I. Introduction
Under its 2024–2029 Strategic Agenda,Footnote 1 the European Union committed to simplifying legislative procedures and reducing administrative burdens. The Omnibus VII package was introduced to address these objectives in the digital sector. Framed as a response to European Council Budapest Declaration call for a “simplification revolution” and the 2024 Draghi and Letta reports, Omnibus VII introduces cuts to rules across the entire digital acquis and in particular for small- and medium-sized enterprises (SMEs).
Existing literature addressing the Omnibus package has focused on two areas of inquiry. First, scholars have argued that the Omnibus departs from established EU legislative procedures by bypassing stakeholder consultations, regulatory impact assessments and other Better Regulation instruments.Footnote 2 Second, authors have interpreted the package as primarily deregulatory in nature, removing legislative rules and reducing legal certainty.Footnote 3
This article contributes to this literature by arguing that the bundling and simplification of the EU Digital Rulebook is accelerating and consolidating the EU’s digital policy agenda. The 2020 Digital Strategy, Shaping Europe’s digital future, pursued a model of co-regulation combining self-regulation with public oversight and stakeholder governance. European Standard Organisations (ESOs) were instrumental in the implementation of legislation. Omnibus VII changes this governance architecture by reducing national regulatory authority (NRA) and third-party oversight, replacing EN standard-setting with market-developed alternatives and centralising policy coordination with the Commission.
The article proceeds as follows. Section II contextualises the proposals within the aims of the 2020 European Data and the 2025 Data Union Strategies. Section III examines the Data Omnibus,Footnote 4 AI OmnibusFootnote 5 and European Business Wallet (EUBW)Footnote 6 explaining how they are reducing the role of Member States, NRAs, ESOs and centralising the role of the Commission. The conclusion shows how Omnibus VII has greatly expanded the remit of the EU in this important area of the single market.
II. Contextualising omnibus VII
In November 2025, the European Commission published its Omnibus VII proposals aimed at simplifying existing “rules on data, cybersecurity, and AI, accompanied by the Data Union Strategy, and a proposal for European business wallets.”Footnote 7 It is organised into five parts: the Data Omnibus, the Cybersecurity Omnibus, the AI Omnibus, the Data Union Strategy and EU Business Wallet. Omnibus VII bundles amendments to a wide body of digital legislation, including revisions to pillar Acts such as the General Data Protection Regulation (GDPR), EU Data Protection Regulation (EUDPR) and ePrivacy Directive. It repeals only recently agreed and barely implemented Regulations such as the Regulation on the Free Flow of Non-Personal Data Regulation (FFDR), Open Data Directive (ODD), Platform-to-Business Regulation (P2B) and the Data Governance Act (DGA) combining their relevant rules into the existing Data Act.
The package also schedules a review of the Digital Markets Act (DMA) the Digital Decade Policy Programme, the Chips Act, the Audiovisual Media Services Directive and Copyright Directive in 2026 and Cyber Solidarity Act, Open Internet Regulation, NIS2 and Digital Services Act in 2027.Footnote 8 It plans re-evaluations of the European Media Freedom Act and the Data Act in 2028, and the AI Act and the Regulation establishing the European Cybersecurity Competence Centre and Network in 2029. As such, Omnibus VII represents the most comprehensive overhaul of EU digital market governance to date.
The article focuses on the first three proposals: the Digital Omnibus Regulation (the Data Omnibus), the Digital Omnibus on AI (AI Omnibus) and the European Business Wallet (EUBW). Similar to other Omnibus proposals, these measures were not preceded by impact assessments or public consultations. Instead, they were set out in two Staff Working DocumentsFootnote 9 and an Explanatory Memorandum.Footnote 10 The main rationale for legislative consolidation is that it is technical, not regulatory in nature. Despite this claim, Omnibus VII considerably speeds up the legislative process, with both new and existing initiatives folded into one. The Council has prioritised urgent adoption of the package. Indeed, the AI Omnibus was agreed in June 2026 only eight months following its initial proposal.Footnote 11
Omnibus VII emerges from an extensive period of regulatory expansion in the digital sector. In this respect, it resembles the 2002 EU Telecoms Framework which consolidated existing telecommunications legislation into one central package. Like the 2002 Framework, Omnibus VII does not break away from the EU’s existing digital governance strategy but streamlines and consolidates it. Understanding the proposals requires situating them within the Commission’s broader digital agenda.
The 2025 Data Union Strategy builds directly on the 2020 European Data Strategy and its predecessors. Under the 2020 Digital Agenda, the 2020 European Data Strategy sought to expand data availability across sectors while remaining anchored in the EU’s commitments to high standards of data protection and European values, namely safety, security, transparency, fundamental rights, and accessibility.Footnote 12 Its approach was grounded in the GDPR, which established harmonised rules for data privacy. Although market-oriented, the 2020 Strategy continued to be embedded within a governance model underpinned by NRA oversight, stakeholder governance and ESO standards harmonisation.
The 2020 Strategy expanded the use of data across sectors, including eCommerce, research, the public sector and the third sector through the creation of cloud switching services and removed data localisation requirements with the aim of creating a “Single Market for data.” Access to large-scale, high-quality datasets was viewed as necessary for emerging technologies, particularly artificial intelligence.Footnote 13 The Strategy introduced the 2022 Data Governance Act, which enables the reuse of public sector data for altruistic purposes, and the 2023 Data Act, which facilitates data sharing between public and private actors. They were accompanied by the creation of Common European Data Spaces (CEDS) and promotion of cloud interoperability. CEDS were designed to facilitate cross-sectoral and cross-border data sharing via “smart contracts,” which automate data sharing agreements. A key priority of the 2020 Strategy was to protect digital sovereignty (DS) aimed at ensuring that data generated within EU borders remains under European control and preventing US tech groups from being the main beneficiaries of European data processing.Footnote 14
The 2023 Data Act harmonised rules for the use of and fair access to data. Created as a measure to promote data sharing in both public and private sectors, the Act sought to rebalance control over generated data by redistributing access rights among manufacturers, users and third parties. It built on the 2019 ODD which facilitated data sharing in the public sector and publicly funded research. Accordingly, the Data Act imposed obligations on cloud providers for switching and interoperability, and targeted vendor lock-in practices that were only previously addressed on a self-regulatory basis under the 2018 Free Flow of Non-Personal Data Regulation. As such, the 2023 Data Act extended data sharing beyond the public sector to the private sector fulfilling a gap left by the GDPR which was limited to personal data. To introduce fairness in contractual terms for SMEs, the 2019 Directive addressed the terms SMEs faced when entering into agreements to access data held by large corporations. This approach was upheld in the 2023 Data Act which differentiates obligations depending on the size of providers and the nature of services by introducing safeguards against unfair contractual terms for SMEs, thereby addressing long-standing concerns regarding unequal bargaining power.
The 2023 Data Act also built on the 2019 Regulation on platform-to-business relations (P2B Regulation) which outlined conditions for sellers providing products to consumers on online platforms. Under the accompanying 2020 Guidelines on ranking transparency, platforms were required to adhere to the transparency of the use of algorithmic sequencing. The 2023 Data Act also required data collectors to share their collection models with consumers.
To remain consistent with the GDPR, both the Data Governance and the Data Act continued to maintain high data protection standards. The Data Act loosened GDPR rules with reduced restrictions for privacy breaches and data misuse regulations but, at the same time, it imposed strict obligations on manufacturers and service providers (e.g., IoT) for access to device-generated data from users and set out rigid rules for data transfers to third countries.Footnote 15 Under the Act, the Commission can develop Standard Contractual Clauses (SCCs), which are pre-approved legal contract templates, to govern transfers from EU-based data processors to third-country controllers for states which do not meet EU data protection adequacy.
The 2025 Data Union Strategy introduced under the Omnibus VII package, largely completes this legislative trajectory by addressing legal gaps.Footnote 16 However, it does so by changing the legislative mechanisms through the Strategy is implemented. The 2020 approach had relied upon traditional instruments that had been developed for the Single Market, namely, the harmonisation of data sharing rules, cloud switching obligations, interoperability requirements, third-country transfer rules and EN standardisation coupled with NRA oversight and stakeholder governance.Footnote 17 NRA networks, such as the European Data Protection Board (EDPB) for data protection and the Network and Information Systems (NIS) Cooperation Group for cybersecurity, were embedded into Regulations and Directives.
The 2025 Data Union Strategy overhauls this approach reducing the role of NRAs, third party oversight bodies and ESOs and, at the same time, centralising the role of the Commission. Most of the initiatives expand on existing policy proposals. They are not new. What is new is the speed at which the agenda is being rolled out. Indeed, the streamlining of existing digital rules is greatly accelerating the EU’s digital policy agenda.
III. The data omnibus, AI omnibus and European Business Wallet
1. The data omnibus (digital omnibus regulation)
The Data Omnibus proposal introduces amendments across EU data protection, cybersecurity and digital services legislation. Its main proposals are the centralisation of reporting to European level bodies, reduced reliance on EN standards and the simplification of GDPR rules.
a. Centralisation
The Data Omnibus centralises coordination at the EU level. This starts with the reorganisation of the European Data Innovation Board (EDIB) as originally established under the Data Governance Act. New powers under the Data Omnibus strengthen the role of the European Commission vis-a-vis the EDIB.Footnote 18
Centralisation is also taking place with the establishment of the Single Entry Point (SEP) which combines previously separate reporting bodies into one. The SEP builds on the 2018 Single Digital Gateway Regulation (SDGR), which introduced the Once-Only Technical System (OOTS) linking documents reported to national bodies to a central Your Europe portal. The SEP expands on this model, centralising reporting obligations across wide range of digital legislation, including the 2016 GDPR, NIS2 Directive, 2022 CER Directive and 2022 Digital Operational Resilience Act (DORA).
The Commission proposed that the SEP be established at the European, rather than at national levels, by the EU body ENISA. Currently, for example, if a multinational bank suffers a cyberattack, it needs to report it to a national DPA under the GDPR, a national CSIRT or cyber agency under NIS2 and a national financial regulator under DORA.Footnote 19 Under the Data Omnibus, the SEP becomes the sole reporting body. Reporting obligations have been loosened. For example, data breach notification windows for the GDPR and EUDPR have been lengthened from seventy-two to ninety-six hours. The SEP also reduces the volume of what must be reported with many notification obligations becoming voluntary.
Several Member States raised concerns over the SEP because it reduces NRA oversight.Footnote 20 They pointed to security flaws, interoperability difficulties, language barriers and the risks of mishandling sensitive information. Labelling systems are also under contestation as incidents are currently reported as “major ICT-related incidents” and “significant cyber threats” under DORA, “significant cyber threats” under NIS2, and a “high risk to the rights and freedoms of natural persons” under the GDPR. Organisations must also document whether an incident meets, e.g., “significant impact” on critical societal or economic activities under NIS2 or a “significant disruptive effect” to essential services under the 2023 Critical Entities Resilience (CER) Directive. Accordingly, the Council April 2026 compromise amended the SEP proposal establishing that national bodies will continue to act as the first point of contact for incident reporting which will then be transferred to the SEP.
What further complicates reporting is the existence of separate EU implementing Acts. For example, the DORA harmonises technical standards outlining the content and time limits for notification of incidents under a 2024 Implementing Act.Footnote 21 The NIS2 Cooperation Group is currently working to adopt common templates for incident reporting.Footnote 22 However, the Commission plans to issue further Implementing Acts under the Data Omnibus which can arguably bypass the right of NRAs to interpret what constitutes significant within their own borders. This dilutes the autonomy of DPAs and other agencies, requiring them to align with a centralised Commission defined interpretation of risk and compliance.
In addition to the SEP, the Data Act introduces a combined EU-level “Public Union register of ‘data intermediation service providers’ (DISPs) and data altruism organizations.” The register removes the need for DISPs and data altruism organisations to register at national levels. The list of reporting and transparency obligations for data altruism organisations has also been reduced and the plan for a “data altruism Rulebook” dropped. Along with improved coordination powers, EU level reporting allows the Commission to better monitor how Member States are enforcing EU rules.
b. Standardisation
The Data Omnibus aims to accelerate cloud interoperability by enabling the adoption of market alternatives to EN standards. It also provides the Commission with more discretion to adopt Implementing Acts rather than to delegate to ESOs. For example, it empowers the Commission to “adopt implementing acts establishing model contractual clauses” for rules on the transfer of non-personal confidential data protected by intellectual property rights to re-users in third countries.
Another move away from the EN standards model is found in the change to the definition of a Data Processing Service (DPS). Zikesch et al. argue that the definition now tracks the 2012 National Institute of Standards and Technology (NIST) definition of “cloud computing,” which is a US national standard organisation.Footnote 23 They also note that according to the September 2025 Commission guidance, a service only triggers the Data Act’s switching obligations if it meets all seventeen criteria of a DPA denoting a further loosening of requirements.
This move away from EN standards is consistent across the Digital Omnibus package. Similar changes have been proposed under the Data Omnibus for the Cyber Act, which would remove EN Standardisation Requests for NIS2 implementation, instead relying on “existing industry standards rather than developing more overlapping security frameworks.” This approach could include the use of NIST cybersecurity frameworks or open-source solutions, with stakeholders recommending OASIS STIX and TAXII for cybersecurity networks.Footnote 24
Technical standard-setting options have also been used as a rationale for legislative changes. For example, under the 2023 Data Act, smart contracts are required to meet requirements for safe termination which requires them to be capable of terminating the continued execution of transactions under Article 36. The Data Omnibus proposes to delete Article 36 of the Data Act. The Commission justifies the deletion based on “the absence of harmonised standards and clear definitions for key concepts such as ‘robustness’, ‘access control’ and ‘consistency with contractual terms’, combined with the requirement for a ‘safe termination or interruption mechanism’.” However, the changes were clearly a reaction to industry lobbying. The main opposition to safe termination came from blockchain and decentralised finance (DeFi) providers who argued that termination keys were equivalent to “kill switches,” which could compromise security and constituted state overreach.Footnote 25
The Data Omnibus empowers the Commission to request ESOs to develop “standards for encoding automated and machine-readable indication of data subject’s choices, and the communication of those choices from browsers to websites and from mobile phone applications to web services.” However, Zimmeck et al. note in their analysis that the W3C’s pre-existing GPC standard is already the most widely used browser-to-website privacy signalling standard and legally enforced standard in several US states. As the W3C publishes its standards as ISO standards, questions arise as to whether the GPC will be adapted to EU requirements, or whether ESOs will instead be requested to develop a separate EN standard.
c. Simplification
The most politically sensitive issue of the Data Omnibus concerns changes to data protection legislation. The Data Omnibus loosens a wide range of restrictions on data controllers. It repeals the 2018 FFDR, 2019 ODD, 2019 P2B and the 2022 DGA condensing some requirements into the 2023 Data Act. It further proposes changes to GDPR definitions of personal data, legitimate interest, permission for entities to refuse or charge for subject access requests which are “excessive,” DPIAs, data breach reporting obligations and updates cookie rules.
The proposed redefinition of personal data proved the most controversial change because it narrows the scope of what counts as identifiable information. Under current EU law, data is protected if an entity can use it to identify an individual. Under Article 4(1) of the GDPR “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’) .” Article 3 of the Omnibus Regulation proposes to add an exemption paragraph to Article 4(1) of the GDPR and Article 3(1) of the EUDPR. Data would no longer be considered “personal” if a given entity does not have “the means reasonably likely to be used …. to identify the natural person to whom the information relates.” This would mean that data held by one company might not be classified as personal data by another company even if that company holds the key to re-identify it.
The redefinition of personal data is based on 2025 EDPS v. SRB.Footnote 26 Under the ruling, if a recipient lacks the legal and practical means to re-identify individuals, the data is no longer considered to be personal. Under the Omnibus proposal, the Commission amended the definition of personal data in Article 4(1) of the GDPR to codify the decision taken by the Court. The proposed text states “Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity.”
Mannekens argues that the Digital Omnibus proposal goes beyond the intention of the EDPS v. SRB ruling. She points to the earlier 2023 Gesamtverband Autoteile-Handel v. Scania under which the Court ruled that if a provider hands over impersonal data, but the recipient has the tools to identify individuals, the data might retroactively become “indirectly personal” for the transferor.Footnote 27 Other authors have also contested the Commission’s interpretation of EDPS v. SRB, with Aldibs et al. arguing that the “Commission’s proposed approach risks further shifting the regulatory focus away from the mitigation of these risks to fundamental rights towards an overly narrow and technically framed threshold of identifiability.”Footnote 28
The proposed exemptions for legitimate interest are also highly contentious. The word “not” will be removed GDPR Article 5 (1)(b) where it states that “further processing (of personal data) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’).” The double negative is replaced with “be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’)”. Controllers will no longer need to perform an Article 6(4) compatibility assessment for archiving purposes. The proposal aims to create a presumption of compatibility.
A new paragraph was proposed under Article 88c confirming that the processing of personal data by AI systems may be pursued for legitimate interests. The Council, however, removed Article 88c in April 2026 stating that “the possibility for the development and operation of AI to rely on the legitimate interest has already been explicitly confirmed by data protection authorities” negating a need for the Article.Footnote 29
Another significant change relates to “special” categories. Under the GDPR, personal data cannot be processed which reveals “racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures.” The Omnibus proposed that “derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed” for the “development and operation of an AI system or an AI model” if it is for legitimate purposes. The February 2026 EDPB/EDPS Joint Opinion,Footnote 30 backed by the EP in March,Footnote 31 welcomed the derogation in principle but recommended stronger safeguards and clarification of its scope.Footnote 32 In April 2026, the Council affirmed that the derogation under Article 9(2)(l) GDPR, be “subject to appropriate safeguard laid down in Union or Member State law.”
The Commission flanked its proposals on legitimate interest with the addition of paragraphs granting exemptions and simplifications to existing GDPR rules. These include limitations on the right to refuse personal data requests, exemptions from information obligations, changes to conditions governing automated individual decision-making, modifications to data breach notification requirements and reforms to the use of DPIAs. These proposals represent a major scaling back of EU privacy law, which has received considerable political backlash, particularly from digital rights groups.
The EDPB and EDPS argued that proposals relating to personal data definitions, legitimate interest expansion and purpose limitation exceeded a “technical amendment” or a “mere codification of CJEU jurisprudence” and risked weakening established privacy rights protections. In their February 2026 Joint Opinion, both “strongly urge the co-legislators to not adopt the proposed changes to the definition of personal data.” They argued that the limiting the scope of the GDPR could “negatively affect the protection of the fundamental rights and freedoms of individuals while increasing legal uncertainty for organisations.” The proposal to remove the phrase “where appropriate” also came under harsh criticism. The EDPB and the EDPS stated its removal can “decrease rather than increase legal certainty.”
The April 2026 Council compromise text on the Data Omnibus removed the Commission’s proposal to redefine personal data under the GDPR and “preserves the current definition of personal data as enshrined in the GDPR” under a new Article 29a “while facilitating compliance for controllers and by providing a consistent interpretation of the application of pseudonymisation to personal data, which remains within the sole remit of independent supervisory authorities.” The Council draft also removed the power of the European Commission to adopt Implementing Acts establishing the criteria for determining when pseudonymised data would no longer be considered personal. Instead, it recommended the use of EDPB guidelines on pseudonymisation.
The Data Omnibus also proposes revising the rules governing the storage of information on users’ terminal equipment (cookie consent rules) under the 2002 ePrivacy Directive, last amended in 2009. Under Article 88a, the Omnibus proposes a list of exemptions to consent alongside a requirement that users can refuse consent with a single click and that, following this refusal, a new request for consent cannot be made within a six-month period. The Data Omnibus also proposes that there be automated and machine-readable standards for recording users’ choices, including in browser settings. Currently, companies obtain cookie consent through pop-up banners or browser settings.
The EDPB/EDPS, EP and Council largely support the proposal on consent fatigue. In its April 2026 Communication, the Council recommends Articles 88a and 88c be replaced with a new Article 8b of the GDPR based on the proposed Article 88b “related to consent through automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons.” However, Article 88b retains exemptions for media service providers (as defined under the EMFA) from the obligation to respect automated browser signals. This is designed to protect the funding model of independent journalism even though, as SchwambergerFootnote 33 and MartensFootnote 34 point out, publishers are core drivers of real-time bidding AdTech.
The Commission justified the repeal of P2B on the grounds that the 2022 Digital Services Act and 2022 DMA sufficiently cover its requirements. For example, transparency on rankings required from gatekeepers (large US tech groups such as Amazon, Booking.com, Google Play) under P2B are now enforced under the DMA. However, the April 2026 compromise retained the P2B but amends it repealing a number of articles over two different time periods with Article 3 on ranking, Article 7 on differentiated treatment and Article 15 on ensuring enforcement maintained. Article 4 on restrictions and suspensions and Article 11 on complaint-handling system have sunset clauses of 2032. The remaining Articles have been repealed.
Lastly, the Data Omnibus narrows the scope under which EU bodies, namely the Commission, the European Central Bank or Union bodies, can access privately held data from cases of “exceptional need” to “public emergencies.” It also strengthens the conditions under which data controllers can refuse to share IoT-generated data where disclosure would pose a significant risk to trade secrets, giving private actors greater control over the data they hold.Footnote 35 In addition, it introduces stricter controls on cloud switching. These measures strengthen the position of the private sector by limiting public access to privately held data thereby increasing the discretion of data holders. The Data Omnibus in this respect rebalances digital governance towards private self-regulation and away from public oversight.
The Data Omnibus also extends existing exemptions designed for SMEs under the Data Act to small mid-cap companies (SMCs), which have less than 750 employees and €150 million in revenue. For example, the provision under Article 40 of the GDPR which takes into consideration the needs of SMEs would apply to SMCs, relating to record keeping requirements and Codes of Conduct or Certification schemes developed by the EDPB. The Data Omnibus retains the contractual obligation on providers of data processing services, including cloud providers, to facilitate the transfer of customers to another provider. This ensures users are not locked in to a single tech provider.Footnote 36
Undoubtedly, the Data Omnibus represents a transition towards a more centrally driven and Commission engineered agenda. It accelerates and expands the EU’s remit in a wide number of policy areas. However, despite plans to agree the Data Omnibus under the Cypriot Presidency by the end of June 2026, Member States did not come to agreement, and the Act was passed to the Irish Presidency in July.
2. The AI omnibus
The Council adopted the AI Omnibus Act in June 2026. It amends the 2024 AI Act which had been considered the most ambitious regulatory framework for artificial intelligence globally.
a. Centralisation
Under the AI Act, AI systems are classified according to four levels of risk: unacceptable, high, limited and minimal or no risk, with regulatory obligations increasing according to the potential impact of AI on safety, security and EU fundamental rights. AI practices presenting an unacceptable level of risk are prohibited where they are considered incompatible with fundamental rights and EU values. Prohibited practices include social scoring, manipulative or exploitative AI, the scraping of facial images for facial-recognition databases and biometric categorisation used to deduce sensitive data such as race, political opinions or religious beliefs. Uses of real-time remote biometric identification by law enforcement are also prohibited, subject to exceptions. The prohibitions under Article 5 began to apply on 2 February 2025, ahead of full application of the AI Act from 2 August 2026.Footnote 37
High-risk AI systems are those considered potentially harmful to health, safety or fundamental rights. Annex III covers standalone AI systems used in areas such as education, employment and recruitment, law enforcement, migration and access to essential services, while Annex I covers AI systems that are product, or safety components of products, regulated under existing EU legislation, such as medical devices, machinery and toys.
High-risk systems are subject to stringent requirements concerning risk management, data governance, technical documentation, record-keeping, accuracy, robustness, cybersecurity, transparency and human oversight. Before being placed on the market, providers must ensure compliance with a conformity assessment, attach a CE marking and comply with post-market monitoring and registration requirements. Conformity is assessed by a designated third party Notified Body for most high-risk systems but Annex III systems can undergo internal assessments under conditions outlined in the Act. The Act also provides citizens with procedural rights, including the right to lodge complaints with NRAs and to obtain a clear and meaningful explanation of the role of a high-risk AI system in decisions affecting them.
The two remaining categories cover lower-risk AI applications. AI systems that interact directly with individuals or generate or manipulate synthetic content, must comply with information and transparency requirements designed to ensure that users are aware when they are interacting with AI or encountering AI-generated content. Minimal- or no-risk AI systems are not subject to any mandatory requirements under the Act, although Article 95 encourages providers to voluntarily apply Codes of Conduct. While Article 95 encourages AI providers to draft their own Codes of Conduct, the Commission launched the AI Pact, designed to support Code development, which is managed by the European AI Office. Over half of the companies signing the AI Pact have taken voluntary “additional AI Pact commitments, such as human oversight, risk mitigation, and transparency in AI-generated content like deep fakes.”Footnote 38
Under the AI Act, General-Purpose AI (GPAI) providers, such as ChatGPT, are subject to obligations concerning technical documentation, copyright compliance and transparency for training content. GPAI models presenting systemic risks are subject to additional requirements concerning risk assessment and mitigation, model evaluation, incident reporting and cybersecurity. From August 2026, the European AI Office assumed responsibility for supervising and enforcing GPAI rules. It has the power to request information, conduct model evaluations, require corrective measures and impose sanctions.
The original AI Act relied heavily upon co-regulatory governance involving NRAs, third-party Notified Bodies and ESOs. For example, high-risk AI systems, particularly those falling within Annex I and embedded in products such as medical devices, toys and machinery, were subject to conformity assessments by third party Notified Bodies. Notified Bodies were to be designated by Member States and notified to the Commission through the NANDO system. However, by 2025, NRAs were not fully operational and Notified Bodies had not been designated.
The AI Omnibus therefore made changes to conformity assessment firstly by “amending the list of codes, categories, and corresponding types of AI systems” under Annex XIV of the AI Act. Secondly, although designation of Notified Bodies remains with Member States, the Commission assigns each Notified Body with an identification number and maintains NANDO as a public portal for notification. When a Notified Body is responsible for the conformity assessment of a high-risk AI system, its identification number is displayed alongside its CE marking. The number identifies the Notified Body involved in the conformity-assessment procedure and indicates that an AI system has undergone third-party conformity assessment. This centralises coordination with the Commission.
b. Standardisation
More significant than the changes to implementation are the reforms affecting standardisation. The slow production of EN standards created pressure for alternatives. Although CEN-CENELEC remains the primary route for standard setting, the Commission has provided itself the power, under Article 41 of the Act, to author its own “Common Specifications.” If a provider maps its standards to Common Specifications, it can claim a “presumption of conformity.” By pushing back the dates when companies must comply with standards, the Commission widened the window of time in which it could pass its Common Specifications via Implementing Acts negating the need to use EN standards.
At the same time, it has opened the door to greater adoption of standards not developed within the EU. A faster route for CEN and CENELEC standard formation is to adopt a pre-existing standard from an international organisation such as ISO or the IEC. A standard can be either jointly developed or adopted verbatim. For example, EN ISO/IEC 42001:2023 is a joint standard for “establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations.” At the time of writing, ten ISO/IEC standards had been adopted by CEN and CENELEC under the AI Act.Footnote 39
In an interesting development, large US tech groups have been agreeing private sector standards in standards bodies which submit them to ISO, where ESOs can download and adopt them. For example, standard setting for AI systems has been developed within the Coalition for Content Provenance and Authenticity (C2PA), which is an industry-led SSO founded by major US tech giants including Adobe, Arm, Intel, Microsoft and Google. C2PA is developing “Content Credentials” which watermarks AI text, images, audio and video. This standard can satisfy requirements under Article 50 of the AI Act which stipulate that providers of GPAI systems that generate synthetic content ensure that outputs are machine-readable and identifiable as artificially generated. The technology is currently being fast-tracked for international recognition as ISO/DIS 22144 (Authenticity of Information: Content Credentials) within the ISO/TC 171/SC 2 subcommittee. Uploading standards to ISO for download to ESOs is highly strategic.Footnote 40
c. Simplification
The AI Omnibus introduces a new regulatory calendar. The Council agreed that “streamlining the AI rules is essential for ensuring the EU’s digital sovereignty” and agreed to “adjust the timeline for applying rules on high-risk AI systems by up to sixteen months, so that the rules start to apply once the Commission confirms the needed standards and tools are available.”Footnote 41 The original deadlines for High-Risk AI systems were August 2026 for Annex III systems and August 2027 for Annex I systems. Under the AI Omnibus, the compliance deadlines for these groups are tied to the availability of official EN standards. This delay in deadlines is referred to as a stop-the-clock rule. The AI Omnibus proposed that standalone high-risk Annex III systems were required to comply by 2 December 2027. Embedded high-risk Annex I systems were granted a longer transition period with a deadline of 2 August 2028. National regulatory sandboxes were delayed until 2 August 2027, with Member States now required to have established at least one operational sandbox for AI testing by this date. In March 2026, the EP Internal Market and Civil Liberties committees agreed to the December 2027 and August 2028 deadlines, respectively, but recommended shortening the deadline for providers creating “watermarking AI-created audio, image, video or text content to indicate its origin” to 2 November 2026 (instead of 2 February 2027 as proposed by the Commission).Footnote 42
The postponement of deadlines can be seen as deregulatory. However, delaying enforcement also reduces the risk of implementation failure. At the same time, the delay to implementation has allowed the EU to widen its scope over AI governance by adding on additional measures and adapting the framework to new areas. For example, the European Parliament successfully pushed through a new prohibition that was not proposed in the original AI Act. AI systems designed to generate non-consensual intimate imagery (NCII) namely nudifier apps and child sexual abuse material (CSAM) are now categorised as Prohibited AI Practices.Footnote 43 This ban will go into effect on 2 December 2026. It also applies to systems where such generation is “reasonably foreseeable,” and developers have failed to put adequate guardrails in place. Violations carry the AI Act’s heaviest fines up to €35 million or 7% of global annual turnover.
In addition to the postponement of deadlines, the AI Omnibus reduces transparency and reporting requirements. The Commission removed the obligation to register Annex III high-risk AI systems which fall within the Article 6(3) in the EU high-risk AI database. AI systems are instead obliged instead to maintain documentation and risk assessments internally. This reduces the extent of information made publicly available and places greater reliance on providers’ internal assessments. The reform therefore represents a move towards greater reliance on self-regulation. The EU high-risk AI database in any case has been delayed until to late 2027.
3. European Business Wallet (EUBW)
The 2021 Digital CompassFootnote 44 delineated four targets to be achieved by 2030. Several initiatives were laid out in the Communication, which outlined digital transformation for citizens and businesses. The targets were supported by the Digital Europe funding programme, which committed €7.5 billion to the period 2021 to 2027 and a Regulation obliging Member States to pledge 20% of recovery funds on digitalisation.Footnote 45 However, the 2025 State of the Digital Decade Communication reported that businesses did not meet their digitalisation targets, particularly SMEs, due to “regulatory fragmentation and administrative complexity.”Footnote 46 Accordingly, in 2025, the Commission published two Communications, A Competitiveness Compass for the EUFootnote 47 and A simpler and faster Europe to forward the policy agenda.Footnote 48
a. Centralisation
One of the targets facing delay under the Digital Compass was the roll out of the European Digital Identity Wallet. Accordingly, both 2025 Communications called for an acceleration of this agenda along with the creation of European Business Wallet (EUBW). The Communications were accompanied by the EU Startup and Scaleup Strategy, which also supports a call for EUBW. The proposal for a EUBW RegulationFootnote 49 was published by the European Commission on 19 November 2025, the same day as the Data Omnibus and AI Omnibus proposals.
The EUBW builds on the European Digital Identity Framework (EUDI) and European Unique Identifiers (EUiDs). The EUBW will be fully interoperable with EUDI Wallets, as established under eIDAS,Footnote 50 which store qualified certificates for “trusted digital identities for all Europeans” aimed at providing access to “public, private and cross-border digital services.” The EUBW also draws on existing European Unique Identifiers (EUiDs) which are codes assigned to companies, commercial partnerships and 28th regime companies in the Business Register Interconnection System (BRIS). With EUBW, companies can operate across all twenty-seven Member States, eliminating the need for notarised translations of company records. The EUBW will be managed by the Commission with the establishment of a European Digital Directory.
The EUBW is also linked to the Commission’s proposals for a 28th regime, the Single Digital Gateway, the Digital Product Passport (DPP), the Interoperable Europe Act, EU company law and the VAT in the Digital Age package. The 28th regime, officially proposed as EU Inc in March 2026, was announced in the Commission’s 2025 Competitiveness Compass. It aims to incorporate start-ups through a single online portal providing them with EU-wide recognition, rather than having to register in each of the twenty-seven states separately. This represents a substantial expansion in EU level regulatory activity.
b. Standardisation
Standard-setting is central to the Digital Wallet. In its Competitiveness Compass Communication, the Commission observed that “the current European standardisation system lacks responsiveness to faster innovation cycles in emerging technologies. Engaging systematically in global standard setting processes is very important to influence outcomes aligned with EU interests, …. Alternative options must be sought to give businesses legal security on compliance with the EU rules, in situations where harmonised standards do not exist, are not available or there is an urgent need.” This statement marks a further move away from EN standard compliance towards market-driven alternatives.
The EUBW depends on the Digital Product Passport (DPP). The DPP framework was established in July 2026 and is based upon a phased rollout based upon product sector.Footnote 51 For example, legal requirements for DPPs can be found under the Ecodesign for Sustainable Products Regulation (ESPR) and the EU Battery Regulation (EU) 2023/1542 (2025 version). The chapters on DPPs require products sold in the Single Market to carry digital tracking requirements set out under the respective legislations.
The Joint CEN and CENELEC Technical Committee 24 (CEN-CLC/JTC 24) “Digital Product Passport – Framework and System” has thus far published 8 EN standards to implement the DPP under an EU Standardisation Request. Market operators using EN standards benefit from a presumption of conformity with requirements set out under the ESPR and other product legislation. However, as under most digital legislation, EN standards are not mandatory. If a market operator chooses to adopt a private or open-source standard, they can demonstrate equivalent compliance. Competing standards in this case are GS1, W3C Decentralized Identifiers (DIDs) and W3C Verifiable Credentials.
At the time of writing, the EUBW is tabled for EP committee review. Because crypto asset regulation, digital identities and the technology behind the wallets share technical and legal similarities, the legislative timeline has been grouped together with similar initiatives. As the European Commission launched a public consultation on MiCA (Markets in Crypto-Assets) in August,Footnote 52 the EUBW is not expected to be agreed until the end of 2026. All of this legislation is highly dependent on technical standard harmonisation. As in the AI Act, if harmonised EN standards are delayed or deemed insufficient, the European Commission retains the power under the EUBW proposals to adopt Common Specifications via Implementing Acts.
IV. Conclusion
The Digital Omnibus VII represents a sea change to EU digital governance. The governance architecture that emerged under the 2020 Digital Strategy relied upon co-regulation with significant oversight powers granted to NRAs, third sector bodies and ESOs. This approach reflected a commitment to EU values, high standards of data governance and ensured strict oversight of platforms, cloud services and AI systems.Footnote 53
Simplification is a governance strategy that seeks faster policy adoption with the Commission in the driving seat. A major finding of the article is that Omnibus VII is achieving these goals by reducing NRA and third-party oversight and the role of ESOs. Reporting structures are being centralised, conformity assessments simplified and reliance on EN standardisation weakened in favour of market-led solutions. These measures are strengthening the Commission’s capacity to advance both policy agreement and implementation.
There is, however, a tension between the acceleration of regulatory objectives and European autonomy. The removal of NRA oversight weakens institutional accountability at the national level, while the retreat from EN Standardisation Requests produces reliance on globally developed technical standards. This policy trajectory may have uneven effects across digital sectors. The Digital Omnibus reorients the balance of power towards greater private sector self-regulation. In the short term, this may reduce administration for firms operating across multiple regulatory jurisdictions. Over time, however, the erosion of NRA supervision and the marginalisation of ESOs risks producing a more uneven regulatory environment, where regulatory norms are shaped by those with the greatest market power rather than through EU harmonisation.
In their place, a more centralised and market-driven model is being proposed, under which compliance is met through self-regulation. Large technology firms are generally well positioned to operate within flexible and standards-driven regulatory environments and may benefit from reduced compliance burdens and delayed implementation timelines. Whereas SMEs and smaller actors may face greater regulatory uncertainty and dependency on larger groups and proprietary standards. Similarly, while the reduced role of ESOs may accelerate implementation, it may also limit the EU’s capacity to shape technical standards globally reducing the Brussels Effect. Omnibus VII could lead to a governance architecture in which legislative simplification accelerates market growth, but self-regulation empowers private actors.
Competing interests
The author declares that there are no conflicts of interest.
Open access
