European Union Releases Plan to Overhaul Digital Technology Regulations

The proposed changes would effect the General Data Protection Regulation (GDPR) passed in 2016, which emerged as the poster child for the so-called Brussels Effect in which EU rules become a de facto global standard; the Data Act passed in 2023, and the AI Act, passed in 2024 but still in the process of being fully implemented.

That process could now slow down if the proposals are adopted by the European Parliament and the Council of Europe. As passed, the AI Act anticipated rules for AI models deemed to pose the highest systemic risk would go into effect on August 2, 2026. Under the proposed changes, the timing of that deadline would be linked to availability of technical standards and other tools to support implementation, which could stretch into 2027.

Oversight of the AI Act’s rules would also be centralized under the AI Office in Brussels rather than being managed by national authorities.

Other proposed changes include simplifying cybersecurity reporting by a single point of contact where incident reports can be filed, and loosening GDPR rules to allow certain personal data to be used to train AI models.

The proposals, 11-months in the making, are the fruits of a September 2024 report by the former head of the European Central Bank, Mario Draghi, that put a spotlight on Europe’s lack of technology competitiveness with the U.S. and China. The report was particularly critical of the EU’s deep thicket of regulations for holding back innovation on the continent, suppressing outside investment, and causing home-gown entrepreneurs to look outside the EU for the capital and technical talent needed to grow their businesses.

Read more: Plaintiffs’ Lawyers Dust Off Legacy Privacy Statutes to Challenge Digital Tracking Technologies

The current European Commission headed by President Ursula von der Leyen, which took over in February, championed the Draghi report and embarked on an ambitious plan to simply the 27-nation bloc’s regulatory structures to boost investment and innovation.

The U.S. under President Trump has also been critical of the EU’s Digital Markets and Digital Services Acts, as well as the AI Act, and has pressured the Commission in trade talks to strip away rules the White House sees as overly restrictive on U.S. companies.

Reaction to the Omnibus from industry and civil society was mixed. While some technology industry groups applauded the release of the Omnibus, others insisted the proposed changes do not go far enough.

“[T]his package must only be the starting point for deeper reform of the EU’s digital rulebook,” the Computer and Communications Industry Association (CCIA) said in a statement. “Major challenges previously identified by CCIA Europe remain unresolved, including continued friction across the digital ecosystem from the Digital Services Act and Digital Markets Act.”

Consumer and civil society groups were generally negative on the proposed changes. “The Omnibus package unacceptably weakens the once proud EU digital framework and short-changes the EU, trading away robust guarantees for the uncertain promise of expedited competitiveness – a promise not built on evidence,” Center for Democracy and Technology Counsel and Director of the Equity Laura Lazaro Cabrera said in a statement. “The proposals rest on the flawed premise that the removal of core protections and safeguards designed to protect people and the public interest benefit the EU at large, only because they might benefit innovation.”

The proposed changes must now be voted on by the European Parliament. If approved, the Omnibus would then then need to be blessed the Council of Europe, made up of representatives from the 27 EU countries.

Any changes to the proposal by Parliament or the Council would need to be reconciled  with the Commission version through the EU Trilogue Process.