The proposed EU Digital Omnibus Regulation signals a decisive shift in how the European Union intends to balance innovation, accountability and regulatory complexity in its digital economy. On 19 November 2025, the European Commission unveiled the proposal, aimed at simplifying and modernising the EU’s digital rules.
The Omnibus seeks to close gaps, remove duplications and address inconsistencies across existing regimes, making compliance easier to navigate for organisations.
Targeted adjustments are expected to be introduced across the AI Act, Network and Information Security Directive 2 (NIS2), Digital Operational Resilience Act (DORA) and the GDPR, with the proposal now entering negotiations between the European Parliament and the council. While formal adoption is not anticipated until 2027-2028, the direction of travel is very clear: organisations operating across the EU will be expected to move away from siloed compliance efforts acrossintersecting regulatory obligations and instead adopt a more integrated, system-wide approach to digital compliance.
Proposed changes:
GDPR
- This Regulation would extend the personal data breach notification requirement from 72 hours to 96 hours, while also raising the threshold for reporting breaches to only high-risk cases. The European Data Protection Board (EDPB) will prepare a standardised reporting template and a list of high-risk scenarios.
- It also seeks to clarify that pseudonymised data held by an entity which does not have the means to reasonably identify the data subject will not be considered personal data.
AI Act
- The Omnibus will delay application of high-risk AI obligations until compliance support is available, with longstop deadlines of December 2027 and August 2028, depending on system types. It also provides a strengthened role for the AI Office in supervising general-purpose AI and integrated systems.
- It will also streamline documentation requirements and provide extended relief for SMEs and mid-caps.
Data Law Consolidation
- The Omnibus proposes integration and repeal of overlapping data instruments into a consolidated regime (e.g., Data Governance Act, Free Flow of Non-Personal Data Regulation, Open Data Directive, etc.), simplifying data access and sharing obligations with the Data Act to be the central legislation for all data access, usage and sharing rights of data.
Cookies
- The Omnibus will streamline cookie regulations by moving relevant ePrivacy Directive rules into the GDPR and simplifying consent requirements in low-risk situations.
What does this mean for organisations:
As the Digital Omnibus proposal progresses toward adoption, organisations should begin assessing how potential changes across the AI Act, NIS2, DORA and the GDPR may affect existing governance and compliance structures. While the stated aim is simplification, the consolidation of multiple regimes is likely to introduce short-term complexity for organisations operating across jurisdictions.
The role of the Data Protection Officer is likely to become increasingly important in this context. With a cross-cutting view of data protection, accountability and risk, the DPO is well placed to support organisations in coordinating compliance efforts across regimes and ensuring that governance measures are both defensible and operationally workable. Early involvement of the DPO can help organisations avoid fragmented approaches and support more coherent, risk-based decision-making as the regulatory landscape evolves.
At HewardMills, we are experienced in supporting organisations in navigating regulatory change through practical, multi-jurisdictional privacy and data governance advice. Our team works with clients to anticipate regulatory developments, align compliance frameworks across borders, and embed privacy-by-design into business operations, ensuring compliance remains resilient as the EU’s digital framework evolves. Contact us to find out more.
