LEGAL NEWS IN THE SPOTLIGHT | First draft of Digital Omnibus package released

On 19 November 2025, the European Commission published the first draft of the so-called Digital Omnibus package, a set of two legislative proposals aimed at reducing the administrative burden on businesses and streamlining the EU regulatory framework in the fields of artificial intelligence (AI), cybersecurity and data.

The first proposal, under COM (2025) 836, introduces targeted amendments to the recently adopted AI Act, with the aim of refining certain regulatory requirements applicable to AI systems. The second proposal, under COM (2025) 837 (Digital Omnibus Regulation), has a broader horizontal scope and seeks to update and align several existing EU digital legislations. In particular, it proposes amendments affecting EU data and privacy legislation, including the GDPR, the Regulation (EU) 2023/2854 (Data Act) and the Directive 2002/58/EC (ePrivacy Directive), as well as EU cybersecurity legislation, by amending the Directive 2022/2555/EU (NIS 2 Directive).

From an AI perspective, the most relevant intervention concerns the regulation of high-risk systems under the AI Act. In particular, the proposals seek to bring forward the entry into force of certain key provisions applicable to such systems, as well as to further clarify and narrow the scope of AI systems qualifying as high-risk.

From a personal data protection perspective, the proposals introduce a limited number of amendments which may nonetheless have a significant practical impact. In particular, the package introduces a definition of non-personal data, clarifying the circumstances under which data falls outside the scope of EU data protection laws. Further clarifications are provided with regard to the interpretation of the concept of “automated decision-making”. In addition, the proposals clarify that the legal basis of legitimate interest may be relied upon for certain AI development activities. Relevant updates also concern cookies and other tracking technologies, with the aim of harmonising the EU regulatory framework.

From a cybersecurity perspective, the proposals introduce changes to the incident management and notification framework by establishing a single entry point for incident notifications to EU authorities.

The proposals are still subject to the ordinary legislative procedure and will therefore undergo further discussion and amendments.

Newsletter n. 113 – December 2025