What Is the EU AI Omnibus (Digital Omnibus)?

The Digital Omnibus is a package of simplification measures that the European Commission presented on 19 November 2025 to streamline the EU's digital rulebook - the Commission's seventh omnibus package of 2025. It consists of two Commission proposals: the "Digital Omnibus on AI" (often called the "AI Omnibus"), amending the AI Act, and a broader "Digital Omnibus" covering the GDPR, ePrivacy rules, the Data Act and incident reporting. An "omnibus" amends several existing laws at once. This one targets the interaction between the EU AI Act, the GDPR, the Data Act, ePrivacy rules, and the cybersecurity incident-reporting regimes, with the stated goal of cutting administrative burden - especially for SMEs - and making compliance more coherent across overlapping laws. Its main purpose is to simplify and align existing rules, although the final AI Act amendments also added new prohibitions on AI-generated intimate imagery and child sexual abuse material.

The Digital Omnibus matters because it signals a shift in the EU's posture - from rapid digital rule-making toward consolidation - and because it is no longer hypothetical. The package was tabled as two separate proposals that have moved at very different speeds. The AI-focused part (the "AI Omnibus") moved fast: on 7 May 2026 the European Parliament and the Council reached a provisional political agreement to amend the AI Act, postponing key high-risk deadlines and easing some obligations. It is now law: Regulation (EU) 2026/1744 was adopted on 8 July 2026 and entered into force on 27 July 2026, before the original 2 August 2026 deadline. The broader part - proposed amendments to the GDPR, ePrivacy and the Data Act - is still a proposal at first reading, and is the most contested, with privacy and digital-rights groups warning it could weaken hard-won protections. So the right reading in October 2026 is: the AI timeline changes are settled law; the data-protection changes are still very much in play.

Digital Omnibus Defined

In EU legislative practice, an "omnibus" is a single instrument that amends multiple existing laws together - used when changes cut across several regulations that interact. The Digital Omnibus is the digital-policy counterpart to earlier 2025 simplification packages (such as the sustainability omnibus), part of a broader Commission drive to reduce reporting burden and improve EU competitiveness.

Its defining characteristics:

• Simplification first - Its main purpose is to simplify and align existing rules, although the final AI Act amendments also added new prohibitions on AI-generated intimate imagery and child sexual abuse material.
• Cross-cutting - It touches the AI Act, GDPR, Data Act, ePrivacy, and cyber-incident reporting in one package, precisely because their requirements overlap.
• Partly adopted - The AI part is now Regulation (EU) 2026/1744; the data part (COM(2025) 837) is still going through the ordinary legislative procedure.
• Contested - The EDPB and EDPS have formally objected to parts of it, notably the narrower definition of personal data, and privacy groups warn it could weaken protections.

What It Proposes

The package bundles measures to reduce friction across the digital rulebook. The AI side is now law after the 7 May 2026 deal and its formal adoption; the data-protection side is still at first reading. The main thrusts:

Changes to the AI Act

The most consequential part of the Omnibus is its treatment of the AI Act, where the provisional agreement of 7 May 2026 turned proposals into final terms, now enacted as Regulation (EU) 2026/1744. It responds to a recurring complaint: high-risk obligations were due to apply before the harmonised technical standards needed to comply with them existed. The adopted changes include:

• Postponed high-risk deadlines. Obligations for standalone high-risk systems (Annex III) move from 2 August 2026 to 2 December 2027, and for high-risk AI embedded in regulated products (Annex I) from 2 August 2027 to 2 August 2028 - fixed new dates, justified by the delayed availability of harmonised standards and guidance (the Commission had proposed tying them to standards readiness).
• Eased transparency timing. Article 50 transparency duties broadly hold at 2 August 2026, but the marking requirement for AI-generated content (Article 50(2)) gets a grace period - to 2 December 2026 for generative AI systems placed on the market before 2 August 2026.
• New prohibitions. Article 5 gains bans on AI systems that generate non-consensual intimate imagery or child sexual abuse material, applying from 2 December 2026.
• Lighter burden for smaller players. Compliance reliefs previously reserved for SMEs are extended to small mid-cap companies.
• Centralised oversight. The AI Office becomes competent to supervise AI systems built on a provider's own general-purpose AI model, centralising oversight that would otherwise be split across national authorities, with exceptions where national authorities stay in charge, including law enforcement, border management, the judiciary and financial institutions.

These changes are now law: Regulation (EU) 2026/1744 was adopted on 8 July 2026 and entered into force on 27 July 2026, before the original 2 August 2026 deadline. The strategic signal is clear: the obligations are not going away - their timing has been recalibrated to when compliance is actually feasible.

GDPR & Reporting

Beyond the AI Act, the original November 2025 proposal reaches into data protection and incident reporting - but this part travels as a separate proposal, COM(2025) 837, and remains the most contested. As of October 2026 the GDPR/ePrivacy/Data Act proposal (COM(2025) 837) is still at first reading: as of October 2026 Parliament had no position yet, the Council's negotiating mandate was still pending, and trilogue negotiations had not begun. Its main measures:

• GDPR simplification. Measures aimed at easing specific requirements - for example, clarifying the definition of personal data (codifying case law on pseudonymised data); allowing processing for developing and operating AI systems and models under legitimate interest, with a right to object; a single EU-wide list of when a DPIA is required; breach notification to the authority only for high-risk breaches with a 96-hour deadline; and fewer cookie consent prompts. These are the most disputed elements, with critics warning against eroding core data privacy protections.
• Consolidated incident reporting. Today an organization may have to report a single incident under NIS2, DORA, the GDPR and the Critical Entities Resilience Directive, each with its own form and deadline. The proposal would route these through one ENISA-run single-entry point ("report once, share many"), building on the reporting platform already created under the Cyber Resilience Act. Like the GDPR changes, this is part of the unadopted COM(2025) 837.

Because this track is unsettled, organizations should plan for today's GDPR obligations to remain fully in force. If eventually enacted, these changes would not lower the bar for protecting personal data so much as reduce the number of times and ways organizations must demonstrate that protection.

What It Means for Data Teams

It would be a mistake to read "simplification" as "less governance." Whatever the final text, three things hold:

• The substance survives. Simplifying paperwork does not remove the underlying duties - to know your data, document your AI, protect personal information, and report incidents. It changes how often and in what form you prove it.
• Coherence rewards a single source of truth. The whole premise of the Omnibus - one incident, one report; aligned obligations across laws - is far easier to meet when an organization has one governed inventory of its data and AI systems rather than separate spreadsheets per regulation.
• Uncertainty raises the value of being ready. While timelines shift, the organizations best positioned are those whose data governance is already in order - they can comply under either the original or the simplified regime without scrambling.

This is the consistent thread across the AI Act, DORA, NIS2, and the GDPR: the paperwork differs, but the foundation is the same - a governed catalog, clear ownership, and traceable lineage. Dawiso's AI governance approach is to maintain that foundation once, so that whichever way the Omnibus lands, the evidence is already there.

Conclusion

The Digital Omnibus is the EU recalibrating, not retreating: a bid to make a dense digital rulebook workable without abandoning its goals. For organizations, the worst response would be to wait for the dust to settle and do nothing - because the underlying obligations remain, and the package's own logic favors those who govern their data in one coherent place. Simplification is a reason to consolidate, not to relax. For a strategic take on what actually changed and what to adjust in your AI strategy, see our deep dive: The AI Omnibus - What Changed in the EU AI Act.

Sources

• European Commission, Press release IP/25/2718 on the digital package (19 November 2025; the two proposals).
• European Commission, Digital package - Questions and answers (scope of the AI and data proposals).
• Publications Office of the EU (EUR-Lex), Regulation (EU) 2026/1744 (Digital Omnibus on AI) (adopted AI Act amendments, new dates and prohibitions, entry into force).
• Council of the EU, Artificial Intelligence: Council gives final green light to simplify and streamline rules (press release, 29 June 2026; final approval).
• European Commission, COM(2025) 837, proposal for a Digital Omnibus (GDPR, ePrivacy, Data Act and incident-reporting amendments).
• European Parliament Legislative Observatory, Procedure file 2025/0360(COD) (status of the data proposal).
• EDPB and EDPS, Joint Opinion 2/2026 on the Digital Omnibus (objections, including to the narrower definition of personal data).