Dispatch from Brussels: Updates on EU tech policy
EU Simplification Agenda: AI, Data, Cyber, Privacy
Leaked drafts of EU’s Digital Simplification packages: The EU Commission is set to propose two legislative simplification packages on 19 November aimed at simplifying EU tech and digital rules. The first proposal will focus on AI, while the other will focus on data, privacy, and cyber. A brief overview of what the leaks contain can be found below. We will be publishing an overview of the contents of the proposals on the techUK website once they are officially released.
Leaked AI simplification package: The package will propose the following
Enforcement delay of 12 months specifically for some transparency obligations for AI providers, corresponding to AIA Art. 50(2).
Clarified legal basis for providers and deployers of AI systems and AI models to exceptionally process special categories of personal data for bias detection and correction (under certain conditions).
Removal of database registration for certain high-risk AI systems that fall out of scope
Stronger enforcement powers for the EU Commission
Removal of the mandatory template for a post-market monitoring plan
AI literacy should no longer be an obligation
Possibility to launch a regulatory sandbox at EU level for AI systems within the Commission's exclusive supervision.
A few exemptions and privileges to be extended to small mid-caps
New legal basis to facilitate real-world testing
Deadline specified for the changes to sectoral legislation
Clarification on the interplay with the Cyber Resilience Act (CRA).
Leaked Data, Privacy, Cyber simplification package: The package will propose the following:
A major restructuring of the existing legislation into the Data Act (four laws are expected to be merged)
Targeted amendment to the GDPR meant to clarify key definitions, harmonise, streamline application etc.
The creation of a single-entry point for reporting, covering NIS2, eIDAS, DORA, and potentially GDPR (for data breaches) and CER (Critical Entities Resilience Directive).
Digital Sovereignty
EU Commission to launch Sovereign Digital Infrastructure Consortium: on 29 October, the EU Commission adopted a decision establishing the Digital Commons European Digital Infrastructure Consortium (DC-EDIC), a new instrument enabling Member States to jointly develop, deploy and operate cross-border digital infrastructures with dedicated governance and legal personality. The Consortium, whose founding members include France, Germany, the Netherlands and Italy (though more Member States can join), will seek to implement a Multi-Country Project on Digital Commons in the areas of European common data infrastructure and services and connected public administration. The Consortium will officially be launched in December 2025. You can read more about it on the EU Commission website.
EU Commission defines sovereignty objectives relevant for cloud services: On 27 October, the EU Commission’ s DG DIGIT released a document defining sovereignty objectives and assurances that are meant to provide a framework through which authorities contracting services can assess the overall “Sovereignty Score” of a tender. The document lists 8 Sovereignty objectives.
Public Procurement
EU Commission Launches Consultation ahead of Public Procurement Legislation Revision: In the Commission’s 2024-2029 political guidelines, President von der Leyen announced a revision of the public procurement directives. The revision will aim to “enable preference to be given to European products in public procurement” and to “modernise and simplify procurement rules”. The consultation will be open until 26 January 2026
Networks
EU Digital Networks Act to be delayed: The EU legislation meant to stimulate investment in and take-up of very high capacity networks in the EU (e.g. fibre and 5G) and set new spectrum rules for mobile connectivity, has been delayed to 20 January 2026 according to a newly published EU Commission Agenda.
For more information on any of the above, please contact:
