The EU Digital Rulebook in Motion

Why should I read this?

EU digital regulation is moving on several fronts, with the AI Act at the centre. Under the Digital Omnibus, one proposal addresses AI and another covers data, privacy and cybersecurity. Alongside that package, the AI Act has its own rollout, including recent guidance on transparency, high-risk classification and AI-generated content marking.

Timelines now matter for AI governance, vendor due diligence and product planning. From 2 August 2026, the AI Act’s transparency obligations become enforceable. Non-compliance can attract fines of up to €15 million or 3% of global turnover. With changes moving in stages, it is easy to misjudge what applies, and when.

On 29 June 2026, the Council adopted the AI Omnibus amendments. Core AI Act obligations remain, but the high-risk rules now move to December 2027 and August 2028. For businesses, the practical change is timing, not direction. Meanwhile, the separate data, privacy and cybersecurity proposal remains further off. Further simplification may follow as the Commission’s Digital Fitness Check reviews the wider rulebook.

What should I do?

Many businesses will fall into more than one category, so the steps below should be read together rather than in isolation. AI Omnibus has now been adopted and is settled. Data, privacy and cybersecurity sit in the other proposal, which is still moving. Cybersecurity also has its own timeline, notably under DORA, NIS2 and the Cyber Resilience Act.

If you develop or use AI systems

With the new dates confirmed, the useful steps now are to:

• Map and classify your AI systems: assess Annex III use cases and AI embedded in regulated products.
• Build for the high-risk rules now: risk management, documentation and conformity assessment take time, even with the delay.
• Meet the Article 50 transparency rules: from 2 August 2026, address user notices, AI-generated content marking, and deepfake disclosures.
• Note the marking grace period: systems already on the market have until 2 December 2026 to mark their content.

If you handle personal data or cookies

These changes sit in the Digital Omnibus proposal covering data, privacy and cybersecurity. It is separate from the AI Omnibus, and is not yet formally agreed, so the current focus is readiness:

• Track the cookie reforms: the proposal would move some consent rules into the GDPR, with simplified consent and saved browser or system preferences.
• Assess the GDPR changes: these include proposed clarification of personal data, and reliance on legitimate interests for certain AI training and operation.

If you have cybersecurity or reporting obligations

Here the picture is mixed. DORA already applies, NIS2 depends on national implementation, and the Cyber Resilience Act applies in stages, with reporting from 11 September 2026. Further reform and guidance are also coming. The steps that currently matter are to:

• Prepare for CRA reporting: from 11 September 2026, manufacturers must report severe incidents and actively exploited vulnerabilities. Commission draft guidance from March 2026 also helps clarify scope, classification and vulnerability handling.
• Watch the NIS2 reforms: the Omnibus would add a single incident-reporting point, and a January 2026 package would clarify scope and streamline ransomware reporting.

What else do I need to know?

When the changes apply

The AI Act applies in stages. Prohibited practices have been banned since February 2025, and general-purpose AI rules since August 2025. From 2 August 2026, the transparency obligations apply.

The Omnibus pushes back only the high-risk rules. Stand-alone systems move to 2 December 2027, embedded ones to 2 August 2028. Two new bans and the content-marking rules take effect from 2 December 2026. Following the Council’s final adoption on 29 June 2026, these dates are now confirmed.

The other tracks run separately. The broader data, privacy and cybersecurity Omnibus has no fixed application date. The CRA's reporting obligations begin on 11 September 2026, while NIS2 and DORA already apply. NIS2 itself faces further amendments proposed in January 2026, but the timing remains uncertain.

Overlapping obligations across the digital rulebook

Overlap is where the practical burden falls. A single connected AI product can fall under both the AI Act and the CRA. It will also engage the GDPR if it processes personal data. The business behind it may face NIS2 or DORA, depending on its sector. Commission draft CRA guidance from March 2026 helps clarify scope, product classification and vulnerability handling. Reducing duplication is a central aim of the broader Omnibus, through measures such as the single reporting point. For businesses, mapping these intersections now is the best way to manage the cumulative load.

Beyond the Omnibus: the AI Act’s own rollout

The Omnibus is not the only thing moving. Separately, the AI Act is being fleshed out through guidance, standards and codes of practice. The Commission published draft Article 50 transparency guidelines on 8 May 2026 and draft high-risk classification guidelines on 19 May 2026. The final high-risk guidelines are expected by the end of 2026.

The Commission also published the final Code of Practice on marking and labelling AI-generated content on 10 June 2026, with optional EU icons for labelling. While the code is voluntary, the Article 50 transparency obligations it supports are not. These materials should feed into AI inventories, transparency notices, content-marking design and high-risk classification decisions. For businesses, these developments matter as much as the Omnibus measures, and run on their own timetable.

Regulatory direction and outlook

The Omnibus is part of a wider competitiveness push. It sits within the Commission’s Competitiveness Compass of January 2025, prompted by the 2024 Draghi report on Europe’s innovation gap. The aim is to cut administrative costs by at least 25% for companies, and 35% for smaller ones, by 2029. And it does not stop with the Omnibus. The Digital Fitness Check, which closed its consultation in March 2026, is a wider stress-test of how EU digital rules interact in practice. It looks at cumulative burdens, overlaps and practical friction across the digital rulebook, and may inform further simplification measures.

The direction is towards implementation, consolidation and targeted reform, rather than a pause in regulation. For businesses, though, the compliance load does not lighten. The obligations remain. What changes is the timing, and the effort of keeping track of various streams running in parallel.

Further reading

Executive Compliance Guide: EU Cyber Resilience Act
EU Digital Omnibus: At a glance
AI Implementation Toolkit
EU Digital Fitness Check consultation – implications for multinational businesses
Updata: Your quarterly privacy & cybersecurity update
Navigating cybersecurity compliance
Legal Telescope: Tech & AI trends shaping supplier–customer relationships in 2025/26