The European Commission launches its most ambitious digital regulation reform package yet. It’s called the Digital Omnibus. This proposed regulation intends to reform how companies comply with EU technology regulations. It plans to do that by rewriting the AI Act, GDPR, and the Data Act. According to the European Commission, the Digital Omnibus streamlined the regulation for companies. However, the proposal retains the key safeguards.
Commission responds to delays in compliance with the AI Act
Digital Omnibus brings in considerable amendments to the AI Act. These are in response to the industry-wide concerns regarding timelines for implementation. The AI Omnibus bill particularly delays the requirement for high-risk AI systems. This delays the timeline for compliance from August 2026 to December 2027 for Annex III systems. This is owing to the late publication of the essential technical standards for compliance by the industry.
Simplified regimes for compliance will also apply not only to small and medium-sized enterprises but also to small mid-cap companies employing fewer than 750 people annually and having an annual turnover of less than €150 million. Ideally, the regulation streamlines documentation requirements for such companies. Additionally, the proposal foregoes the requirement for literacy in the field of AI for both the provider and the deployer. Such literacy is now the responsibility of the member state and the Commission.
Major provisions in the Key AI Act are:
- Extended deadlines for high-risk systems
- Simplified regimes for an additional 8,250 European companies
- Repeal the compulsory literacy in AI requirement
- Alignment of the implementation process with the availability of technical standards
Data protection laws also undergo thorough modernization
The Data Omnibus outlines some major updates to the GDPR rules on data protection. The proposed act intends to provide an environment for innovation while also supporting the high standards in data protection. Cookie consent rules are expected to undergo some major changes in the Data Omnibus. New exceptions for statistical purposes and for purposes of securing the data are introduced. Also, controllers must comply with the machine-readable user preferences indicated through the browser.
It was made clear in the proposed regulation that the processing for legitimate interests might qualify as an applicable exemption for the training of artificial intelligence. New rules provide an exemption for processing special categories of personal data in the context of the processing of artificial intelligence. Notified processing limits in the GDPR will now stand at 96 hours. Recommendations are made to limit the definition of personal data for individuals who lack reasonable means of being identifiable.
Business benefits promise substantial cost savings and efficiency
Among the Digital Omnibus provisions is the Implementation of the Single Incident Reporting Port for the EU. This act harmonizes the means through which EU organizations report different incidents. It ensures that the whole process of receiving different notifications from the GDPR, the NIS2 directive, DORA regulations, and CER Directives, among others, is covered through the Digital Omnibus Act. Organizations will require less effort in the process by half.
The Commission pegs the annual savings potential from the adoption of the European business wallet at €150 billion. Additionally, one-time savings totaling €5 billion by the year 2029 will also come from simplification measures related to the regulation of data, AI, and cybersecurity. This will provide solutions for the digital identity market that will enable companies to provide a unified business identity.
Digital Omnibus legislation represents a watershed in the regulation of the digital world in the European region. Even though the specifics of the measures may develop during the process of legislation, the commission’s call for simplification in the regulation process seems positive. However, the future of the Digital Omnibus legislation will depend on its implementation at the end of the lengthy process of legislation in the European Parliament.
