EU simplification agenda: Commission proposes Digital Omnibus

AI Omnibus: The EU Commission proposes to amend the AI Act to seek compliance facilitation and proposes a delay of the implementation of the Act up to 2027.

Data Omnibus: The package proposes to amend key “data acquis”, including the GDPR (e.g. facilitating the use of data for AI training), and incident reporting.

It seeks to repeal the following pieces of legislation by merging them into a single unified and harmonised structure:

Should you be interested, please find below an overview of some of the major changes proposed by the Omnibus.

Key measures of the AI Omnibus

Quite importantly, the legislation proposes to delay the AI Act’s high-risk requirements until the end of 2027. Additionally, it proposes moving the date when the high-risk requirements associated with AI systems linked to sectoral regulated products will take legal effect to August 2028.

This raises key questions regarding timeline. Indeed, should EU institutions not be able to come to an agreement on a final version of the text before August 2026 (at which time the AI Act’s high-risk regime is meant to apply), a risk exists that a window would open during which enforcement of high-risk infringements would be technically possible.

Data Omnibus

In order to address regulatory complexity, the Commission has decided to consolidate various existing frameworks into the Data Act (see above for the list of repealed legislation). However not all repealed legislation will be integrated into the new consolidated legislation equally. Indeed, nearly all of the Free Flow of Non-Personal Data Regulation will be repealed, except for a few articles, such as those defining “data localisation requirements”. Conversely, most of the Data Governance Act and the Open Data Directive will be retained and adapted within the Data Act. Overall, the newly consolidated Data Act would propose to:

New interplay between the GDPR and the AI Act

Amongst the key things the Commission proposes is that anonymised data should no longer be considered “personal” and thus should find itself excluded from the scope of the GDPR. However, this would depend on whether the entity holding the data is unable to identify the person to whom the data relates to and taking into account the means reasonably likely to be used by the entity. Even if a subsequent entity might be able to later identity someone through anonymised data by using different tools, this will not be considered sufficient for the data to be classified as “personal”.

Another key issue the proposal puts forward is making the ban on “sensitive” data listed under article 9 of the GDPR (such as ethnic origin, sexual orientation, health status etc.) more flexible. Under the proposed changes, the ban would only apply to data where there is a direct risk of revealing sensitive information. Quite importantly, the proposed changes would allow for exemptions to this ban if the data is used for training and operating AI models under certain conditions (see article 88c of the omnibus).

The omnibus also aims to introduce a new article which would make legal for AI developers to rely on the “legitimate interest” legal basis when training their AI models on personal data. Indeed the text states that “The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model” (see recital 30 of the omnibus).

What does this all mean and what’s next?

The EU Commission, through this legislative proposal is making an ambitious first step in seeking to simplify major pieces of legislation such as the AI Act and the GDPR. Should this be achieved, the EU Commission would be able to “bring immediate relief to businesses, public administrations, and citizens alike, to stimulate competitiveness”

However, some members of the European Parliament from the Greens, Renew, and S&D political groups have already expressed some scepticism and discontent at the EU. The Omnibus will now go to the Council (EU Member States) and European Parliament, who will have to agree on their respective negotiating positions before beginning interinstitutional negotiations. Agreeing on a final text as soon as possible will be crucial to guarantee certainty for businesses operating in the EU.

techUK will continue to analyse the proposal and its evolution throughout the legislative process and provide membership with relevant updates.

techUK International Policy and Trade Programme activities

techUK supports members with their international trade plans and aspirations. We help members to understand market opportunities, tackle market access barriers, and build partnerships in their target market. Visit the programme page here.