Commission launches major effort to simplify EU digital rules

The European Commission announced September 16, 2025, its comprehensive Digital Omnibus initiative designed to simplify digital regulations affecting businesses across artificial intelligence, cybersecurity, and data governance. According to the call for evidence published September 16, the initiative seeks to cut administrative burden by at least 25% for all companies and 35% for small and medium-sized enterprises through streamlined compliance processes and reduced regulatory fragmentation.

The announcement follows Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen's statement emphasizing the need for "less paperwork, fewer overlaps and less complex rules for companies doing business in the EU." According to the Commission's official press release, the initiative represents the first step in the broader Digital Package on Simplification strategy launched under the Commission's Work Programme for 2025.

The Digital Omnibus specifically targets five critical areas requiring immediate regulatory adjustment. Data legislation receives primary focus, addressing what the Commission describes as "outdated nature of some of the rules and the need for further coherence and predictability." The current data acquis fragments rules across multiple instruments, creating unnecessary complexity for businesses implementing data-driven business models.

Cookie and tracking technology regulations face significant modification under the omnibus proposal. According to the Commission's documentation, changes to the ePrivacy Directive's "cookie article" will reduce instances requiring user consent while strengthening privacy rights through simplified management mechanisms. The initiative aims to address widespread "cookie fatigue" while providing legal clarity for businesses utilizing tracking technologies.

Cybersecurity incident reporting represents the third major simplification target. According to the call for evidence, businesses currently face "significant burden stemming from incident and data breach reporting obligations regulated in different EU-level rules" with inconsistent national-level implementation. The omnibus seeks streamlined reporting processes while maintaining cybersecurity protection standards.

Artificial Intelligence Act implementation receives focused attention through targeted adjustments ensuring optimal rule application. According to the Commission, the intervention addresses implementation challenges identified through stakeholder consultations while facilitating smooth interplay with existing legal frameworks.

European Digital Identity Framework modifications complete the omnibus scope. The Commission identifies opportunities to reduce compliance costs while maintaining security standards, particularly regarding qualified trust service providers and the forthcoming EU Business Wallet proposal.

The broader initiative builds on three previous consultations covering data union strategy, cybersecurity act review, and artificial intelligence implementation support. According to the Commission's documentation, contributions from those consultations inform the current omnibus proposal, eliminating the need for stakeholder resubmission.

The Commission expects significant cumulative impact from proposed amendments. According to the call for evidence, cost reductions target "a wide variety of industry sectors, as well as digital services or businesses in other areas with a digital component." Data intermediary services receive specific compliance cost reductions, while cybersecurity reporting changes address multiple industry areas.

Cookie regulation modifications promise substantial business impact. The Commission documentation states changes will "cut cost for businesses by reducing the cases where consent must be obtained" while incentivizing privacy-enhancing technology development. Central cookie management mechanisms strengthen user autonomy while reducing business compliance burden.

The timeline positions the Digital Omnibus as immediate relief preceding broader Digital Fitness Check assessment. According to the Commission's strategy, the fitness check will evaluate cumulative effects and coherence across the digital acquis governing business activity throughout the EU Single Market.

Recent regulatory developments underscore the urgency for simplification. German courts have imposed strict cookie banner compliance requirements, creating implementation challenges for businesses operating across European markets. Belgian data protection authorities imposed daily fines reaching €25,000 for non-compliant cookie consent mechanisms, demonstrating enforcement intensity affecting digital advertising operations.

The Commission's approach reflects broader industry concerns about regulatory fragmentation. Privacy technology developments show organizations struggling with compliance across multiple jurisdictions, while extensive regulation has already eliminated digital political advertising platforms from European markets due to implementation complexity.

Technical specifications reveal detailed simplification mechanisms. Data legislation changes address the "cliff edge" affecting small and mid-cap companies required to comply with full regulatory requirements despite limited resources. The Commission identifies this burden as particularly challenging for companies with data-driven business models attempting market entry.

Cybersecurity reporting modifications focus on reducing burden "while keeping a high cybersecurity protection." The Commission acknowledges widespread stakeholder reports of compliance difficulties across different EU-level rules and national transposition variations. Immediate measures for simplifying reporting tools complement broader Cybersecurity Act review processes.

Artificial Intelligence Act adjustments ensure "predictable and effective application" aligned with available support and enforcement structures. According to the Commission, the intervention addresses stakeholder and Member State consultation findings while considering small and mid-cap company needs.

The legal basis for omnibus measures rests on the same foundations as amended acts, predominantly Article 114 and Article 16 of the Treaty on the Functioning of the European Union. The Commission emphasizes that solutions explored maintain existing competence divisions between EU and national levels.

Industry reaction highlights the initiative's significance for digital marketing operations. Marketing professionals face increasing compliance complexity as multiple regulatory frameworks create overlapping requirements. The omnibus proposal addresses concerns about regulatory fragmentation while maintaining protection standards for citizens' rights and interests.

The consultation period extends until October 14, 2025, providing stakeholders opportunity to influence final proposal development. According to the Commission, the call for evidence complements previous topic-specific consultations while avoiding duplication of stakeholder submissions.

Implementation timeline targets fourth quarter 2025 for Commission adoption, positioning the Digital Omnibus as rapid response to business concerns about regulatory burden. The initiative supports the Commission's target in the Competitiveness Compass for administrative burden reduction across European businesses.

The simplification agenda extends beyond immediate omnibus measures. According to the Commission's strategy, the Digital Fitness Check will launch comprehensive assessment of digital acquis coherence and cumulative impact. This longer-term evaluation addresses opportunities for further simplification measures in data regulation and enhanced data availability.

Timeline

• September 16, 2025: European Commission publishes Digital Omnibus call for evidence
• October 14, 2025: Consultation period ends at midnight Brussels time
• Q4 2025: Commission adoption planned for Digital Omnibus proposal
• 2026: Digital Fitness Check launch planned for comprehensive acquis review
• Previous related developments
• Privacy enforcement has intensified across European markets
• Austrian courts ruled Pay or Okay models illegal
• Microsoft Clarity implemented European consent requirements

Summary

Who: The European Commission, led by Executive Vice-President Henna Virkkunen, launched the Digital Omnibus initiative targeting businesses, administrations, and citizens across the European Union.

What: A comprehensive regulatory simplification package addressing data legislation, cookie consent requirements, cybersecurity reporting, AI Act implementation, and European Digital Identity Framework modifications.

When: Announced September 16, 2025, with consultation ending October 14, 2025, and Commission adoption planned for fourth quarter 2025.

Where: The initiative applies across the European Union, affecting businesses operating in digital services and companies with digital components in their operations.

Why: The Commission aims to reduce administrative burden by at least 25% for all companies and 35% for SMEs while addressing stakeholder concerns about regulatory fragmentation, implementation complexity, and misaligned enforcement approaches across digital legislation.