AI Act GDPR amendments explained, you are better placed to ask the right questions.