EU Unveils Digital Omnibus to Streamline AI, Cybersecurity, and Data Regulations

The European Commission officially published its comprehensive Digital Omnibus on November 19, 2025, proposing significant legislative adjustments aimed at simplifying and streamlining the European Union's digital rulebook. This initiative targets key areas including artificial intelligence (AI), cybersecurity, and data governance, seeking to reduce administrative burdens and enhance legal certainty for businesses across the bloc, as reported by vertexaisearch.cloud.google.com.

A central component of the Omnibus involves targeted changes to the EU AI Act, particularly adjusting the timeline for the application of rules concerning high-risk AI systems. This delay, potentially up to 16 months, is designed to align with the availability of necessary support tools and technical standards, according to Xinhua. The Commission aims to ensure a smoother implementation process for companies.

Furthermore, the package extends crucial simplifications to small and mid-cap companies (SMCs), alongside existing provisions for small and medium-sized enterprises (SMEs). These measures, including streamlined technical documentation requirements, are expected to foster innovation and ease compliance for smaller entities, as noted by the European Commission.

In the realm of cybersecurity, the Digital Omnibus introduces a single entry point for incident notifications, addressing a long-standing issue of overlapping reporting obligations under various EU laws. This unified interface, to be established and maintained by ENISA, will allow organizations to submit notifications more efficiently, according to vertexaisearch.cloud.google.com.

Data governance also sees substantial reforms, with proposals to merge several existing legislative instruments into the Data Act. This consolidation aims to enhance legal clarity and reduce complexity, particularly benefiting businesses through targeted exemptions to cloud-switching rules and simplified data altruism frameworks, as detailed by Bird & Bird.

The Commission estimates that these simplification measures within the Digital Omnibus could save firms up to €5 billion in administrative costs by 2029, with additional savings anticipated from related initiatives like the European Business Wallets. This underscores the EU's commitment to fostering a more competitive and innovation-friendly digital economy, the European Commission stated.

This package is part of a broader strategy to boost Europe's productivity and innovation, following insights from the 2024 European Competitiveness report. The proposals will now proceed through the EU's ordinary legislative procedure, requiring review and adoption by the European Parliament and the Council, as reported by Covington & Burling LLP.

• Background and Context of EU Digital Regulation: The European Union has been at the forefront of digital regulation, with landmark legislation like the AI Act and GDPR. However, the rapid evolution of technology has led to a complex and sometimes overlapping regulatory landscape, creating significant compliance challenges for businesses, particularly SMEs and SMCs, according to Taylor Wessing. The Digital Omnibus seeks to address these tensions, aiming for a more coherent and user-friendly framework, as highlighted by CMS LawNow.

• Detailed AI Act Adjustments and Support Mechanisms: The Digital Omnibus on AI specifically refines the AI Act without altering its fundamental architecture, as explained by CMS LawNow. Key adjustments include delaying the application of high-risk AI rules by up to 16 months to ensure the availability of necessary standards and support tools, according to the European Commission. It also extends simplifications, such as reduced technical documentation requirements, to SMCs and SMEs, which could save an estimated €225 million annually, Xinhua reported. The proposals also reinforce the AI Office's powers for centralized oversight of general-purpose AI models and broaden the use of AI regulatory sandboxes, including an EU-level sandbox from 2028, to support innovation and real-world testing, the European Commission confirmed.

• Streamlining Cybersecurity Incident Reporting: The current system for cybersecurity incident reporting involves multiple, often overlapping, obligations under various EU legal acts, including NIS2, GDPR, DORA, and CER, as detailed by vertexaisearch.cloud.google.com. The Digital Omnibus proposes a single entry point for these notifications, to be established and maintained by ENISA. This unified interface is designed to significantly reduce the administrative burden on companies by allowing them to fulfill multiple reporting requirements through one secure portal, according to euobserver.

• Consolidation and Simplification of Data Rules: The Digital Omnibus aims to consolidate several key data-related legislative acts into the Data Act, merging the Data Governance Act, the Free Flow of Non-Personal Data Regulation, and the Open Data Directive, as reported by vertexaisearch.cloud.google.com. This move is intended to provide greater legal clarity and reduce complexity. Additionally, it introduces targeted exemptions to cloud-switching rules for SMEs and SMCs, which are projected to result in €1.5 billion in one-off savings, according to EU Digital Omnibus. The package also seeks to simplify the data altruism framework and remove mandatory registration for data intermediation service providers, thereby lowering market entry barriers, Bird & Bird stated.

• Promoting AI Literacy Across the EU: A crucial element of the Digital Omnibus is the emphasis on promoting AI literacy among citizens and businesses. The European Commission and Member States are tasked with ensuring continuous support for companies and fostering a sufficient level of AI literacy, as highlighted by vertexaisearch.cloud.google.com. This includes initiatives to train staff, develop acceptable AI use policies, and raise awareness of AI risks and ethical considerations, according to JD Supra. Article 4 of the AI Act, which came into effect in February 2025, already mandates AI literacy measures for providers and deployers of AI systems, as noted by the European Commission.

• Economic Impact and Broader Digital Strategy: The simplification measures are projected to yield substantial economic benefits, with an estimated €5 billion in administrative cost savings for firms by 2029, as stated by the European Commission. This initiative is part of a larger digital package that includes a Data Union Strategy to unlock high-quality data for AI and the introduction of European Business Wallets. These digital wallets, offering unified digital identities for companies, are expected to unlock an additional €150 billion in annual savings by simplifying paperwork and cross-border interactions, according to the European Commission.

• Legislative Process and Future Outlook: The legislative proposals contained within the Digital Omnibus will now undergo the standard EU legislative process, involving detailed scrutiny and potential amendments by the European Parliament and the Council, as confirmed by Covington & Burling LLP. The Commission has also launched a public consultation on a "Digital Fitness Check," which will assess the coherence and cumulative impact of the EU's digital rules, indicating an ongoing commitment to regulatory optimization and simplification, the European Commission announced.