Dublin: The Irish presidency of the Council of the European Union circulated its first Digital Omnibus compromise text on 3 September 2026 and put it to member states’ diplomats on 11 September, reopening the questions on pseudonymised data, artificial intelligence training and cookie consent that Cyprus could not settle before the summer. The revised text carries the reference ST 12535/26 and travels with an explanatory note, WK 13065/26, both marked LIMITE and neither published.

Officials examined the paper in the Antici Group’s simplification formation, the preparatory body that has handled the file since the Commission split its digital simplification drive into two halves. The artificial intelligence half is finished. The data half, covering the General Data Protection Regulation, the ePrivacy Directive, NIS2 and DORA, is not.

Ireland’s most visible move concerns cookies. The compromise lifts consent rules for terminal-equipment access out of the GDPR, returns them to the ePrivacy Directive where they started, and adds an exemption for processing that measures contextual advertising.

On identifiability, the presidency has loosened the approach it inherited. Cyprus had abandoned the Commission’s plan to amend the definition of personal data and built a new Article 29a around pseudonymisation instead; Ireland asked capitals in July whether that construction delivers any real legal certainty, and the September text treats pseudonymised data more flexibly.

The artificial intelligence provision is the one industry lawyers will read first. Where the June text relegated the point to a recital, the presidency now proposes that controllers may process personal data in the development and operation of an AI system or model on the basis described in the document itself.

for a legitimate interest of the controller

That phrasing points back to Article 6(1)(f) of the GDPR, and it would give model developers an operative provision rather than interpretive comfort. Data protection authorities have argued through the year that legitimate interest still requires a balancing test, which no compromise text removes.

Four questions remain open across the file:

• the scope of personal data and the fate of Article 29a;
• the legal basis for AI development and operation;
• the definition of scientific research, which the June text tightened around transparency, verifiability and research independence;
• when controllers may refuse or charge for abusive data subject requests.

Cypriot negotiators learned in late June how thin the majority is. The presidency pulled its text out of the Coreper approval process once it became clear that no qualified majority stood behind it, and Ireland declined to carry that draft over.

The Commission proposed the package on 19 November 2025, presenting it as a correction to overlapping obligations rather than a retreat from data protection. Civil society organisations disagreed immediately, and the argument over whether simplification amounts to deregulation has shadowed the file since.

The contrast with the artificial intelligence half is instructive. Parliament and Council struck a provisional deal on that text on 7 May 2026, and the Council gave its final green light on 29 June 2026. It entered into force on 27 July, moving the AI Act’s high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.

No comparable landing zone exists for the data half. The Council has yet to agree a general approach, Parliament has yet to fix a negotiating mandate, and adoption before the end of 2026 looks improbable. The Commission’s published digital omnibus documents set out what it asked for; the Council’s answer is still being drafted behind a LIMITE marking.