The Digital Omnibus: GDPR, Cookies and AI Act Changes

The digital omnibus package: two proposals, two different outcomes

On 19 November 2025 the European Commission presented its digital omnibus package to simplify the EU's digital rulebook. It consisted of two legislative proposals. The first, the Digital Omnibus on AI (COM(2025) 836), amended the AI Act and has already been adopted: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

The second, the broader Digital Omnibus Regulation (COM(2025) 837), proposes changes to the General Data Protection Regulation (GDPR), the ePrivacy Directive's cookie rule, the Data Act, incident reporting under NIS2 and other instruments. That proposal is still in the legislative process. For companies, the digital omnibus therefore means two things at once: AI Act changes that already apply, and GDPR and cookie changes that may come but are not yet law.

The AI part of the digital omnibus: what has changed

Regulation (EU) 2026/1744 of 8 July 2026 makes targeted amendments to the AI Act. The most significant changes are:

• Later dates for high-risk AI: the obligations for high-risk AI systems in Chapter III, Sections 1–3 apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for systems that are safety components of products covered by Annex I harmonisation legislation, instead of 2 August 2026.
• AI literacy: Article 4 now requires providers and deployers to take measures to support the development of AI literacy of their staff and others operating AI systems on their behalf; it expressly does not require them to guarantee any specific level of literacy, and the Commission and Member States must support compliance, in particular for SMEs.
• Transparency grace period: providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking duty in Article 50(2).
• New prohibitions: AI systems that generate or manipulate non-consensual intimate imagery of identifiable persons or child sexual abuse material are prohibited from 2 December 2026, subject to conditions on intended purpose and safeguards.
• Bias detection: a new Article 4a allows providers of high-risk systems to process special categories of personal data where strictly necessary for bias detection and correction, with safeguards.
• SMEs and small mid-caps: simplified obligations and proportionate penalties.
• Machinery: the Machinery Regulation moves to the list of harmonisation legislation in Section B of Annex I.

See our insight on the AI Act timeline for the full revised schedule.

The GDPR and data part of the digital omnibus: the proposals

The Digital Omnibus Regulation proposal contains a wide range of amendments. The most important for businesses are:

Where the legislative process stands

The Council worked on the proposal throughout the first half of 2026. On 22 June 2026 the Council's General Secretariat submitted a Presidency compromise text to the Permanent Representatives Committee for confirmation as the Council's mandate for negotiations with the European Parliament (Council document 10729/26).

According to that document, the compromise text amends fourteen GDPR articles, keeps the 96-hour notification deadline, regulates cookies through an amendment to Article 5(3) of the ePrivacy Directive rather than a new GDPR provision, and gives Member States flexibility in setting up a national entry point for incident reports. The European Council had called for all pending omnibus packages to be agreed before the end of 2026.

As at November 2026, we have not seen the Digital Omnibus Regulation adopted or published in the Official Journal. Its content may still change in negotiations with the European Parliament, and the final text will apply only from the dates it sets. Until then, the current GDPR, the German Telecommunications Digital Services Data Protection Act (TDDDG) and the Data Act apply unchanged.

What the cookie changes could mean

For cookie consent, the proposal aims to reduce consent fatigue. Certain purposes — such as aggregated audience measurement by the website operator and security — would no longer require consent, controllers would have to respect a refusal for a period before asking again, and websites would eventually have to accept automated, machine-readable signals of users' choices once standards exist.

Media service providers could be exempted from the duty to accept such signals. The Council text places these rules in the ePrivacy Directive instead of the GDPR, which affects enforcement: in Germany, § 25 TDDDG implements the ePrivacy rule and would need to be amended. See our insight on cookie consent under the TDDDG.

Data Act and the data acquis

The proposal also restructures the EU data acquis. According to its title, it would repeal the Free Flow of Non-Personal Data Regulation, the Data Governance Act, the Platform-to-Business Regulation and the Open Data Directive, integrating relevant parts into the Data Act.

It would also make targeted changes to the Data Act itself; during the Council negotiations, the protection of trade secrets under the Data Act was one of the main topics. For businesses that are implementing the Data Act's access, sharing and cloud switching rules, the practical message is that the core obligations remain, while some details may change. See our insights on access by design under the Data Act and cloud switching.

A single entry point for incident reporting

Companies that suffer a cyber incident may currently have to report to several authorities under the GDPR, NIS2, DORA, the CER Directive and sector rules, each with its own form and deadline.

The digital omnibus proposes a single entry point through which incident reports under several instruments can be submitted, with data breach notifications under the GDPR channelled through it. The Council's text gives Member States flexibility to establish a national entry point. In Germany, a joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance already receives NIS2 reports, which could serve as a building block. See our insight on incident response after a cyber attack.

Implications for German law

Several German statutes would need to be adapted once the digital omnibus is adopted. The TDDDG, which implements the ePrivacy cookie rule in § 25, would have to reflect any amendment of Article 5(3) of the ePrivacy Directive. The Federal Data Protection Act contains provisions on access requests, information duties and employee data that would need to be checked against the amended GDPR. The NIS2 implementation in the BSI Act would have to accommodate the single entry point. Companies should expect a period in which EU and German rules are adjusted step by step.

What the GDPR changes could mean

The proposed relative concept of personal data would codify recent case law of the Court of Justice and could reduce the scope of the GDPR for recipients of pseudonymised data. The changes to access requests respond to the use of Article 15 GDPR as a litigation tool, particularly in employment disputes.

Breach notification would become less burdensome for low- and medium-risk incidents, while the information duties would be lightened where data subjects already know how their data are used. Together, these changes would mainly benefit companies with large numbers of routine processing operations. Critics, including the European Data Protection Board and the European Data Protection Supervisor in their joint opinion of February 2026, have warned against weakening protections, so the final balance remains open.

When could the GDPR changes apply?

Once the European Parliament and the Council agree on a final text, it must be formally adopted, published in the Official Journal and enter into force. The Commission's proposal provides for staggered application dates for some provisions — for example, the new cookie rules would apply a set period after entry into force — and the final text may introduce further transitional periods.

Realistically, companies should not expect the GDPR and cookie changes to apply before 2027, and some elements, such as machine-readable consent signals, depend on technical standards that do not yet exist. The AI part shows how quickly the institutions can move when deadlines press, but the GDPR part is politically more sensitive.

The digital omnibus is part of a broader simplification agenda that also includes omnibus packages on sustainability reporting, investment and other areas. For compliance planning, companies should track each package separately, because their timelines and content differ.

Practical steps for companies

1. AI Act: update AI compliance roadmaps to the new dates for high-risk systems and the revised AI literacy obligation.
2. Generative AI providers: meet the Article 50(2) marking duty by 2 December 2026 for systems already on the market, and from the start for new systems.
3. GDPR and cookies: monitor negotiations and prepare adaptable processes, but do not change current compliance.
4. Incident reporting: map all reporting duties and prepare for a possible single entry point and longer deadlines.
5. Data Act: continue implementing current Data Act obligations; see our insight on data sharing contracts under the Data Act.

How TRW & Co helps with the digital omnibus

We help companies translate the digital omnibus into practical compliance plans: updating AI Act roadmaps to the amended dates, reviewing AI literacy and transparency measures, tracking the GDPR and cookie negotiations, and preparing adaptable processes for breach notification, access requests and consent management. We monitor the legislative process and update clients when the final text is agreed. See our pages on GDPR and data protection and the AI Act, or contact us.