What are the proposals (in short)?
The Commission has the right of initiative in EU legislative procedure - meaning that it proposes legislation to the European Parliament and the Council of the European Unition. The Commission has proposed a package of proposals includes a digital omnibus that streamlines rules on AI, cybersecurity and data, complemented by a Data Union Strategy to unlock high-quality data for AI and European Business Wallets that will offer companies a single digital identity to simplify paperwork and make it much easier to do business across EU Member States.
Why is the Commission making these proposals? In short:
there is a general recognition that the digital economy has out paced parts of the regulatory framework (e.g. too many cookie pop ups);
there is a growing desire in the EU (similar to the US) to reduce regulatory burden on AI to enhance innovation and digital competitiveness;
SMEs have viewed the regulations as very burdensome and complex;
duplication of incident reporting obligations;
responding to new technology (e.g. AI training data, digital wallets).
What are the key proposals?
In terms of AI:
the commencement of the EU AI Act will be pushed out;
guidance and support will be implemented before commencement;
certain simplifications that are granted to SMEs will be extended to larger businesses as well.
There would be a single a single-entry point where companies can meet all incident-reporting obligations (currently, companies may have to report under the GDPR and DORA).
There would be targeted amendments to the GDPR to harmonise, clarify and simplify certain rules to boost innovation and support compliance by organisations, while keeping intact the core of the GDPR, maintaining the highest level of personal data protection.
Amendments would reduce the number of times cookie banners pop up and allow users to indicate their consent with one-click and save their cookie preferences through central settings of preferences in browsers and operating system.
Improved access to data, for the purpose of fostering innovation. Four pieces of legislation would be merged into the one Data Act.
New guidance on compliance with the Data Act through model contractual terms for data access and use, and standard contractual clauses for cloud computing contracts.
Boosting European AI companies by unlocking access to high-quality and fresh datasets for AI, strengthening the overall innovation potential of businesses across the EU.
There will be a new data union strategy (expected in the second half of 2025). The strategy will focus on unlocking data use for innovation, regulatory simplification, and international data flows. This is not a law - it is like a policy roadmap that sets a direction of travel.
Digital wallet: This proposal will provide European companies and public sector bodies with a unified digital tool, enabling them to digitalise operations and interactions that in many cases currently still need to be done in person. Businesses will be able to digitally sign, timestamp and seal documents; securely create, store and exchange verified documents; and communicate securely with other businesses or public administrations in their own and the other 26 Member States.
Have there been any criticisms of the proposals? Yes, I am glad you asked. Some have argued that the proposals will erode privacy safeguards e.g. by making it easier to use personal information to train AI models. Others have argued that re-opening cornerstones of data protection such as the GDPR could lead to uncertainty and unintended consequences.
What are the next steps: The digital omnibus legislative proposals will now be submitted to the European Parliament and the Council for adoption. T
Why should you care? We are not sure you should, but then again, that depends on who you are.
If you are in the EU you should probably care.
If you are not, then the key takeaway is the general trend internationally to a more relaxed and simplified regulatory framework for data - one that focusses on driving innovation. There is a phenomenon known as the “Brussels effect” which essentially means that what happens in the EU often trickles down to other jurisdictions.
If you are selling into the EU then you could be directly affected if the proposals become law (the GDPR for example applies extra-territorially).