Omnibus VII - Digital Simplification Package
The seventh Omnibus package on Digital, presented on 19 November 2025, comprises two legislative proposals: a Regulation on the “Digital Omnibus” (or “Data Omnibus”) and a Regulation establishing a “Digital Omnibus on AI.”
The Digital Omnibus aims to simplify the EU’s digital legislative framework by streamlining cybersecurity reporting, fostering a more innovation-friendly privacy regime while safeguarding fundamental rights under the GDPR, modernising cookie rules to enhance users’ online experience, and improving access to data.
In relation to cybersecurity, the proposal introduces a single reporting entry point enabling companies to comply with incident-notification obligations under multiple frameworks, including the NIS2 Directive, the GDPR, and DORA.
Enhanced access to data would be pursued through the consolidation of EU data legislation under the Data Act, targeted exemptions for SMEs and SMCs, new compliance guidance through model contractual terms, and improved access to high-quality datasets for European AI developers.
The European Parliament and Council have both started their internal processes to define their respective position on the file.
As regards the proposal for a Digital Omnibus on AI, the proposed measure sets out targeted amendments to the AI Act among others to ensure the EU’s AI framework is clear, proportionate and innovation-friendly:
- Revises the timetable for high-risk AI requirements, allowing a maximum of 15 months before application to ensure companies have access to necessary compliance tools.
- Strengthens the AI Office and centralises oversight of general-purpose AI systems.
- Expands opportunities for regulatory sandboxes and real-world testing.
- Complements AI Act measures by integrating high-risk AI requirements into aviation safety rules for sectoral coherence.
Work on the file is progressing swiftly, with the aim of reaching an interinstitutional agreement by May 2026, in line with the AI Act’s approaching deadlines.
In the European Parliament, legislative work highlighted the need to postpone the application of the AI Act to ensure that standards, guidelines, and compliance frameworks are fully prepared. It also emphasises targeted measures on AI literacy, bias mitigation, oversight, cybersecurity, and sandboxes, aiming to strike a careful balance between ambition, legal certainty, and practical readiness.
Council discussions are advancing in parallel. The Cyprus Presidency has proposed a compromise text establishing a fixed timeline for high-risk AI obligations, removing early application, and introducing a simplified registration procedure for borderline high-risk systems. It also seeks to refine the AI Office’s powers, set cooperation and enforcement procedures, and impose binding AI literacy requirements for providers and deployers, while tightening conditions for processing sensitive data.
Based on the Parliament and Council positions, interinstitutional negotiations are then expected between late March and early April.