Digital Omnibus: a reform proposal that demands thorough consideration

In recent weeks, the so-called Digital Omnibus has been at the centre of the European debate, amid undeniable needs for simplification and equally undeniable risks of oversimplification.

One thing is certain: the reform proposal marks a radical change in the European Union’s approach to the digital sphere. As the European Commission itself writes, “The Data Union strategy shifts the focus from rules to results”[1].

The current situation

Until now, the regulatory interventions that make up the digital acquis have essentially followed the path laid out by the GDPR, adopting an approach that could be described as “precautionary”, centred on the protection of fundamental rights, natural persons, and the proper functioning of the internal market.

This approach has resulted in a regulatory paradigm that imposes stringent obligations on economic operators, in order to prevent particularly pervasive technologies developed or managed by them from taking on a quasi-public role in serving collective interests, in a manner neither controlled nor democratically legitimised.

The intention of the European legislator is certainly understandable, insofar as it pursues the highest objective of protecting citizens—an extensive category that also includes market operators themselves, who are in turn protected by the same rules when they act as ordinary inhabitants of the European continent.

Thus, while the intention itself is beyond question, the implementation methods appear open to significant improvements. In particular, all stakeholders have noted that the regulatory framework on digital matters is excessively fragmented, with overlaps, gaps, and sometimes systemic inconsistencies.

Since 2016, a multitude of regulations, directives, guidelines and national provisions have been adopted, often relating to areas that are contiguous or intersecting, leading to a progressive increase in the burden on market operators and a corresponding rise in interpretative difficulties for those responsible for implementing the rules.

The main European bodies — supported, among other things, by the analyses contained in the Draghi and Letta reports — have highlighted how the accumulation of rules risks negatively affecting competitiveness, acting as a brake on technological innovation. At the same time, stakeholders have called for targeted corrective measures aimed at reducing compliance costs and clarifying the interrelationships between the various strands of digital regulation.

What the Digital Omnibus provides

The Digital Omnibus package of proposals is set within this context, with the stated aim of modernising and rationalising the Union’s digital legislation, adapting it to an increasingly dynamic economic and technological environment.

The declarations of intent highlight the goal of reducing regulatory burdens on citizens, businesses and administrations, while maintaining the highest standards for the protection of the Union’s values and fundamental rights.

However, closer analysis requires placing these statements within the broader current geopolitical scenario, which is also shaped by undeniable pressure from the EU’s main trading partners. Simplistic and superficial views tend to oppose market liberalisation and the protection of fundamental rights, as if they could not instead represent two sides of the same coin. It is to be hoped that such short-sighted perspectives will not excessively influence the future choices of the European legislator.

To clarify, it should be noted that the Digital Omnibus is a package of legislative proposals intended to amend existing regulations and directives. It will therefore not be a new standalone Regulation replacing the entire pre-existing framework, but rather a coordinated set of corrective and alignment interventions modifying the current rules.

In particular, on 19 November 2025 the European Commission published three Communications that must be read together:

1. COM(2025) 835 “Unlocking data for AI”.
   The Communication outlines a strategy aimed at unifying and enhancing data, with the objective of “unlocking” the information potential needed to develop Artificial Intelligence, considered a strategic asset for the Union’s technological sovereignty and competitiveness in the global context. The subsequent Communications represent a direct implementation of the political and strategic approach set out in this document; therefore, the Commission’s entire package must be read from a systemic and integrated perspective.

2. COM(2025) 836 “Digital Omnibus on AI”.
   This is a draft regulation amending Regulations (EU) 2024/1689 and (EU) 2018/1139 with the aim of harmonising and simplifying the implementation of the Artificial Intelligence rules. Specifically, the intention is not to reform the AI Act, but to support its entry into force by strengthening implementation tools and operational support for obligated parties through guidelines and harmonised standards.

   To better guide the legislative effort, the Commission conducted consultations that revealed significant difficulties in implementing the AI Act, perceived as obstacles to innovation and sources of excessive costs for businesses.

   To address these issues, the proposal includes targeted simplification measures, such as:

   • linking the application of rules on high-risk AI systems to the availability of adequate standards and support tools;

   • extending certain regulatory simplifications designed for SMEs also to small mid-caps;

   • promoting AI literacy through initiatives by the Commission and the Member States;

   • centralising, within the AI Office, the supervision of systems based on general-purpose AI models or integrated into large platforms and search engines;

   • clarifying the interaction between the AI Act and other Union regulations, and making procedural adjustments to improve its application.

   These measures aim to ensure a smoother, more proportionate and innovation-friendly implementation of the AI Act, contributing to the strategic objective of making the European Union a true “AI continent”.

3. COM(2025) 837 “Digital Omnibus”.
   This too is a draft Regulation introducing a broad revision of the entire EU data framework (GDPR, ePrivacy Directive, Data Governance Act, Regulation on the free flow of non-personal data, Open Data Directive, Data Act, NIS2, DORA, CER, P2B Regulation). In particular, the proposal focuses on the following issues:

   • Rationalisation of the data framework, through the consolidation of the Data Act, which becomes the single text governing the “data economy”, incorporating within it related legislative acts (Data Governance Act, Open Data Directive, Free Flow Regulation), which will also be partially repealed.
     Targeted adjustments are also envisaged for specific rules concerning, for example, the reuse of data by public authorities, simplifications for SMEs, protection of trade secrets, the scope of business-to-government data sharing, and requirements for smart contracts.

   • Amendments to the GDPR, introducing significant changes to key concepts such as “personal data”, “special categories of data”, and “pseudonymisation”, as well as greater openness to the use of data for AI training and scientific research.

   • Reform of the ePrivacy regime and reduction of cookie banners (e.g., derogations from consent for low-risk uses or uses necessary to access the service).

   • Simplification of security incident reporting, through the establishment of a single entry point for all cybersecurity notifications, with ENISA tasked with developing the relevant platform.

   • Repeal of the P2B Regulation, considered obsolete following the entry into force of the DSA and DMA.

Conclusions

In conclusion, the proposed legislative package contains multiple, cross-cutting interventions that require careful monitoring and a precise assessment of their actual effectiveness.

The legislative process is only just beginning; at present, the Digital Omnibus is at the initial stages of an approval process that will not be completed before two years.

In the coming months, public consultations and stakeholder discussions are expected, which may lead to revisions of the Commission’s proposal. The text will then have to undergo scrutiny by the European Parliament and the Council of the European Union through the ordinary legislative procedure.

In any case, for now we can say that the Commission’s intent appears clear: to align data governance and the implementation of the AI Act with a more globally competitive business model.

The question remains as to how far this process will affect the balance between competitiveness and the protection of fundamental rights — a knot that can only be untied by the next legislative developments.

Barbara Tombini

[1]Brussels, 19.11.2025, COM(2025) 835 final, pag. 2