EU prepares digital omnibus to cut red tape amid privacy and sovereignty fears

The European Commission will publish its long-awaited digital omnibus on 19 November, a single legislative package intended to cut through a thicket of overlapping rules that businesses say stifle innovation. The omnibus targets three core areas: the ePrivacy directive's cookie and tracking consent requirements, duplicate incident-reporting obligations under the NIS2 directive and the Cyber Resilience Act, and clarifications to the Artificial Intelligence Act on high-risk categories, general-purpose model obligations and consistency with data-sharing frameworks. Commissioner Henna Virkkunen framed the exercise as delivering an innovation-friendly rulebook that reaches the same objectives at lower cost.

Commission promises less paperwork, same protections

In a September press release, Virkkunen said the goal is less paperwork, fewer overlaps and less complex rules for companies operating in the EU. The Commission argues that aligning privacy provisions in the ePrivacy directive with GDPR and Digital Services Act standards will reduce fragmentation. Harmonising NIS2 and Cyber Resilience Act reporting aims to end the situation where companies file near-identical notifications to multiple national authorities. On AI, the omnibus is expected to address complaints that definitions of high-risk systems and obligations for general-purpose models remain ambiguous, creating compliance uncertainty for SMEs and large firms alike.

The Commission also points to definitional incoherence across the Data Act and Data Governance Act, where terms such as data holders, intermediaries and public sector bodies are used inconsistently. Officials say the omnibus will not lower substantive protection levels but will streamline processes. Critics, however, note that the line between procedural simplification and substantive deregulation is easily crossed when multiple major regulations are reopened simultaneously.

Big tech lobby pushes for deeper cuts

On 15 October, the Computer and Communications Industry Association (CCIA), whose members include Apple, Amazon and Meta, launched a campaign urging the Commission to expand its simplification ambition. Vice-president Daniel Friedlaender said efforts are moving in the right direction but not fast enough, calling for real ambition and decisive action. The CCIA argues that current rules create barriers to entry and slow deployment of new services. Its position carries weight in Brussels, but it also reinforces the perception among civil society that the omnibus is being shaped by the very companies whose market power the original regulations sought to constrain.

Franco-German axis applies political pressure

France and Germany have turned simplification into a bilateral project. Their September economic agenda calls for substantially easing the complexity of the EU regulatory environment to unleash growth and productivity. The agenda explicitly mentions looking deeper into GDPR for additional adjustments, going beyond the Commission's stated scope. A Berlin Digital Sovereignty Summit on 18 November, the day before the omnibus publication, will bring public and private stakeholders together to press the case. Germany's digital minister Karsten Wildberger told Reuters that digital sovereignty does not mean protectionism and European companies must actively participate as players in the global market. In June, President Emmanuel Macron hosted Nvidia chief executive Jensen Huang at the Élysée, where Huang reportedly joked that Europe's problem is being too slow on tech-law upgrades.

EU backs its own AI champions with billions

The simplification drive sits alongside a massive public investment push. The Commission's InvestAI initiative, launched in February, aims to mobilise €200 billion for AI development through what von der Leyen called the largest public-private partnership for trustworthy AI. Additional programmes include the AI in Science Strategy, Apply AI Strategy, AI Innovation Package and AI Factories. The goal is to close a compute gap: the 2025 State of AI report by Nathan Benaich and Air Street Capital found the United States holds roughly 75 percent of global AI supercomputer capacity, nine times more than China and seventeen times more than Europe. European ventures such as Mistral AI, Black Forest Labs and Aleph Alpha are valued at a fraction of US rivals, Mistral at $14 billion in 2025 versus OpenAI's $500 billion, and argue that regulatory drag compounds the resource disadvantage.

European AI firms demand a two-year pause

Mistral AI, Black Forest Labs and 56 other companies signed an open letter to von der Leyen under the EU Champions AI Initiative, requesting a two-year clock-stop on implementing AI Act requirements. They contend the law as it stands jeopardises not only the development of European champions but the ability of all industries to deploy AI at the scale required by global competition. The letter reflects a broader tension: the same companies that benefit from public funding and a protected regulatory market now say that market's rules are the obstacle. Whether a pause is legally feasible without amending the Act itself remains unclear.

The €60 billion compliance bill

Industry's strongest quantitative argument comes from Digital Europe, which estimates that overlapping cybersecurity regulations cost companies at least €60 billion annually in compliance. Multiple authorities, multiple formats, multiple deadlines, the burden falls hardest on mid-sized firms that lack dedicated regulatory teams. Simplification here is tangible: a single reporting channel, a common taxonomy, a unified deadline. The Commission's impact assessment for the omnibus is expected to cite this figure heavily. Yet the same logic applied to privacy rules produces a different calculus: the cost of weaker consent mechanisms is borne by individuals, not balance sheets.

Civil society and academics sound the alarm

In multiple open letters, researchers and rights groups have warned that the speed and breadth of the omnibus risk reopening settled political compromises. Plixavra Vogiatzoglou, a PhD candidate studying digital sovereignty, said simplification of ePrivacy rules on cookies and other tracking technologies is liable to affect safeguards against arbitrary or disproportionate state or commercial surveillance. Professor Kristina Irion of the University of Amsterdam argued the Commission is rushing towards digital simplification when the bigger fish to fry is effective implementation and scalable enforcement. Ella Jakubowska of European Digital Rights (EDRi) was blunt: there is no doubt this is really about deregulation. She warned that weakening AI Act safeguards could expose citizens to algorithmic harms such as AI-driven discrimination, and that rewiring regulations jeopardises the EU's credibility in an uncertain geopolitical landscape.

Parliamentary resistance emerges

German social-democrat MEP Birgit Sippel told EUobserver that with ePrivacy dismantled, Europeans are left with nothing but the Charter to defend their right to privacy, while US tech giants enjoy a carte blanche to exploit data for profit. Her intervention signals that the omnibus will face scrutiny in the European Parliament, where the Committee on Civil Liberties, Justice and Home Affairs (LIBE) holds sway over ePrivacy. The Parliament's position could force the Commission to narrow the package or accept amendments that preserve core consent requirements.

Geopolitical context hardens the debate

The simplification drive unfolds against a backdrop of intensifying US pressure. In July, President Trump signed an executive order directing that American AI technologies, standards and governance models be adopted worldwide. Professor Daniel Mügge has observed that in digital tech, US corporate and political power are increasingly indistinguishable. The United Kingdom offers a cautionary case: in September, Prime Minister Keir Starmer hosted Huang and other US tech leaders to announce more than £31 billion in AI funding, drawing criticism that Britain was handing strategic control to American firms. AlgorithmWatch responded to US pressure on the EU with an open letter stating that European democracy and the rights and freedoms of European citizens are not for sale at any price.