In recent years, Europe has built an ambitious — yet also complex — digital ecosystem: the Data Act, Data Governance Act, GDPR, ePrivacy, NIS2, DORA, DMA, AI Act… A framework which, while protecting rights and fostering innovation, has generated overlaps, regulatory burdens and a lack of legal clarity.
The Digital Omnibus is the European Commission’s response to this challenge. It does not introduce new substantive obligations; rather, it simplifies, consolidates and harmonises the existing framework, enabling businesses, public authorities and consumers to operate in a clearer, more efficient and more competitive environment.
Below we set out the main amendments introduced by the Digital Omnibus affecting the new Artificial Intelligence Regulation (AI Act):
1. Preservation of the main obligations of the AI Act
In general terms, the Digital Omnibus does not introduce substantive changes to the obligations applicable to providers and deployers of AI systems. In particular, obligations relating to high-risk AI systems remain essentially unchanged, and in some cases have only been clarified, refined or further developed by this new regulation.
2. AI literacy: the obligation is shifted to the States
The obligation for providers and deployers to train their staff in AI literacy is removed. Instead, responsibility is transferred to the European Commission and the Member States, which must promote training and capacity-building, without imposing a direct requirement on companies.
3. Elimination of duplications in relation to obligations covered by sectoral legislation
The Digital Omnibus introduces a single application and assessment procedure for conformity assessment bodies that must be designated both under the AI Act and under applicable EU sectoral harmonisation legislation. Where provided for in such sectoral legislation, this mechanism avoids administrative duplication, relies on existing procedures and ensures simultaneous compliance with the requirements of the AI Act and the relevant sectoral framework.
This possibility is also extended to already notified bodies applying for designation under the AI Act.
4. Strengthening of the AI Office
The role of the AI Office is significantly reinforced as a central supervisory and enforcement authority for certain categories of AI systems. In particular, it is granted exclusive competence over systems based on general-purpose AI models developed by the same provider, as well as over systems integrated into very large online platforms and search engines, thereby centralising enforcement and avoiding regulatory fragmentation.
In addition, its investigative, monitoring and enforcement powers are expanded, including the ability to carry out conformity assessments and adopt coercive measures, subject to procedural safeguards. The AI Office is also empowered to establish an EU-level regulatory sandbox, reinforcing its role both in supervision and in support of innovation.
5. Use of personal data for AI training
The Digital Omnibus establishes a specific and exceptional legal basis for the processing of special categories of personal data by providers and deployers of AI systems and models, where such processing is strictly necessary for the detection and correction of bias.
This authorisation is subject to strict conditions of necessity and proportionality, as well as enhanced technical and organisational safeguards, and is articulated in coherence with the GDPR. The measure does not constitute a general authorisation for the use of sensitive data in AI training, but rather a limited and purpose-specific clarification, aimed at preventing discrimination risks and ensuring the reliability of AI systems.
6. Real-world testing of high-risk AI systems
The Digital Omnibus makes the regime for real-world testing of high-risk AI systems outside controlled testing environments more flexible, extending its scope to systems listed in Annex III and to those covered by EU sectoral harmonisation legislation (Annex I, Section A), always prior to their placing on the market and on the basis of a specific testing plan.
It also introduces a specific regime for systems integrated into products regulated under Annex I, Section B, making such testing subject to voluntary agreements between the Commission and the Member States, with reinforced safeguards.
7. Extension of implementation timelines
The Digital Omnibus introduces changes to the initial timetable for the application of certain AI Act obligations, mainly those relating to high-risk AI systems:
- High-risk AI systems already placed on the market will only be subject to the obligations of Chapter III of the AI Act if, after the Regulation becomes applicable, they undergo significant modifications to their design.
- A specific transitional period is introduced for generative AI systems placed on the market before 2 August 2026, which must comply with content labelling and detection obligations by 2 February 2027.
- The obligations set out in Articles 8 to 15 will not apply automatically on 2 August 2026, but will instead be linked to the adoption of a Commission decision confirming the availability of harmonised standards, common specifications or guidelines. Once such a decision is adopted, these obligations will apply after:
- a six-month transitional period for high-risk AI systems classified under Article 6(2) and Annex III; and
- a twelve-month transitional period for high-risk AI systems classified under Article 6(1) and Annex I (harmonised legislative acts).
- In any event, the Digital Omnibus sets definitive deadlines: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, from which date the obligations will be fully enforceable.
At Across Legal, we support companies and organisations in interpreting and applying the new European digital regulatory framework, combining legal rigour, strategic vision and a practical approach.
📩 Contact us and turn your next challenge into a shared opportunity.
↳ Discover more content in the section Insight.
↳ Do you want to stay up today about the sector related news? Follow us on LinkedIn.
