Since February 2025, the European Commission has presented twelve proposals for simplification, known as the ‘Omnibus packages’. The Digital Omnibus VII focuses on rules relating to data protection, privacy and cybersecurity. This article does not discuss the substance of the 11 other proposals [1].
Omnibus VII consists of two separate proposals from the European Commission: i) the ‘Digital Omnibus on rules for data, cybersecurity and privacy’ and ii) the ‘Digital Omnibus on AI’.
Digital Omnibus
The first proposal for a Digital Omnibus Regulation was presented on 19 November 2025 [2] with the aim of reducing the regulatory burden on businesses, public authorities and citizens. The proposal is intended to ensure that compliance with the rules entails lower costs, achieves the same objectives and provides a competitive advantage.
The Digital Omnibus contains amendments to the GDPR, a number of notable changes from which are briefly outlined here. Firstly, a new provision on pseudonymisation and the identifiability of a natural person is introduced. Personal data does not exist if a particular entity does not have the means that could reasonably be used to identify the natural person. This codifies the SRB judgment of 4 September 2025 [3]. Secondly, it is confirmed that a legitimate interest may exist in the processing of personal data for the development and use of AI systems and for scientific research. Thirdly, an exception to the prohibition in Article 9 of the GDPR is introduced for the residual presence of special categories of personal data in the development of AI systems and AI models, provided that measures are taken at all times to prevent this as far as possible and, where necessary, such data is deleted.
Cookie banners are also set to be simplified due to ‘consent fatigue’. The current rules on cookies and other tracking technologies under the e-Privacy Directive remain in place and consent remains mandatory in principle, but a framework will be introduced covering additional purposes – including security, statistics and strictly necessary cookies – for which consent is not required.
A key change regarding the reporting of data breaches and cybersecurity incidents is the introduction of a single central point of contact for reporting obligations under the NIS 2 Directive, the GDPR, DORA, eIDAS and CER.
Digital Omnibus on AI
On 19 November 2025, the Commission published the proposal for a Digital Omnibus Regulation on AI [4]. This concerns a proposal to amend the AI Regulation, which entered into force on 1 August 2024, also known as the ‘AI Act’ [5].
The AI Omnibus entered into force on 27 July 2026. This has extended the timelines, with the rules for high-risk AI systems in Annex III applying from 2 December 2027 and for high-risk AI in physical products (machinery, toys, lifts, etc.) in Annex I applying from 2 August 2028.
The AI Omnibus also contains substantive amendments. Some of these focus on reducing administrative burdens, such as simplifying the AI literacy requirement for businesses and simplifying the obligation to register exempted AI systems in the central EU database. In addition, an official ban has been introduced on so-called ‘nudification’ apps. The ban will come into force on 2 December 2026. Although this provides a solid basis against online abuse, the Amsterdam District Court, in its interim ruling of 26 March 2026 [6], granted an injunction prohibiting the generation and distribution of sexually explicit material on the basis of the GDPR and Article 6:162 of the Dutch Civil Code.
Where do we stand now?
On 21 October 2026, the Council of the European Union set out its position on the Digital Omnibus VII [7]. Following the Council’s approval and once the European Parliament has also adopted its final position, negotiations with the European Parliament will commence. The aim is to complete work on all Omnibus Packages by the end of 2027.
[1] A summary of all the Omnibus proposals can be found at: https://www.consilium.europa.eu/nl/policies/simplification/
[2] https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:52025PC0837
[3] Court of Justice of the European Union, 4 September 2025, C-413/23 P, ECLI:EU:C:2025:645.
[4] https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX:52025PC0836
[5] Regulation (EU) 2024/1689
[6] Amsterdam District Court, 26 March 2026, ECLI:NL:RBAMS:2026:3106
[7] The press release can be viewed at: https://www.consilium.europa.eu/nl/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/