What is the Digital Omnibus?
The Digital Omnibus is a simplification package the European Commission proposed in November 2025 to amend several pillars of EU digital law at once — including the GDPR, the ePrivacy rules and the AI Act. Its stated aim is to cut compliance burden, particularly for smaller companies, by consolidating overlapping obligations. It remains a proposal: the European Parliament and the Council must negotiate and adopt it, and the text can change substantially — or fail — along the way.
What the Commission proposes
- Data protection: targeted GDPR amendments, including streamlined breach reporting and clarifications on processing in the context of AI development, alongside moving cookie and terminal-equipment consent rules from the ePrivacy framework into the GDPR to reduce banner fatigue.
- AI Act: a debated postponement of parts of the application timeline for high-risk AI system obligations, tied partly to the readiness of technical standards, plus simplifications for smaller providers.
The legal dimension
Nothing is amended yet. The GDPR, the ePrivacy rules and the AI Act remain in force as adopted, and obligations continue to apply on their current dates unless and until an amending act is published. Building a compliance plan on a proposed delay is a bet, not a strategy; supervisory authorities enforce the law as it stands. The package has also drawn criticism from parts of the data protection community, which leaves the final shape of the text genuinely uncertain.
Turkish context
For Turkish companies selling into the EU, the practical answer is to keep preparing under current law and follow the legislative file, not the headlines. KVKK is untouched by the package, so domestic obligations continue regardless. If your product could fall into a high-risk category, work through our AI Act readiness checklist now — a timeline that may or may not move is no reason to pause an assessment you will need either way.
Do: track the proposal through Parliament and Council, and reassess when a final text is published. Don’t: deprioritise GDPR or AI Act workstreams because a postponement has merely been proposed.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call