In November 2025 the European Commission proposed a 'Digital Omnibus': a package that amends several digital laws at once in the name of simplification. It is the most significant proposed change to the GDPR since 2016 and it moves the goalposts for the AI Act in the middle of implementation. Since then it has been negotiated between the Parliament and the Council. This note explains what is proposed, where the negotiation stands in general terms and, most importantly, what you can do that will be right whichever way it lands. Treat the details below as a proposal, not as law: positions change until the final text is published.
What the proposal does to the AI Act
The headline is timing. High-risk obligations were due to apply from 2 August 2026 for the systems listed in Annex III (employment, credit, education, essential services and so on) and from August 2027 for AI embedded in regulated products. The proposal links those dates to the availability of harmonised standards and support tools, with backstop dates later in 2027 and 2028. It also widens simplifications for small and medium-sized companies, centralises some oversight of systems built on general-purpose models at the AI Office, and adjusts transparency and registration duties. Separate 'stop-the-clock' discussions have run in parallel, and the AI literacy duty and the prohibitions, which already apply, are not touched.
What it does to the GDPR
Four changes matter most for technology companies. First, a narrower, more relative definition of personal data, following the Court of Justice: information is personal data for you only if you can reasonably identify the person. Second, an express route for using legitimate interest to train and run artificial-intelligence models, with safeguards. Third, the cookie and device-storage rules move out of the ePrivacy Directive into the GDPR, with recognition of browser-level consent signals and a narrower set of cases that need consent at all. Fourth, breach notification would be simplified: a single EU entry point, a longer deadline than the current 72 hours, and a higher threshold for what must be reported. There are also proposals to harmonise the lists of processing that require a DPIA and to ease data subject requests that are abusive.
What it does to the rest of the rulebook
The Data Act, the Data Governance Act and the Free Flow of Data Regulation would be merged into one data instrument. Incident reporting under NIS2, DORA, the CRA and the GDPR would get a single entry point. The Omnibus would also delete some reporting obligations that duplicate each other across laws.
What to do now: the no-regret list
Do not stop your AI Act classification. Deadlines may move; the categories will not. An inventory with documented role and risk reasoning is required under every version of the text and is what customers and investors ask for today. Keep building your DPIA and RoPA; both survive in every draft. Design cookie consent for the strictest reading and make it easy to loosen later; the reverse is expensive. Prepare for browser signals such as Global Privacy Control; they are already law in several US states. Build one incident process that can feed any regulator, rather than one per law. Document legitimate-interest reasoning for AI training now; if the Omnibus passes it becomes the standard, and if it does not it remains your best argument.
We track the negotiation and update clients when a position becomes final. If you want a one-page view of what the current text would change for your company, send us a short description of what you build.