Regulatory compliance, risk assessment frameworks, GDPR, and governance strategies for international businesses.
The EU AI Act reaches full application on August 2, 2026, while the European Commission’s Digital Omnibus proposal extends high-risk AI compliance deadlines to 2027–2028. CFOs and General Counsel must distinguish between what is enforceable now and where governance investment should be directed ahead of the revised timelines.
The EU Commission’s Digital Omnibus proposal delays high-risk AI Act compliance deadlines to December 2027 and streamlines GDPR breach reporting — offering a 16-month buffer for mid-market firms. CFOs and General Counsel should treat this window as a strategic acceleration opportunity, not a pause.
The EU Digital Omnibus proposal, with a compromise text dated 21 May 2026, would materially reshape GDPR obligations across cookie consent, breach notification, AI governance, and SME compliance. Mid-market companies and their legal, technology, and finance leadership should begin structural compliance reviews now.
A political agreement on EU AI Act amendments extends high-risk AI compliance deadlines to December 2027 and August 2028, while preserving near-term transparency and governance obligations from August 2026. Mid-market companies must act now on foundational AI governance, GDPR convergence, and auditable compliance controls.
The European Commission’s proposed Digital Omnibus would unify GDPR, EU AI Act, NIS2, and DORA reporting obligations and extend key AI compliance deadlines to 2027–2028. Decision-makers must distinguish procedural relief from substantive obligation — enforcement risk remains high.
The EDPB’s Coordinated Enforcement Framework 2026 and the EU AI Act’s August 2026 full application deadline are creating overlapping compliance obligations that demand integrated action from CFOs, General Counsel, and CTOs. Organisations that treat GDPR and AI governance as separate workstreams face compounding regulatory exposure.
The European Commission’s Digital Omnibus proposal would amend GDPR, the EU AI Act, and four other digital regimes simultaneously—extending breach-notification windows, creating a unified reporting point, and pushing high-risk AI deadlines to 2027–2028. For boards and compliance leaders, the proposal demands an immediate reassessment of integrated data governance and enterprise risk management programs.
The EU AI Act’s high-risk AI obligations apply from August 2026, creating immediate compliance pressure for mid-market firms operating under a dual GDPR and AI Act governance model. CFOs, General Counsel, and board members must act now to inventory AI assets, build evidence-based controls, and quantify material regulatory exposure.
The EU Digital Omnibus reform package proposes material changes to GDPR’s Article 22, AI data processing rules, and breach notification thresholds that will require mid-market and enterprise firms to redesign compliance programmes and AI governance frameworks. Decision-makers should begin gap assessments now rather than waiting for final legislative text.
The European Commission’s proposed Digital Omnibus would streamline overlapping GDPR and EU AI Act obligations — but it remains a proposal, not law. With the AI Act’s full applicability date set for August 2026 and GPAI obligations already in force, corporate compliance teams cannot afford to wait.