GDPR and AI Act news October 2026: Digital Omnibus, EN 18286 standard, CNIL and EDPB
The GDPR and AI Act news for October 2026 covers four topics: the EU Council's position on the Digital Omnibus, the harmonized standard EN 18286:2026, professional emails reconstructed according to the CNIL, and smart glasses according to the EDPB. No changes to the data protection component of the Digital Omnibus are applicable at this stage.
The essentials
- TheCouncil of the European Union adopted its October 21, 2026 position on the data protection component of the Digital Omnibus: it retains the current definition of personal data and certain protections regarding automated decision-making
- No changes resulting from the data protection component of the Digital Omnibus should be considered applicable at this stage: the text must still be negotiated with the European Parliament
- The European Commission published on October 14, 2026 the reference for the EN 18286:2026 standard, the first harmonized standard under the AI Act, intended for providers of high-risk AI systems and voluntary application
- TheOctober 16, 2026, the CNIL clarifies that reconstructing a professional email address may, depending on the circumstances, be based on legitimate interest, although this legal basis is not automatically granted
- TheOctober 13, 2026, the statement from the EDPB on smart glasses draws attention to the challenges of transparencyandcontrol over processing
Four insights on GDPR, privacy, and the AI Act for DPOs (Data Protection Officers), legal professionals, and compliance managers.
What does the Council of the EU's position on the Digital Omnibus change?
The position of the Council of the European Union on the Digital Omnibus, adopted on October 21, 2026, notably retains the current definition of personal data and certain protections regarding automated decisions, but no changes to the data protection component are applicable at this stage, as the text must still be negotiated with the European Parliament.
A compromise less permissive than the initial draft
TheDigital Omnibus is a European Union project aimed at simplifying the digital framework. Several proposals initially considered raised concerns about a reduction in the safeguards provided by the GDPR (General Data Protection Regulation).
The position of the Council of the European Union focuses on the data protection component of the Digital Omnibus (GDPR and ePrivacy). Notably, it retains:
- The current definition of personal data
- Certain protections regarding automated decision-making
Safeguards preserved, but debates remain open
GDPR advocates secure major concessions: the position of the Council of the European Union can be seen as a significant concession to data protection advocates. However, this position does not constitute a final victory. Three topics continue to be debated:
- Provisions regarding the reuse of data for artificial intelligence
- Provisions regarding the pseudonymization
- Certain exemptions
What companies need to know about the Digital Omnibus
No changes from the data protection component of the Digital Omnibus should not be considered applicable at this stage. DPOs can map out potentially affected procedures:
- Cookies
- Data breaches
- Legal bases
- Informing individuals
This mapping is carried out while maintaining current requirements.
Our take on the Digital Omnibus
The Digital Omnibus shows that administrative simplification does not necessarily imply a retreat from the fundamental principles of the GDPR. Documented and adaptable governance remains an essential investment. To learn more: the impact of the Digital Omnibus on the GDPR and the AI Act.
Sources and verification regarding the Digital Omnibus
- Council of the European Union, press release of October 21, 2026: https://www.consilium.europa.eu/
- Text and stages of the legislative procedure: https://eur-lex.europa.eu/
What does standard EN 18286:2026, the first harmonized standard of the AI Act, provide for?
The EN 18286:2026 standard, for which the European Commission published the reference on October 14, 2026, is the first harmonized standard developed under the AI Act: aimed at providers of high-risk AI systems, it is designed to facilitate the application of Article 17 of the regulation.
A step toward more operational compliance
The AI Act (the Artificial Intelligence Regulation) requires, in its Article 17, the implementation of a documented quality management system. The EN 18286:2026 standard provides a concrete framework for structuring:
- Governance
- Risk management
- Control procedures
- Monitoring of AI systems throughout their lifecycle
Is the presumption of conformity for standard EN 18286:2026 established?
The presumption of conformity of standard EN 18286:2026 remains uncertain : this is the main legal subtlety of the text.
- Article 40 of the AI Act provides for a presumption of conformity for requirements covered by harmonized standards
- However, the wording of Article 40 refers to Section 2 of Chapter III, whereas Article 17 regarding quality management is located in Section 3
- While European standardization bodies present standard EN 18286:2026 as providing a presumption of conformity, its exact legal basis therefore remains to be clarified
The application of standard EN 18286:2026 remains voluntaryanddoes not exempt providers from complying with the other obligations of the AI Act.
What are the consequences of standard EN 18286:2026 for companies?
Standard EN 18286:2026 constitutes a first concrete framework for:
- Perform gap analyses
- Formalize internal procedures
- Document evidence of compliance
The EN 18286:2026 standard can also help companies using AI solutions to evaluate their suppliers.
Other standards are still expected, particularly regarding data quality, transparency, human oversight, and cybersecurity.
Our take on the AI Act for Adequacy
The AI Act is gradually shifting from a regulatory framework to verifiable operational requirements. However, organizations must move forward without waiting for an exhaustive reference framework, by identifying their AI systems, assessing risks, and documenting their compliance.
Sources and verification for the EN 18286:2026 standard
- European Commission, digital strategy: https://digital-strategy.ec.europa.eu/
- Regulation (EU) 2024/1689, particularly Article 17: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Can you reconstruct professional email addresses for B2B prospecting?
Yes, depending on the circumstances : the CNIL clarified on October 16, 2026 that reconstructing a professional email address based on a person's first name, last name, and a company's email format can be based on legitimate interest, though this legal basis is not automatically granted.
A common practice, but not without obligations
Reconstructing a professional address based on a person's first name, last name, and a company's email format can constitute personal data processing. The practice is common, but it is not free from obligations.
Context and reasonable expectations matter
To evaluate the reconstruction of a professional email address, four elements must be examined:
- The commercial purpose
- Source of the information
- Reasonable expectations of the individual
- Safeguards in place
Publicly accessible information is not necessarily free to reuse. The right to object and the information obligations remain central.
A practical case: importing reconstructed addresses into a CRM
A SaaS company importing addresses reconstructed by a service provider into its CRM must:
- Examine the sources
- Document its legal basis
- Organize how individuals are informed
- Prevent further solicitations after an objection
Our interpretation of the CNIL's position on B2B prospecting
The CNIL does not prohibit B2B prospecting in principle: it requires a proportionate and transparent justification. Marketing team compliance is built from the moment of collection, not just when sending campaigns.
Sources and verification for reconstructed professional emails
- CNIL, publications and news: https://www.cnil.fr/fr/actualite
- GDPR, articles 6, 14 and 21: https://eur-lex.europa.eu/eli/reg/2016/679/oj
What risks do smart glasses pose according to the EDPB?
Smart glasses equipped with cameras, microphones, and sometimes artificial intelligence features can record people who are unaware that they are being filmed or listened to : the statement from October 13, 2026 by the European Data Protection Board (EDPB) draws attention to the challenges of transparency and control regarding this data processing.
Increasingly discreet data collection
Data collection via smart glasses is becoming increasingly discreet, raising concerns for the EDPB regarding invisible surveillance : the people being recorded may not know they are being filmed or listened to.
Innovation does not erase responsibilities
Themanufacturers and service providers of smart glasses must examine their own GDPR obligations.
- Recording notification systems can contribute to transparency, but are not sufficient on their own to guarantee the lawfulness of processing
- Thebiometric and automated analysis functions can raise additional risks
A practical case: technicians equipped for remote assistance
A company that equips technicians with smart glasses for remote assistance must define the following for clients and employees who may be recorded:
- The purposes
- Access rights
- The retention period
- The safeguards
A data protection impact assessment (DPIA) may be required depending on the risks.
Our perspective on the subject of smart glasses
The issue goes beyond smart glasses: as smart objects make data collection less visible, privacy by design becomes an essential condition for responsible deployment.
Sources and verification regarding smart glasses
- European Data Protection Board: https://www.edpb.europa.eu/
- GDPR, Articles 5, 25, and 35: https://eur-lex.europa.eu/eli/reg/2016/679/oj
What are the key takeaways from the October 2026 GDPR and AI Act news?
The October 2026 GDPR and AI Act updates require different actions depending on the specific regulations: maintain current GDPR requirements in light of the Digital Omnibus, use the EN 18286:2026 standard as a reference framework,justify B2B prospecting from the point of collectionandestablish a framework for any deployment of smart glasses.
Digital Omnibus: Council of the EU position
- Date: October 21, 2026
- Scope: European Union
- Topic: GDPR and ePrivacy
- Action: map potentially affected procedures (cookies, data breaches, legal bases, informing individuals) while maintaining current requirements
Standard EN 18286:2026
- Date: October 14, 2026
- Scope: European Union
- Topic: AI Act and AI governance
- Action: conduct gap analyses, formalize internal procedures, and document evidence of compliance
Reconstructed professional emails: CNIL
- Date: October 16, 2026
- Scope: France
- Topic: GDPR and marketing
- Action: review sources, document the legal basis, organize how individuals are informed, and prevent further solicitations after an objection
Smart glasses: EDPS statement
- Date: October 13, 2026
- Scope: Europe
- Topic: Privacy by design and AI
- Action: define purposes, access, retention periods, and safeguards; a DPIA may be required depending on the risks
October 2026 GDPR and AI Act news at a glance
To catch up on regulatory monitoring: August 2026 GDPR and AI Act news.
Adequacy, a French SaaS provider of GDPR and AI Act compliance software, shows how the solution adapts to your day-to-day reality: request an Adequacy demo.
FAQ - GDPR and AI Act News October 2026
Does the Digital Omnibus already amend the GDPR?
No, the data protection component of the Digital Omnibus does not amend the GDPR at this stage: no changes should be considered applicable. The Council of the European Union adopted its position on October 21, 2026, but the text must still be negotiated with the European Parliament. DPOs can map potentially affected procedures while maintaining current requirements.
Is the EN 18286:2026 standard mandatory for high-risk AI providers?
No, the application of the EN 18286:2026 standard remains voluntary and does not exempt providers from complying with other AI Act obligations. This first harmonized standard, for which the European Commission published the reference on October 14, 2026, aims to facilitate the implementation of Article 17, which requires a documented quality management system.
Does the EN 18286:2026 standard provide a presumption of conformity?
Thethe legal basis for this presumption of conformity remains to be clarified. Article 40 of the AI Act provides for a presumption for requirements covered by harmonized standards, but it refers to Section 2 of Chapter III, whereas Article 17 regarding quality management is in Section 3. Nevertheless, European standardization bodies present the standard as granting this presumption.
Can reconstructed professional email addresses be used for B2B prospecting?
Yes, depending on the circumstances : according to the CNIL, the reconstruction of a professional email address can be based on legitimate interest, though this legal basis is not automatically granted. One must examine the commercial purpose, the source of the information, the reasonable expectations of the individual, and the safeguards in place, while respecting the right to object and information obligations.
Is a DPIA necessary when equipping employees with smart glasses?
A DPIA may be required depending on the risks. A company that equips technicians with smart glasses for remote assistance must define the purposes, access rights, retention periods, and safeguards for customers and employees who may be recorded. Biometric and automated analysis functions can raise additional risks.
Is a recording indicator enough to make smart glasses lawful?
No, a device that signals recordings is not enough on its own to ensure the lawfulness of processing, even if it can contribute to transparency. Manufacturers and service providers of smart glasses must also examine their own GDPR obligations, and biometric and automated analysis functions can raise additional risks.
