On 19 November 2025 the European Commission published the Digital Omnibus — a two-proposal package that amends almost every major EU digital law at once: the AI Act, the GDPR, the ePrivacy Directive, the Data Act, the Data Governance Act, the Open Data Directive, and NIS2. The stated goal is simplification: less administrative overhead, clearer rules, and more room to innovate — without, the Commission says, lowering fundamental-rights standards. Privacy organisations disagree, and the package is working its way through the ordinary legislative procedure now. Nothing here is final law yet — but if you plan compliance work around EU digital rules, this package rewrites your roadmap.
Two Proposals, One Package
The omnibus arrives as two separate legal texts. The first reforms the data and cyber acquis: GDPR, ePrivacy, the Data Act, the Data Governance Act, the Open Data Directive, the Free Flow of Non-Personal Data Regulation, the platform-to-business (P2B) Regulation, and NIS2. The second is a targeted amendment of the AI Act — the "stop the clock" piece that delays the high-risk regime. They travel through Parliament and Council separately, so their final shape and timing may diverge.
The AI Act "Stop the Clock"
The headline change pushes back the high-risk obligations that were due to apply in August 2026 and August 2027. Under the proposal, providers and deployers of high-risk AI systems would not have to comply until six to twelve months after the supporting standards and tools are available — with hard backstop dates of 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products under Annex I. Until the omnibus is adopted, the original deadlines remain the law — treat the delay as a proposal, not a reprieve. Other AI Act changes:
- Centralised oversight — AI systems built on general-purpose AI models, and AI embedded in very large online platforms or search engines, fall to the EU AI Office rather than national market-surveillance authorities.
- Watermarking grace period — the Article 50 transparency/marking duty for AI systems placed on the market before 2 August 2026 extends to 2 February 2027.
- AI literacy — the obligation (live since February 2025) shifts from individual organisations to the Commission and member states.
- Registration relief — systems in Annex III that the provider assesses as not high-risk under the Article 6(3) filter escape EU database registration.
- SME relief extended to small mid-caps, and broader scope for real-world testing and regulatory sandboxes.
For the obligations already in force — transparency duties, deployer obligations, the GPAI regime — see our EU AI Act compliance guide. Nothing in the omnibus removes those.
The GDPR Rewrites
The data-side proposal makes the most consequential GDPR amendments since 2018 — mostly clarifications of contested points rather than deregulation, but several move real workloads:
- Personal data redefined — codifying CJEU case law, data is personal relative to an entity only when that entity has means reasonably likely to identify the person. Pseudonymised data shared onward may cease to be personal data for recipients who cannot re-identify it — with the Commission empowered to specify the criteria.
- AI training lawful basis — legitimate interest becomes an explicit basis for processing personal data to develop and operate AI systems, subject to an unconditional opt-out and safeguards.
- Special-category conditions — new permissions for processing sensitive data in AI development/operation (with safeguards) and for biometric verification under the user's sole control.
- DSAR abuse — controllers may refuse access requests or charge a reasonable fee where the data subject exercises rights for purposes other than data protection.
- Breach reporting — only breaches posing a high risk go to the DPA (up from "unlikely to result in risk"), the deadline stretches from 72 to 96 hours, and reports route through the new single incident platform.
- Privacy notices — narrow relief where the individual already knows the controller's identity, purposes, and lawful basis.
- Automated decisions — Article 22 relaxes where an automated decision is necessary for a contract, regardless of whether it could be made by other means.
- DPIAs — the EDPB will publish harmonised required/not-required processing lists plus a common template and methodology.
- Records of processing — a companion proposal raises the Article 30 exemption threshold from 250 to 750 employees for non-high-risk processing.
Cookies Move Into the GDPR
The long-stalled ePrivacy reform effectively gets absorbed: the consent rules for cookies and similar technologies move into the GDPR itself. To attack "consent fatigue", the proposal exempts processing for aggregated audience measurement and security purposes from consent; requires online interfaces to support automated, machine-readable consent and objection (browser-level preferences); and bars re-asking a refusing user for the same purpose for at least six months. One caveat lawyers have already flagged: the GDPR basis only covers personal data, while ePrivacy's device-access rule is broader — non-personal tracking technology sits in a grey zone the final text will need to resolve.
One Data Act, One Reporting Platform
On the data-economy side, the proposal consolidates the acquis into a single Data Act: the Data Governance Act is repealed and its useful parts folded in, along with the Open Data Directive and the Free Flow of Non-Personal Data Regulation. The P2B Regulation is repealed as redundant with the DSA. Substantive changes include protection for trade secrets where disclosure risks unlawful transfer to weaker-protection third countries, and cloud-switching exemptions for custom-made services and SME/small-mid-cap providers on contracts concluded by 12 September 2025 — a relief SaaS providers had been lobbying for. Model contractual terms for data access and standard contractual clauses for cloud contracts come along as compliance aids.
For security teams the sleeper item is the single incident-reporting platform: one entry point for notifications under GDPR, NIS2, DORA, and the Critical Entities Resilience Directive. Today a serious incident can trigger parallel reports to a DPA, a CSIRT, a financial supervisor, and ENISA on different clocks — one submission that fans out to the right authorities removes a real operational burden. Our NIS2 guide covers the reporting duties the platform will unify.
Where It Stands — and What to Do Now
Both proposals are in the ordinary legislative procedure: Parliament and Council are negotiating their positions through 2026, with adoption realistically in 2027 and the AI Act timing provisions the most contested piece. Practical posture: don't bank on the delay. Annex III obligations are live since August 2026 until the text says otherwise — the cost of over-preparing is a quarter of documentation work, the cost of under-preparing is market access. Use the breathing room, if it comes, to align your AI management system and Article 17 QMS evidence rather than to defer it. For help scoping what the omnibus changes in your compliance stack, request a quote.
Frequently Asked Questions
Is the Digital Omnibus law yet?
No. It is a Commission proposal of 19 November 2025 now going through Parliament and Council. Until adopted and published, the existing rules — including the AI Act deadlines that already applied from August 2026 — remain in force.
Does the AI Act delay mean we can pause compliance work?
Only if the text is adopted — and even then the delay covers the high-risk regime, not the transparency, deployer, or GPAI obligations already in force. Pausing is a bet on the legislative calendar; aligning your QMS and documentation now works under either outcome.
Do we still need a cookie banner?
Yes, until the amended text passes. If adopted, consent would no longer be required for aggregated audience measurement and security uses, refusing users can't be re-asked for six months, and interfaces must honour machine-readable consent signals — which will change how banners are implemented, not just whether they exist.
Does the GDPR breach deadline really move to 96 hours?
That's the proposal: only breaches posing a high risk to individuals would be reported to the DPA, within 96 hours, via the new single incident-reporting platform that also covers NIS2, DORA, and CER. It is one of the more contested provisions, so watch the trilogue.
What happens to the ePrivacy Directive?
Its cookie consent rules move into the GDPR, replacing the banner regime with a narrower, machine-readable consent model. The rest of ePrivacy — device-level confidentiality rules beyond personal data — remains, which is why the final text's boundary-drawing matters.
