Dispatch from Brussels: Updates on EU Tech Policy

AI Omnibus trilogue collapses, talks rescheduled: The AI Omnibus is a Commission proposal to simplify the EU AI Act and, crucially for industry, postpone the August 2026 deadline for high-risk AI obligations. After roughly 12 hours of negotiations, the second political trilogue meeting on 28 April broke down without agreement, with negotiators agreeing in the early hours of 29 April to reconvene at a later date, possibly in mid-May. The principal blocking point was the Annex I question and related sectoral interplay (notably Article 6), namely whether industrial AI products already covered by sectoral legislation (machinery, medical devices, etc.) should be carved out of the AI Act's horizontal regime. Discussions also touched on proposed new bans on nudification apps.

Data Omnibus negotiations: The Data Omnibus is a separate simplification package amending the GDPR, Data Act, NIS2 and ePrivacy Directive, intended to reduce overlapping reporting burdens. The Cypriot Presidency circulated a fresh compromise text ahead of a 24 April Council working group, but Cyprus has indicated it does not expect to reach a Council mandate before the end of its Presidency on 30 June. In Parliament, the LIBE and IMCO committees are still in early input-gathering mode. A joint committee draft report is expected in June, a committee vote in February 2027, with trilogues unlikely before March 2027.

Digital Sovereignty

Cloud sovereignty framework returns to the spotlight: The Commission's cloud sovereignty framework, used in a recent procurement that included Google (through its joint venture with France's Thales) at a lower assurance level, returned to the spotlight this month. According to Politico, Philippe Van Damme, Deputy Director General of DG DIGIT, asserted that European sovereign cloud offerings have proven roughly 10% cheaper in tender outcomes, and hinted that the framework could feed into the Commission's forthcoming tech sovereignty package, expected in late May. The remarks come amid growing US scrutiny: US Ambassador to the EU Andrew Puzder warned in an interview that any restriction on American companies in the EU's tech sovereignty push would prove a mistake, urging Brussels to focus on simplification rather than decoupling. Separately, France and Germany are expected to publish joint sovereign tech criteria in June.

Online Platforms

Commission urges Member States to roll out EU age verification app: The age verification app is a Commission-developed tool that lets users prove they meet a minimum age threshold without disclosing other personal data, designed to help platforms comply with their child protection obligations under the Digital Services Act (DSA), the EU's flagship rulebook for online platforms. On 29 April, the Commission adopted a recommendation urging EU Member States to accelerate the rollout of the app, with the goal of making it available to citizens by the end of 2026. The recommendation specifies actions Member States should take to ensure swift availability and cross-border interoperability, including using the EU age verification blueprint, drawing up implementation plans, and ensuring compliance with cybersecurity standards through independent third-party scrutiny. The Commission also announced the EU Age Verification Scheme, a governance framework that will define the trust model and requirements for providers and produce lists of trusted solutions and providers. Cyprus, Denmark, France, Greece, Ireland, Italy and Spain are expected to lead the initial rollout.

Commission preliminarily finds Meta in breach of the DSA over under-13s: On 29 April, the Commission preliminarily found Meta's Instagram and Facebook in breach of the DSA for failing to diligently identify, assess and mitigate the risks of minors under 13 accessing their services. The Commission found that users can enter a false date of birth at sign-up without meaningful verification, and that reporting tools to flag underage users are difficult to access and inconsistently trigger follow-up. Meta has indicated it disagrees with the findings and signalled further measures will be announced shortly. The case falls right as the EU Commission seeks to reinforce its enforcement of child protection rules (it quickly followed the age verification recommendations discussed above).

Commission concludes first DMA review, says rules fit for purpose: The Digital Markets Act (DMA) is the EU regulation that imposes ex ante obligations on the largest online "gatekeeper" platforms to ensure fairer and more contestable digital markets. On 28 April, the Commission delivered its first review of the DMA, concluding that the regulation remains fit for purpose and does not require revision. The Commission pointed to tangible effects, including new entrants in messaging (BirdyChat and Haiket), alternative app stores and improvements for alternative browsers. The review drew sharp pushback from gatekeeper firms, with Apple and Alphabet criticising the conclusions, while civil society and some MEPs argued that fines so far have been too modest. The Commission also decided against extending DMA messaging interoperability rules to social networks for now, citing an external study that found extension to be technically feasible but premature.

techUK International Policy and Trade Programme activities

techUK supports members with their international trade plans and aspirations. We help members to understand market opportunities, tackle market access barriers, and build partnerships in their target market. Visit the programme page here.