The Digital Omnibus: New Reforms in EU Technology Law

On 19 November, the European Commission published its updated package of reforms to the Union's digital law, the so-called Digital Omnibus (Digital Omnibus), aimed at reforming and easing European regulation in the field of the digital market and networks.

The controversial and heavily criticised proposals include a set of technical amendments to key pieces of legislation (such as the Artificial Intelligence Act and the GDPR), intended to streamline administrative procedures but also potentially weakening the protection of personal data and citizens' fundamental rights.

Among the more substantive changes are the proposed limitation of the powers of national data protection authorities under the GDPR, the introduction of uniform rules for notifying and removing online content under the Digital Services Act, as well as changes to the rules on data access and interoperability between platforms set out in the Digital Markets Act.

This is the first step toward optimising the enforcement of the European rules governing the digital sphere. The immediate goal is to ensure that compliance comes at lower cost, achieves the same objectives, and in itself delivers a competitive advantage to responsible businesses.

AI Act: More Flexible and Delayed Entry into Force of the Rules for High-Risk AI Systems

The European Commission proposes that the obligations for high-risk AI systems apply not on fixed dates, but only once the necessary standards, technical guidelines, and compliance tools have been adopted, with the start date depending on a formal decision by the Commission:

• 6 months for the systems under Article 6(2) and Annex III (but no later than 2 December 2027); and

• 12 months for the systems under Article 6(1) and Annex I (but no later than 2 August 2028),

This would give businesses a realistic amount of time to prepare, without compromising the protection of security and fundamental rights.

This new mechanism, however, raises serious concerns, since between the deadlines originally set in the Regulation (August 2026) and the proposed new dates a legal grey zone could open up, in which the rules are formally in force but the standards and guidelines for applying them are missing - and in the event of any further delay, some of the requirements could even be dropped retroactively, creating a risk of a legal vacuum and even greater uncertainty for business.

The Commission's other proposals include having the Member States, rather than businesses, take the lead in ensuring AI literacy through new training and programmes, while the planned first pan-European regulatory sandbox, alongside national ones, would allow companies - especially SMEs and start-ups - to test their systems under real-world conditions and the supervision of competent authorities.

At the same time, the AI Office will exercise centralised oversight of GPAI models and systems on very large online platforms, ensuring faster checks, uniform enforcement of the rules, and effective penalties for breaches.