Introduction to the The European Commission’s Digital Omnibus Package

The European Commission’s Digital Omnibus Package, unveiled on 19 November 2025, is a crucial step towards simplifying and streamlining the digital regulatory framework across data access, privacy and cybersecurity. It aims to reduce complexity and make compliance easier and less costly for businesses. This wide-ranging Proposal for a Regulation on simplification of existing digital legislation will now be discussed and amended by the European Parliament and Council. Whilst these proposals are subject to the outcome of months of institutional discussions to come, they should be considered as the Commission's viewpoint at the start of what is likely to be a lively debate and intense negotiation. 

The full package of measures, includes:

• Amendments to the EU Data Act;
• Establishing a single reporting point for all incidents under the General Data Protection Regulation (GDPR), the Network and Information Security Directive 2 (NIS2), the Digital Operational Resilience Act (DORA) and the Critical Entities Resilience Directive (CER);
• Abolishing the Platform to Business (P2B) Regulation;
• Changing the “cookie consent” rule;
• Amending the definition of personal data and special category data; and
• Allowing the processing of personal data to train AI models based on a legitimate interest

On 19 November, the Commission also launched a Digital Omnibus on AI Regulation Proposal (AI Omnibus) focused on amending aspects of the EU AI Act.

On the same date, the Commission published a Recommendation on non-binding model contractual terms on data access and use and non-binding standard contractual clauses for cloud computing contracts under the Data Act. Looking ahead, the Commission is expected to come forward with Guidelines on reasonable compensation to clarify what can be charged to data recipients for data sharing under Article 5 of the Data Act. The EU executive has also announced its intention to work on a Data Act legal helpdesk to assist companies with concrete questions on how to apply the new rules.

Given the importance of the Digital Omnibus Package and the AI Omnibus, various Committees in the European Parliament are now vying to take the lead on drafting reports and amending the proposals. Regarding the next steps, a tentative timeline is provided below. Note that this timeline is subject to change, depending on the degree of consensus that emerges between the positions taken by the European Commission, the European Parliament and EU Member States represented by the Council.

We will continue to monitor developments throughout the legislative process and keep you informed of significant changes that may affect your business operations.

Prospective timeline:

• December 2025: The European Commission sends its proposals for the Digital Omnibus package to the European Parliament which will begin the process of allocating the proposals to the relevant committee(s). The Committee on Industry, Research and Energy (ITRE) and the Committee on Civil Liberties, Justice and Home Affairs (LIBE) are likely to play leading roles, along with the Committee on the Internal Market and Consumer Protection (IMCO) and the Legal Affairs Committee (JURI)
• From January 2026 onwards: Once the lead and opinion Committees have been confirmed, political groups will nominate rapporteurs and shadow rapporteurs to draft the Parliament’s reports. Members of the European Parliament (MEPs) will then begin the process of discussing the proposals and tabling amendments, with the aim of adopting final Reports by Q2 2026;
• Council discussions: In parallel, representatives of the 27 EU Member States in the Council will begin technical talks to prepare their position, known as a “general approach”, expected in Q2 2026;
• Q2/Q3 2026: Once the responsible European Parliament Committees adopt their final reports, they should be endorsed in a vote by all MEPs in plenary session. If the Council has also agreed to its approach, interinstitutional “trilogue” negotiations can begin. These negotiations between the European Commission, European Parliament and Council—which could kick off in late spring/summer 2026—will aim to reach a final compromise text;
• Q3/Q4 2026: If discussions go smoothly, final adoption could be expected by mid to late 2026. The EU institutions will feel under pressure, in particular, to reach a final consensus on the AI Omnibus proposal by 2 August 2026, which is the original date for the full application of “high-risk” AI rules  under the EU AI Act. If the AI Omnibus is not adopted by this date, the original “high-risk” rules could kick in anyway, before the support infrastructure to guide compliance is in place. This could lead to incomplete compliance guidance and legal uncertainty for businesses.

While the eventual timeline will depend on the speed of the negotiations, it cannot be completely ruled out that the European Parliament could decide to apply its urgent procedure (under Rule 170 of its Rules of Procedure). This would allow the proposals to bypass the full Committee stage and go directly to a vote during a parliamentary plenary session. However, this appears unlikely given the importance of these proposals and the very mixed reception they have received from various political parties. MEPs can be expected to demand full scrutiny of the Omnibus proposals.

How our Regulatory & Public Affairs team can help:

• Monitoring and intelligence: tracking developments in real time, including Committee debates, amendments, the positioning of political parties and deadlines;
• Advocacy strategy: Preparing tailored engagement plans to position your priorities effectively during the examination of the proposals by the EU institutions and during the trilogue negotiations;

• Messaging and outreach: Drafting briefing materials and voting recommendations, in addition to facilitating direct dialogue with policymakers to ensure your voice is heard.

   

Discover more in Connected, our Regulatory & Public Affairs newsletter.