The EU Digital Omnibus Package revises GDPR, ePrivacy, and AI Act obligations in response to Draghi Report competitiveness recommendations — narrowing data definitions, relaxing consent rules, and postponing AI Act deadlines. For CFOs, General Counsel, and risk officers, the window for proactive governance alignment is open, but narrowing.
The EU AI Act’s high-risk obligations, currently set for August 2026 with a proposed extension to December 2027, are converging with GDPR, ESG reporting, and AML frameworks to create the most complex compliance environment European enterprises have faced in years. Organisations that treat this window as preparation time — not a pause — will gain a measurable governance and transactional advantage.
The EU AI Act’s high-risk system obligations take full effect on August 2, 2026, but enforcement has already begun — with prohibited AI practices carrying fines up to 7% of global turnover since February 2025. CFOs and General Counsel must act now to align AI governance with converging GDPR obligations and avoid material regulatory exposure.
The EDPB’s Coordinated Enforcement Framework 2026 mobilises 25 Data Protection Authorities to assess GDPR transparency compliance — a direct escalation for boards and General Counsel managing enterprise risk. With the EU AI Act fully applicable by August 2026 and cumulative GDPR fines at €5.88 billion, the window for reactive compliance strategies has closed.