By Philip Haynes. Emeritus Professor of Public Policy, University of Brighton. Research Fellow, ALFIE.
The EU’s Digital Omnibus is the first major revision to the implementation of the EU AI Act. Introduced in 2026, it delays some compliance requirements, simplifies obligations for smaller organisations, and expands restrictions on harmful AI uses such as non-consensual intimate deepfakes and AI-generated child sexual abuse material. The changes reflect growing political debate about how Europe should balance AI innovation, business competitiveness and public protection.
The reforms illustrate a shift in EU priorities. While the original AI Act focused heavily on risk management and rights protection, the Omnibus places greater emphasis on reducing regulatory barriers that businesses view as obstacles to AI innovation.
The EU Policy Process
Public policy is a complex process. Politicians have strong ideas about how they want legislation to develop. They enter government with short term agendas about delivering on manifesto pledges. Legislation is only the beginning. Laws and regulations must be implemented. The administrative process of delivering policy, through numerous organisations, and the professions they employ, can take years to happen.
For the EU, even the first, political part of the policy process, is far from straightforward. Those elected to the European Parliament make strategic decisions alongside the Council of Ministers but need the administrative power and resources of the European Commission to negotiate the details.
Like the historical international issues of containing nuclear power and the spread of contagious diseases, AI is a big enough global concern to demand much international attention. Major international organisations continue to debate whether AI development should be accelerated or subject to stricter controls.
The European Union is unique as a supranational form of government. It is praised for developing one of the world’s most comprehensive approaches to AI regulation. The EU AI Act became law in 2024. Debates and concerns about its approach to AI governance continue.
A vehicle for change – the Digital Omnibus
The path to the Digital Omnibus included some important voices. Presenter, Arba Kokalari, a member of the European Parliament (MEP) who serves on the Internal Market and Consumer Protection (IMCO) committee, championed the Omnibus for reducing bureaucracy and supporting tech startups[i]. Michael McNamara MEP, rapporteur, spoke for a continuing focus on civil liberties safeguards, including a ban on non-consensual intimate imagery apps[ii]. German Chancellor, Friedrich Merz, when reflecting on the EU AI Act, argued too much regulation was impeding industrial AI applications[iii]. Most member states supported pragmatic adjustments to timelines and regulatory technical overlaps. This is seen as a method to reduce complex bureaucracy.
Big tech companies lobbied for regulation to be streamlined and more time to be given for required adjustments. Some civil society organizations criticized the Omnibus seeing it as a retreat from hard-won consumer and human rights.
Modifications are agreed: encouraging AI economic growth
In the summer of this year, the Digital Omnibus (Regulation (EU) 2026/1744) made amendments to the Act. It delivered for the business lobby who thought governance was causing costly regulatory development at too rapid a pace. It also embraces needed changes to prevent abuses and therefore seeks to represent other stakeholder groups, in addition to business interests.
Its overall goal is to smooth implementation, reduce compliance costs, and close urgent regulatory gaps. Requirements for high-risk AI systems are reduced where equivalent protections already exist in other product‑safety legislation. High‑risk systems can be tested outside of designated AI sandboxes. Member States can also create frameworks for real‑world testing of certain high-risk systems.
A new Article allows exceptional processing of special‑category data collection for bias detection and correction in high‑risk systems. This is subject to: strict necessity, pseudonymisation, limited access, deletion after use, and documentation of justification.
There is a clarification of the required safety components, this to minimise organisational regulatory costs. AI used only for convenience, optimisation, or quality-control is not a safety component – unless its failure endangers health or safety.
There is simplified compliance for small businesses. Streamlined technical documentation will be accepted by notified bodies. Quality‑management requirements are proportionate to organisational size and complexity. Conformity‑assessment bodies can use single applications and unified assessment procedures across the AI Act and product‑safety legislation.
Providers and deployers must support staff AI literacy but are not required to guarantee any specific level. The Commission and Member States must provide examples and frameworks.
Reducing public harm
Actions designed to reduce public harms include an EU‑wide prohibition on non‑consensual intimate deepfakes (realistic sexual imagery/audio/video of identifiable people), and AI‑generated child sexual abuse material. This places more responsibility on deployers of AI systems to prevent such occurrences.
The European Commission AI Office gains additional governance and enforcement responsibilities. The Commission and AI Office receive expanded supervisory and enforcement responsibilities, particularly for general-purpose AI models and certain large-scale services. Individual EU member states cannot independently set rules for these international services and penalize them. The Commission can run EU‑level sandboxes, so these no longer occur solely under national jurisdiction.
There are amendments to aviation and machinery regulations to make them fully compatible with the amended EU AI Act.
Reactions and reflections to the Omnibus
Oleart & Moleón (2026) are concerned about the Omnibus changes. They argue the most powerful influence for global AI use are the Big Tech companies. Governments in comparison are reactive to AI innovations. Their concern is that too much responsibility for policing AI is placed on individual citizens through media literacy that depends on citizens having the skills and actions to manage their interaction with AI. They want to see the supremacy of corporate digital systems more challenged with a shift towards using the democratic system that is empowered to control Big Tech power[iv].
Casey & Colonna (2026) question the legitimacy of the Omnibus to change aspects of the EU AI Act. This is because the Omnibus process departs from some important protections in the EU legislative process. They write that the Digital Omnibus reshapes the policy process. It moves the implementation of the AI Act to prioritising competitive technological developments above human rights with democratic legitimacy[v].
Skiotytė & Sadauskaitė’s study was prepared at the request of the European Parliament’s Committee for the Internal Market and Consumer Protection (IMCO). It analyses the Digital Omnibus proposals. They observe a loosening of procedures to facilitate more competition that is concurrent with a wider EU level market guidance. The relationship of the General Data Protection Regulation (GDPR) with the EU AI Act is seen as of major importance[vi].
A report from the Centre on Regulation in Europe (CERRE) about Data Protection for AI examines how the Omnibus clarifies legal interpretations and data protection rights in the context of assisting AI innovation. They acknowledge the importance of considering if consent is always necessary when training AI data before its deployment. They observe that important implementation issues remain and need further research, for example, reconciling the future application of the GDPR alongside the evolving AI EU Act. They note a focus on changing timelines, reducing administrative costs, and increasing regulatory centralisation[vii].
Conclusion
In conclusion, the Digital Omnibus facilitates the process of businesses, governments and advocacy groups impacting the implementation of EU AI legislation and regulation. A debate continues about which voices are being listened to the most. It shifts the on-going dynamic between broad policy formulation and implementing day-to-day regulatory requirements. The Omnibus tries to strike a balance between encouraging EU nations to grow AI businesses and to compete globally, while sustaining citizen’s concerns about risks to human and consumer rights.
References
[i] Transcript: European Parliament. https://www.europarl.europa.eu/doceo/document/CRE-10-2026-06-15-ITM-015_SV.html
[ii] Transcript: European Parliament. https://www.europarl.europa.eu/doceo/document/CRE-10-2026-06-15-ITM-015_SV.html
[iii] https://www.reuters.com/business/germanys-merz-says-industrial-ai-needs-less-stringent-eu-regulation-2026-04-19/
https://www.implicator.ai/merz-seeks-industrial-ai-carve-out-before-eu-rules-bite-in-august/
[iv] Alvaro Oleart & Alejandro Flores Moleón, 2026. “Why the EU’s Technosolutionist Focus on AI and Media ‘Literacy’ Empowers Big Tech: Centering Structural Approaches to Counter the Undemocratic Political Economy of Surveillance Capitalism,” Social Sciences, MDPI, vol. 15(7), pages 1-18, June.
[v] Casey, D., & Colonna, L. 2026. “The Digital Omnibus on AI, Legislative Legitimacy and the Dynamics of AI Regulation,” arXiv preprint arXiv:2606.15662. https://doi.org/10.48550/arXiv.2606.15662
[vi] Goda Skiotytė, Audronė Sadauskaitė, 2026. “A Digital Omnibus: Identifying Interlinks and Possible Overlaps Between Different Legal Acts in the Field of Digital Legislation to Streamline Tech Rules.”
Brussels: European Parliament, Policy Department for Economy and Growth.
[vii] Centre on Regulation in Europe (CERRE) 2026. “Data Protection Fit for AI” Brussels: Belgium. CERRE.