On November 19, 2025, the European Commission unveiled the Digital Omnibus package, a comprehensive effort designed to simplify and harmonise EU regulations spanning cybersecurity, data management, artificial intelligence (AI), and digital business facilitation. This initiative aims to alleviate administrative burdens that weigh on businesses while fostering competitive opportunities within the European digital economy. The package encompasses several components, including new rules on cybersecurity incident reporting, amendments to data protection frameworks, adjustments to AI regulations, a proposal for a European Business Wallet, and a Data Union Strategy. These proposals are currently under deliberation by the European Parliament and the Council, with hopes for adoption in the near future.
At the core of the package is the ambition to streamline regulatory complexities that have previously hindered innovation and operational efficiency. The Commission has also launched a consultation, the Digital Fitness Check, open until March 11, 2026, to evaluate how current digital regulations interact and impact business competitiveness. This assessment is anticipated to pave the way for further simplification measures by early 2027, reinforcing a regulatory environment more conducive to growth and technological advancement.
A significant pillar of the Digital Omnibus involves reforming cybersecurity incident reporting. The proposal stipulates that notifications under multiple legal frameworks, such as NIS2, GDPR, DORA, and CER, be submitted via a single EU-wide platform maintained by the European Union Agency for Cybersecurity (ENISA). This platform intends to serve as a centralised entry point to streamline communications with national authorities. However, the European Commission's projection of eight full-time employees (FTEs) to manage this platform at ENISA is widely regarded as insufficient, given the extensive scope covering 27 member states, 24 official languages, numerous sectors, and varied incident types. Consequently, ENISA's role may be primarily limited to platform maintenance and providing access support, while national bodies take responsibility for incident handling. The success of this single-entry system hinges on close cooperation among stakeholders to define notification standards, ensure high availability, and maintain confidentiality.
Regarding data regulation, the package proposes consolidating most rules into two principal legal instruments: the Data Act and the General Data Protection Regulation (GDPR). It recommends repealing several laws, including the Free Flow of Non-personal Data Regulation, the Platform-to-Business Regulation, the Data Governance Act, and the Public Sector Information Directive. The proposal also aims to ease cookie consent fatigue through simplified requirements and whitelist of benign purposes, and to permit more flexibility in processing data for AI training under GDPR’s legitimate interest clause. Yet, it notably stops short of repealing the ePrivacy Directive, which continues to impose overlapping and often fragmented rules on telecom providers alongside the GDPR. Industry commentators and experts argue that fully repealing ePrivacy and integrating its essential provisions into broader laws would better serve the objective of regulatory clarity and effectiveness.
The Digital Omnibus introduces targeted amendments to the AI Act to address identified implementation challenges. Most prominently, it delays the application of high-risk AI system regulations, previously scheduled for August 2026, by up to 16 months, moving the enforcement deadline to December 2027. This delay responds to pressure from major technology firms and reflects the Commission’s recognition that critical AI standards and guidelines are still under development. Other changes include an extended transitional period for transparency obligations related to synthetic content, enhanced powers for the AI Office overseeing large AI systems, expanded regulatory sandboxes, and eased compliance for small and mid-sized companies. The package also permits, under strictly controlled conditions, the use of sensitive personal data in AI system bias detection and correction, amending GDPR accordingly. While these adjustments are welcomed as steps toward a more workable AI regulatory framework, concerns remain about persistent overlaps with other directives and the unresolved complications arising from the ePrivacy Directive's continued application.
The package represents the Commission’s most ambitious digital regulatory simplification attempt to date, issuing over 1,200 pages of regulations and guidance across more than nine web platforms within a single week. Industry leaders, such as VDA President Hildegard Müller, have lauded the initiative as a move towards a more innovation-friendly and streamlined regulatory environment, while urging swift legislative negotiations to ensure timely business benefits. Yet significant hurdles remain, including the challenge of securing European Parliament and Council approval by August 2026 and ensuring the practical implementation of simplification measures.
Ultimately, the Digital Omnibus package signals a crucial step towards addressing the EU’s digital regulatory complexity. However, observers stress that true simplification requires bolder action, particularly in resolving the outdated and overlapping provisions of the ePrivacy Directive and integrating national legislations coherently with EU-level directives. Achieving genuine regulatory clarity and reducing administrative duplication will be vital to fostering innovation, enhancing competitiveness, and enabling sustainable growth in Europe’s digital landscape.
📌 Reference Map:
- [1] (Telefonica) - Paragraphs 1, 3, 4, 5, 6, 7, 8
- [2] (Telefonica) - Paragraph 1
- [3] (Council of the European Union) - Paragraph 7
- [4] (Reuters) - Paragraph 5
- [5] (Reuters) - Paragraph 5
- [6] (Digital Policy Alert) - Paragraph 1
- [7] (VDA) - Paragraph 7
Source: Noah Wire Services