Dispatch from Brussels: Updates on EU Tech Policy
Welcome to this edition of the Dispatch from Brussels. After weeks of false starts, Member States have finally agreed their position on the Digital Omnibus, opening the way for negotiations with Parliament. On AI, the AI Office used the International AI Summit in Dublin to signal that AI Act enforcement against frontier model providers has begun, while Member States backed a new Dublin Declaration on trusted, safe and sovereign AI. Elsewhere, the Commission opened its first Digital Services Act investigation into Booking.com, telecoms ministers met in Limerick to discuss the Digital Networks Act, and the date of the UK–EU Summit has now been confirmed for 20 November. Below is a more detailed overview of what has kept the EU tech policy space busy.
UK–EU Relations
UK–EU Summit confirmed for 20 November: On 12 October, the Council confirmed that the second UK–EU Summit will take place in Brussels on 20 November, where António Costa and Ursula von der Leyen will welcome Prime Minister Andy Burnham. The published agenda covers defence and security, energy, agrifood, climate, people-to-people contacts, and migration and law enforcement, with leaders expected to adopt a joint declaration. techUK will make a strong case in favour of discussing key tech issues at the summit and will update members on any potential industry engagement opportunities.
Digital Simplification
Council finally agrees its position on the Digital Omnibus: On 21 October, EU ambassadors agreed the Council’s negotiating mandate on the Digital Omnibus, the Commission’s package amending the GDPR, ePrivacy rules and the EU’s data rules to simplify the digital rulebook (see our previous update on the postponed 7 October vote). The deal was unlocked by a final compromise from the Irish Presidency strengthening protection for trade secrets linked to industrial know-how, the issue that had pushed Germany and France block earlier attempts. Under the Council’s text, trade secrets would only have to be shared once confidentiality measures are in place.
Below are some of the key points that are part of the Council position:
GDPR: the existing definition of personal data is kept, with a new provision on pseudonymisation; a longer deadline for data breach notifications; a single EU-level list of high-risk processing operations; and common compliance templates. Earlier drafts also confirmed that AI development and operation may rely on “legitimate interest”, subject to a case-by-case assessment and the right to object
Cookies: rules stay in the ePrivacy Directive, but consent would no longer be needed in more cases, such as audience measurement or device security. According to earlier drafts, websites would have to wait four months (rather than six as proposed by the Commission) before asking a user again after a refusal.
Incident reporting: the Council rejected the Commission’s proposed single EU-wide reporting entry point, favouring national entry points, an EU-level information point and more harmonised notification rules.
Data: consolidated rules on data altruism and data intermediation, and the possibility for public bodies to charge gatekeepers higher fees for re-using public-sector data.
Inter-institutional negotiations can begin once the European Parliament has adopted its own position. Leaders at the European Council of 15–16 October also called on co-legislators to finalise the simplification files by the end of the year which is a very ambitious timeline.
Artificial Intelligence
AI Office begins enforcement against frontier AI labs: Speaking at the International AI Summit in Dublin on 14 October, Executive Vice-President Henna Virkkunen announced that the AI Office “has started enforcing” the AI Act’s rules for general-purpose AI models, having sent requests for information to OpenAI and Anthropic following incidents during model testing over the summer, in which AI agents reportedly accessed external organisations’ systems. The requests cover security, external evaluation and monitoring of how models are used. The move has led to some degree of debate with some experts arguing that the AI Act’s research and development exemption exclude testing activity. The Commission maintains that the rules apply where effects reach the EU market. As a reminder, the AI Office’s enforcement powers for general-purpose AI models became applicable in August 2026.
EU Member States back the Dublin Declaration on AI: The same summit saw participating Member States endorse the Dublin Declaration on trusted, safe and sovereign AI. The declaration commits signatories to advance the development and adoption of AI, strengthen cooperation on AI safety and governance, invest in skills, research and digital infrastructure, and strengthen Europe’s technological capacity while staying open to trusted international partners. The summit also kicked off European AI Innovation Month, a series of AI events across Europe culminating in the Apply AI Summit in Brussels on 17 November.
Commission launches RAISE pledging initiative: On 15 October, the Commission launched RAISE (Resource for AI Science in Europe), under which companies and foundations pledge access to AI models, compute, data and training for European researchers. Initial pledgers include Google DeepMind, Mistral, Nvidia, Elsevier, Sanofi, Frontiers and the Novo Nordisk Foundation, and the initiative remains open to further contributions.
Consultation on AI Act enforcement procedures: On 12 October, the Commission opened a four-week consultation on a draft implementing regulation setting out procedural rules for AI Act proceedings concerning AI systems built on a provider’s own general-purpose AI model and AI systems integrated into very large online platforms and search engines. It covers access to the file, protection of business secrets and limitation periods for fines. The consultation closes on 9 November.
Online Platforms
Commission opens DSA investigation into Booking.com: On 21 October, the Commission opened formal proceedings against Booking.com under the Digital Services Act, its first DSA investigation into the platform. The Commission will examine whether Booking.com has done enough to tackle fake and non-compliant accommodation listings, whether its safeguards against phishing using reservation data are adequate, and whether boosted search rankings are clearly labelled as advertising. Booking.com said it is cooperating with the Commission.
Google DMA compliance still under review: On 14 October, the Commission confirmed that it remains in dialogue with Google over the changes it made following the €890 million in Digital Markets Act fines imposed in July for self-preferencing in search and anti-steering on Google Play. No date has been set for a final assessment.
KIDS Act: The Commission’s call for feedback on the KIDS Act proposal is open until 3 December. In the Council, talks are set to take place in the Audiovisual and Media Working Party, while in the European Parliament the file is expected to involve the IMCO, LIBE and CULT committees, with rapporteurs still to be named. The European Council conclusions of 16 October also referred to the proposal. Ministers are reportedly due to hold their first political discussion on 20 November.
Telecoms and Connectivity
Telecoms ministers discuss copper switch-off and satellites: On 12–13 October, EU telecoms ministers met informally in Limerick with Executive Vice-President Virkkunen. Discussions on the Digital Networks Act focused on the proposed EU-wide deadline for copper switch-off and measures to encourage investment in the transition to fibre. A second session looked at satellite communications to close coverage gaps and back up emergency services during major disruptions. The Irish Presidency said it aims to progress negotiations on both the Digital Networks Act and the Mobile Satellite Services Decision.
