Why the EU Legislative Process Matters for Your CIPP/E Exam
The European Parliament voted last week to ban nudifier apps and delay several AI Act deadlines. Headlines treated both as done deals. They are not. Neither proposal is law; both require trilogue negotiations between Parliament, the Council and the Commission before anything changes. If you are preparing for the CIPP/E, the EU legislative process is not background knowledge. It is testable material that catches candidates who confuse a Parliament vote with a finished regulation.
A Parliament Vote Is Not a Law
The IAPP’s Body of Knowledge (BoK) for the CIPP/E exam covers the roles and functions of EU institutions under Domain I.B and the legislative framework under Domain I.C. The BoK defines every domain and topic the exam tests. One of the most common errors candidates make is treating a Parliament position as settled law.
The ordinary legislative procedure runs through a defined sequence. Commission proposal, Parliament first reading, Council position, trilogue, final adoption by both co-legislators, publication in the Official Journal, entry into force, then application dates. A Parliament vote is one step in that chain. The AI Act Omnibus illustrates this precisely: Parliament adopted its position on 26 March 2026 with 569 votes in favour. Trilogue negotiations with the Council have not yet started.
What Trilogue Can Change
Trilogue is not a formality. It is the stage where Parliament and Council reconcile their positions, with the Commission mediating. Every element of what Parliament voted can change during these negotiations: scope, definitions, deadlines, exemptions. The nudifier ban could be narrowed, broadened or removed entirely. The high-risk deadline extension could land on different dates.
For exam purposes, the distinction is binary. If a question describes a rule that has passed through trilogue, been adopted and published in the Official Journal, it is applicable law. If any step is missing, it is not.
How the EU Legislative Process Creates Overlapping Obligations
The proposed nudifier ban also illustrates how EU legal frameworks overlap; a topic the CIPP/E exam tests under Domain I.C and Domain III.B. An AI system that generates non-consensual intimate images does not sit neatly under one law.
Under the AI Act, such a system would likely qualify as a prohibited practice once the ban enters into force. Under the GDPR, the same activity engages Article 9 on special category data and Article 17 on the right to erasure. Biometric data used to identify the person and data depicting sexual content both fall within Article 9’s scope. Neither framework displaces the other; both apply simultaneously.
Why the Exam Tests Both Frameworks Together
The CIPP/E exam can present a scenario describing an AI system that processes biometric or intimate-image data and ask which obligations apply. Candidates who identify only the AI Act classification or only the GDPR basis will miss marks. The correct answer requires applying both. Domain I.C expects candidates to understand how the GDPR interacts with other EU legislation.
Compliance Deadlines Shift During the EU Legislative Process
The AI Act originally set 2 August 2026 as the application date for high-risk system obligations. Parliament has now proposed 2 December 2027 for listed high-risk systems and August 2028 for sector-specific safety legislation. The Commission had proposed a different timeline. The Council has its own position. The final dates will emerge from trilogue.
This matters for the exam not because you need to memorise specific dates. You do not. It matters because you need to recognise that deadlines can shift while legislation moves through the legislative process. If a question signals that a regulation is still being negotiated, the answer about what an organisation “must” do changes. A proposed deadline is not an obligation.
The Practical Lesson for CIPP/E Candidates
The EU legislative process is not a procedural footnote. It determines whether a rule is enforceable, whether a deadline is binding and whether a prohibition has legal effect. The CIPP/E exam tests this directly. Know the stages from Commission proposal through to application. Know that a Parliament position requires trilogue before it becomes law. Know that the AI Act and GDPR apply simultaneously, not alternatively.
For a structured approach to these kinds of scenario questions, explore the free CIPP/E study resources at 22academy.com.
