EU Digital Omnibus

Statute European Union

The Digital Omnibus is not a regime of its own. It is an amending instrument, and I catalogue it for one reason: it is the thing that changed the dates everyone had written down. A company that built its EU compliance plan in early 2025 and has not revisited it is now planning against a calendar that no longer exists.

The Commission published it on 19 November 2025 as a single simplification package touching six regimes. It did not stay single.

• The AI half was adopted and is in force - The Council adopted it on 29 June 2026 and it entered into force on 27 July 2026. Annex III high-risk obligations moved from 2 August 2026 to 2 December 2027 — sixteen months. Annex I high-risk, the product-embedded tier, moved from August 2027 to August 2028.
• It did NOT touch general application - The AI Act’s general application date, 2 August 2026, stood, and with it the Article 50 transparency duties: disclose that a user is interacting with an AI system, mark synthetic content, disclose emotion recognition and biometric categorisation. This is the detail most often lost in the reporting, and it is the one that binds the most companies.
• The data half is still in negotiation - GDPR, ePrivacy, NIS2 and DORA amendments remain open, with the Council’s working text dropping several of the headline consent provisions. Final adoption is not expected before late 2026 at the earliest.
• What the data half proposes, if it lands - Single-click accept/reject, a moratorium on re-asking after a refusal, and machine-readable browser-level preference signals. That last one is the one to watch from an API perspective: a legally recognised consent signal expressed in a protocol rather than a modal.

The reason to keep this entry rather than simply editing the AI Act’s dates and moving on is that a deferral is not a cancellation, and the two get conflated within about a week of any announcement. The high-risk obligations did not go away. They moved to December 2027, which happens to be the same month the Cyber Resilience Act’s full regime lands. Two of the heaviest product-level obligations in EU law now share a deadline, and they share it in a month when nobody ships anything.

There is also a governance lesson in the split. The AI half moved quickly because industry pressure had a clear, single ask — more time — and deferral is the cheapest thing a legislature can give. The data half has stalled because its asks are substantive and contested, and the consent provisions that would have simplified the most are exactly the ones the Council pulled. Simplification packages tend to deliver their schedule relief long before they deliver their structural relief, and planning should assume the deadline moved while the work did not.