Digital Omnibus: Key Legal Impacts

AI Act

The proposal introduces a lawful basis for processing special-category personal data for bias detection and mitigation in AI systems, subject to strict safeguards aligned with GDPR principles.
Compliance simplifications traditionally reserved for SMEs are extended to small mid-cap companies, and the application of high-risk AI obligations will depend on the availability of harmonised standards and Commission-endorsed support tools.
Mandatory AI literacy requirements for providers and deployers are removed, shifting responsibility to Member States and the Commission to promote skills through guidance.
Transparency obligations move to a voluntary Code of Practice coordinated by the AI Office, with first guidelines expected in 2026.

Data Act

Three instruments—the Data Governance Act, Free Flow of Non-Personal Data Regulation, and Open Data Directive—will merge into a single, consolidated Data Act.
Business-to-government (B2G) data-sharing is narrowed to public emergencies only, with compensation rights for micro and small enterprises.
Data holders may refuse disclosure where trade secrets risk exposure to third countries with inadequate protections, strengthening safeguards for international transfers.
Cloud-switching rules are eased for SMEs and small mid-caps, and outdated smart-contract requirements are removed to reduce compliance complexity.

GDPR and Cybersecurity

Targeted GDPR amendments clarify the definition of personal data, relax certain notification duties, and integrate cookie consent rules into the GDPR text, enabling one-click consent and browser-level preference management.
Security incident reporting under GDPR, NIS2, DORA, and related frameworks is streamlined via a single ENISA-operated entry point, with an extended 96-hour window for high-risk breaches.

Data Union Strategy & European Business Wallet

The Data Union Strategy introduces measures to unlock high-quality datasets for AI, including data labs and a legal helpdesk for Data Act compliance.
The European Business Wallet will provide companies with a secure digital identity for cross-border operations, enabling digital signatures, document exchange, and simplified interactions with public authorities across all Member States.

Next Steps

The proposals now move to the European Parliament and Council, with adoption expected in 2026 and application from 2027/2028.

Organisations should begin reviewing:

• AI data-processing practices, especially where special-category data is used for bias detection;
• B2G disclosure scenarios and trade-secret protection mechanisms;
• Integrated privacy, AI, and cybersecurity compliance strategies in light of unified reporting and new governance tools.

The Digital Omnibus signals a major shift toward a coherent EU digital regulatory landscape, combining simplification with strategic compliance adjustments.