EU Digital Omnibus Changes to AI Act: Force New Biometric Rules

The European Commission dropped its Digital Omnibus package on February 26, 2025, and most US investigators probably didn't notice. They should have. Because buried inside those proposed revisions to GDPR and the AI Act is something that will eventually land on an American lawyer's desk, in the form of a motion to suppress biometric evidence.

This isn't a distant regulatory scenario to file under "things to worry about later." Inside Privacy reports that the Commission's proposals introduce new Article 9 exceptions specifically permitting biometric processing for identity confirmation, but only where the biometric data or means of verification remain under the sole control of the data subject. That phrase, sole control of the data subjectis the one that should be keeping investigators up at night. Because it directly implies that whoever processes biometric data in an investigation needs to document exactly how templates are handled, stored, and deleted. Not approximately. Not vaguely. Exactly.

How EU Biometric Standards Reshape Evidence Rules

Artificial Intelligence Rules Enter the Evidence Chain

Artificial intelligence tools used for facial comparison don't sit outside this debate, they sit at the center of it. The AI Act and the Digital Omnibus are being negotiated together, which means any deferral of AI Act obligations directly changes what investigators must document about their AI-driven biometric workflows. An investigator using an AI-powered matching tool needs to track both the GDPR biometric rules and the AI Act's compliance obligations, because the two are becoming legally intertwined rather than separate tracks.

Extended Timelines for High-Risk AI Compliance Obligations Postponed

Reporting on the omnibus process has made clear that some high-risk AI compliance obligations postponed under the original AI Act schedule are being pushed back further as part of the broader deferral effort. Extended timelines give companies more room to build documentation systems before enforcement begins, but they don't erase the underlying requirement, they just move the deadline. Investigators who treat a deferral as permission to wait are misreading what a postponed compliance deadline actually means in practice.

For years, the dominant legal question around facial recognition in investigations was accuracy. Did the system make a false match? Was the identification reliable? Those questions aren't going away, but they're about to share the stage with something procedural and, frankly, more dangerous for underprepared investigators.

The new framework being built through the Digital Omnibus treats biometric templates as a class of data that demands documented process controls from the moment of collection to the moment of deletion. That means retention limits. Bias detection mechanisms. Records of who accessed template data and when. The AI development derogations in the proposed package explicitly require what the Commission describes as advanced measures to prevent unnecessary collection, minimize processing, identify and remove special category data, and prevent disclosure to third parties.

Read that list slowly. Now ask yourself whether your current facial comparison workflow, whatever tool you're using, however you're storing images, wherever your match reports live, satisfies every item on it. If the answer is anything less than an immediate yes, you have a problem that's coming for you faster than you think. This article is part of a series, start with Stress Test Facial Comparison Method Against Deepf.

The legislative timeline matters here. Kennedys Law LLP notes that both Omnibus proposals remain subject to the trilogue process requiring approval from the European Parliament and Council, with adoption likely by mid-2026. That's not a long runway. And the proposals, even if softened in negotiation, will land. The regulatory direction is fixed. The specific article numbers might shift. The underlying demand, prove how your biometric tool works, not just that it worked, will not.

Why the Digital Omnibus Matters to US Investigators

Companies Face a Global Compliance Reality

Companies operating across borders don't get to pick which regulatory regime applies to them once evidence crosses a border. A global investigations firm serving clients in both the EU and the US inherits the stricter standard by default, because opposing counsel in any jurisdiction can point to the EU digital omnibus changes to AI Act as the emerging benchmark. That dynamic already forces companies to plan for compliance obligations they technically haven't triggered yet.

Here's the part where people tend to tune out. "We're not in the EU. GDPR doesn't apply to us." Fair enough, until it does, indirectly, through exactly the mechanisms that have always carried EU standards into US practice: defense counsel, cross-border evidence chains, and the RFP process.

Enforcement is already sending signals that the market is reading correctly. Biometric Update reports that Spain's data protection authority fined a biometric identity provider $1.1 million for biometric data handling violations, not for false matches, not for inaccurate results, but for the way the data was handled. The Mercadona supermarket chain faced similar enforcement for failing to meet Article 9 requirements and basic privacy-by-design principles. These aren't fines for getting the wrong answer. They're fines for not being able to show your work.

That distinction is everything. When a Spanish regulator fines a company for how it processed biometric data, defense attorneys everywhere take note. When a settlement forces a major AI company to comply with Illinois's Biometric Information Privacy Act, as the ACLU of Illinois documentedUS courts confirm that they're willing to impose procedural biometric standards as legal requirements, not just best practices. The EU framework and the US litigation explosion are converging on the same destination from different directions.

"The European Data Protection Board and European Data Protection Supervisor welcomed the proposed derogation to process special categories of data for biometric authentication where verification means are under the individual's sole control." European Data Protection Board & EDPS joint opinion, as reported by Inside Privacy

That joint welcome from two of Europe's most powerful data protection bodies signals regulatory consensus. They're not debating whether biometric template controls should be mandatory. They're debating the exact contours of how mandatory they should be. That debate ends, and then the standard becomes the floor, globally, because global business and global legal practice don't respect jurisdictional convenience. Previously in this series: Biometric Privacy Law Splits Investigative Tools C.

What "EU-Grade" Biometric Standards Mean for Workflows

Let's get specific, because "EU-grade biometric standards" is the kind of phrase that sounds important without meaning anything until you break it down. In practice, it means three things that investigators need to be able to demonstrate on demand.

This is where platforms that were built with these controls already embedded, on-device template handling, documented retention policies, bias mitigation built into the comparison process, have a structural advantage that's about to become commercially decisive. Understanding how biometric facial recognition tools differ in their data architecture isn't just technical due diligence anymore. It's the difference between evidence that holds and evidence that gets challenged before trial.

The BIPA litigation wave in the US has already conditioned courts to think about biometric data as categorically different from other digital evidence. Jackson Lewis has tracked the explosion in BIPA litigation, and the pattern is consistent: companies that couldn't document how they handled biometric data lost. The EU framework formalizes that expectation into a global standard. US courts are already there in practice. The regulatory paperwork is just catching up.

The 24-Month Window, and Why Waiting Is the Worst Strategy

Nobody in a small investigations firm wants to rebuild their workflow before they have to. That's completely understandable, and also exactly the kind of reasonable-sounding procrastination that ends careers. The Digital Omnibus moves to adoption by mid-2026. EU member states will begin enforcement pressure through their national data protection authorities immediately. Defense counsel in high-stakes cases will start citing EU Article 9 standards in US discovery motions within months of that. Then it's in case law. Then it's in RFP boilerplate from corporate clients. Then it's expected.

Law.com notes that emerging technologies are already shifting the terrain of biometric privacy litigation, and expert commentary consistently points to procedural compliance as the new battleground. The accuracy question is largely settled. The process question is just beginning. Up next: Blurring Name Does Not Anonymise Face Gdpr Pseudon.

Meanwhile, Financier Worldwide's analysis of GDPR enforcement makes clear that EU regulators are actively using enforcement actions to shape AI governance norms, not just to punish individual violations but to establish behavioral expectations across the industry. That's a different kind of regulatory pressure. It's designed to export standards, not just punish non-compliance within borders.

The investigators who will be caught flat-footed aren't the careless ones. They're the competent ones who got good results, trusted their tools, and never thought to ask what happened to the biometric data after the case closed. In 24 months, that gap in their documentation will be the only thing opposing counsel needs.

So here's the question worth sitting with tonight: if a judge asked you tomorrow to produce a complete audit trail of how your last facial comparison case handled biometric template data, creation, storage, access logs, deletion, how many hours would it take you to realize you simply don't have it?

The EU digital omnibus changes to AI Act proposal is not a single edit, it's a package of amendments touching several parts of the AI Act at once. The omnibus proposal covers the AI Act's high-risk obligations, the GDPR biometric exceptions discussed above, and related digital rules, and treats them as one coordinated reform rather than isolated fixes. That matters for investigators because a change to one piece, say, a compliance deadline, can shift how the others get interpreted and enforced.

One of the proposed amendments would give companies more time before certain high-risk obligations take full legal effect. Reporting describes this as a targeted simplification meant to ease the transition burden on companies building or deploying high-risk systems, rather than a rollback of the underlying requirements. The AI Act's high-risk obligations around documentation, bias testing, and human oversight remain the eventual destination, the omnibus just changes how fast companies have to get there.

It helps to separate two different things that get talked about together: the compliance deadline itself, and the substance of the obligation tied to that deadline. Extended timelines change the first without touching the second. An investigator relying on AI-assisted biometric tools should assume the substantive bar, proving how the tool handles data, is not going anywhere, even while the calendar date for full enforcement moves.

The AI omnibus enters the legislative process at the same time as the GDPR-focused Digital Omnibus, and the two tracks are being negotiated in parallel by the same institutions. That timing is not a coincidence. Regulators drafting biometric data rules under GDPR are working alongside the teams handling amends the ai act provisions, which is part of why the two frameworks are converging on similar documentation demands.

For US-based investigation firms with any EU-facing casework, the practical takeaway is straightforward. Track the AI Act implementation calendar the same way you track the Digital Omnibus trilogue timeline, because a deferral on one side can still leave you facing an active compliance deadline on the other. Firms that build documentation habits now, regardless of which specific deadline applies first, won't need to scramble when either force takes full legal effect.