Sensitive Personal Data in AI Systems: The EU’s New Rules

On 19 November 2025, the European Commission introduced the Digital Omnibus package to simplify and update EU digital laws, including the AI Act. A key change is the introduction of Article 4a, which states:

Article 4a – Processing of Special Categories of Personal Data for Bias Detection and Correction

“Providers and deployers of AI systems may process special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679, solely for the purpose of detecting, monitoring, and correcting bias in AI systems, provided that:

(a) such processing is strictly necessary and proportionate;
(b) appropriate technical and organisational measures are implemented to safeguard the rights and freedoms of individuals;

(c) data is deleted or anonymised immediately after the bias detection and correction process;

(d) processing is documented and subject to oversight by competent authorities.”

This means that, as an exception to the prohibition in Article 9(1) GDPR, providers and deployers of AI systems may process special categories of personal data -including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data on sex life or sexual orientation-, for the sole purpose of detecting, monitoring, and correcting bias in AI systems.

What do you think about this new approach?

#AIRegulation #GDPR #DigitalOmnibus #AICompliance #EUAIAct #DataProtection #RuneLexAIRegulationExperts

Image by Vecteezy