When the European Union’s AI Act came into force in 2024, it was hailed as a global milestone. At the time, AI systems—including chatbots powered by large language models, or LLMs, like ChatGPT—were being deployed far faster than governments could scrutinize them thoroughly. So when the EU drafted the world’s first comprehensive legislative framework for AI, policymakers made it a risk-based model that bans the most dangerous uses outright and subjects high-risk systems to strict checks to protect people’s health, safety and fundamental rights. Coupled with the EU’s Digital Services Act, which subjected large online platforms to strict regulatory oversight, and the older General Data Protection Regulation, or GDPR—long viewed internationally as the gold standard for data privacy—the message was clear: Europe intended to innovate without sacrificing safety.
That foundation is now shifting. Leaked drafts of the European Commission’s “Digital Omnibus” package point to reforms that would dilute some of the very safeguards that have defined the union’s stance toward online and AI platforms. Reports suggest that the commission is considering a “legitimate interest” exemption to the GDPR that would allow companies to use Europeans’ personal data to train AI models. Separately, the same draft outlines a softening of the AI Act’s enforcement, including a proposed one-year grace period before obligations for high-risk systems fully apply.
These are not minor revisions. They cut to the heart of public trust and democratic values in the digital age. The GDPR has set the global benchmark for privacy protections since 2016, influencing similar legislation from Brazil to California. The AI Act, in turn, has been framed as Europe’s defining contribution to global AI governance. If Europe now signals that these protections are negotiable, the consequences will extend far beyond its borders. As civil society organizations have argued, loosening protections at the very moment when demand for training data is surging risks eroding Europe’s credibility in the pioneering sector.