Regulatory compliance, risk assessment frameworks, GDPR, and governance strategies for international businesses.
The EU Digital Omnibus proposal, with a compromise text dated 21 May 2026, would materially reshape GDPR obligations across cookie consent, breach notification, AI governance, and SME compliance. Mid-market companies and their legal, technology, and finance leadership should begin structural compliance reviews now.
A political agreement on EU AI Act amendments extends high-risk AI compliance deadlines to December 2027 and August 2028, while preserving near-term transparency and governance obligations from August 2026. Mid-market companies must act now on foundational AI governance, GDPR convergence, and auditable compliance controls.
The European Commission’s proposed Digital Omnibus would unify GDPR, EU AI Act, NIS2, and DORA reporting obligations and extend key AI compliance deadlines to 2027–2028. Decision-makers must distinguish procedural relief from substantive obligation — enforcement risk remains high.
The EDPB’s Coordinated Enforcement Framework 2026 and the EU AI Act’s August 2026 full application deadline are creating overlapping compliance obligations that demand integrated action from CFOs, General Counsel, and CTOs. Organisations that treat GDPR and AI governance as separate workstreams face compounding regulatory exposure.
The European Commission’s Digital Omnibus proposal would amend GDPR, the EU AI Act, and four other digital regimes simultaneously—extending breach-notification windows, creating a unified reporting point, and pushing high-risk AI deadlines to 2027–2028. For boards and compliance leaders, the proposal demands an immediate reassessment of integrated data governance and enterprise risk management programs.
The EU AI Act’s high-risk AI obligations apply from August 2026, creating immediate compliance pressure for mid-market firms operating under a dual GDPR and AI Act governance model. CFOs, General Counsel, and board members must act now to inventory AI assets, build evidence-based controls, and quantify material regulatory exposure.
The EU Digital Omnibus reform package proposes material changes to GDPR’s Article 22, AI data processing rules, and breach notification thresholds that will require mid-market and enterprise firms to redesign compliance programmes and AI governance frameworks. Decision-makers should begin gap assessments now rather than waiting for final legislative text.
The European Commission’s proposed Digital Omnibus would streamline overlapping GDPR and EU AI Act obligations — but it remains a proposal, not law. With the AI Act’s full applicability date set for August 2026 and GPAI obligations already in force, corporate compliance teams cannot afford to wait.
The EDPB’s 2026 Coordinated Enforcement Framework and the EU AI Act’s full application in August 2026 are converging into a single, high-stakes compliance agenda for European and transatlantic businesses. Mid-market firms must act now to align data privacy governance, AI oversight, and cross-border transfer controls before enforcement pressure intensifies.
The EU’s Digital Omnibus proposal is reshaping how firms must integrate GDPR and AI Act obligations, offering operational relief without reducing core enforcement risk. With full AI Act applicability set for August 2026, executives have a strategic window — but a closing one — to align governance frameworks.