The EU Digital Omnibus
On November 19, 2025, the European Commission introduced the Digital Omnibus, a legislative package designed to streamline and modernize the EU’s digital regulatory framework. This initiative amends existing laws such as the GDPR, ePrivacy Directive, Data Act, NIS2, DORA, eIDAS, and the AI Act. The goal is to reduce administrative burdens, enhance competitiveness, and optimize compliance processes across the European Union.
Why It Matters
The Digital Omnibus represents the first major shift in European digital policy since the GDPR in 2019. By simplifying compliance and aligning overlapping regulations, the package aims to reduce bureaucracy by 25–35%, foster innovation, and strengthen Europe’s position in the global digital economy.
Key Legislative Changes
1.AI Act
- Harmonizes technical standards for high-risk AI systems, replacing rigid compliance deadlines in 2026–2027.
- Extends grace periods for legacy AI systems.
- Removes mandatory registration for low-risk AI systems.
- Shifts AI literacy obligations from providers to Member States.
- Establishes a legal basis for using sensitive data to test for bias, with anonymization and opt-out options.
- Introduces an EU-level AI sandbox by 2028.
2.GDPR & ePrivacy
- Redefines personal data as information identifiable through “means reasonably likely to be used,” aligning with the CJEU’s C‑413/23 judgment.
- Expands legitimate interest to include AI training and testing.
- Extends breach notification deadlines from 72 to 96 hours and introduces a unified webform for incident reporting.
- Merges cookie and tracking rules into GDPR, enabling simplified consent, one-click audience measurement, and standardized browser preference signals.
3.Data Act & Economy
- Consolidates the Free Flow of Non-Personal Data, Open Data Directive, and Data Governance Act into a single framework.
- Creates a data help desk and strengthens protections for non-personal data transfers.
- Promotes EU data sovereignty.
4.Cybersecurity Reporting
- Launches a single EU portal for reporting cyber incidents under NIS2, GDPR, DORA, and related regulations, managed by ENISA.
- Requires secure infrastructure and full testing before software deployment.
5.European Business Wallet
- Introduces a digital ID wallet for businesses to simplify cross-border registration, licensing, and compliance processes.
Challenges & Criticism
While the Digital Omnibus promises efficiency and competitiveness, it has sparked debate among regulators, NGOs, and academics. Concerns center on potential risks to privacy, consent, and surveillance, highlighting the need for careful implementation and oversight.
Call to Action
To prepare for the Digital Omnibus, organizations should:
- Audit current data and AI practices for compliance gaps.
- Update compliance roadmaps to reflect extended timelines and new exemptions.
- Invest in governance tools that support centralized reporting and AI transparency requirements.
Early preparation will help reduce risk and leverage the competitive advantages offered by streamlined EU processes.
Have any questions about the Digital Omnibus? Our experts at Myna are here to help! Contact us today for additional support and/or further guidance.
