The “Digital Omnibus on AI” – Update from the EU Parliament: New details on AI competence, real-world laboratories and compliance

The end of AI bureaucracy? How the European Parliament and the EU plan to streamline the AI ​​Act

The European "AI Act" is considered the world's first comprehensive regulatory framework for artificial intelligence – but no sooner is the ink dry than Brussels is already fine-tuning the details. With the so-called "AI Omnibus" (officially: Digital Omnibus on AI), the European Union is responding to practical hurdles that emerged during the initial implementation of the AI ​​regulation. The aim is to correct unrealistic deadlines, avoid duplicate burdens caused by overlapping laws (such as the GDPR or the Cyber ​​Resilience Act), and prevent the innovative capacity of European companies from being stifled.

The process is now entering a crucial phase: Following the adoption of their draft report by the lead committees IMCO and LIBE in early February, intensive technical negotiations are now beginning. The focus is on fixed deadlines for high-risk AI systems (expected in 2027 and 2028), the introduction of mandatory AI literacy training, and facilitations for real-world laboratories (sandboxes).

The following Q&A sheds light on the background of this "open-heart surgery" on AI regulation. It explains the role of the responsible rapporteurs and negotiating factions, why the coming weeks are considered "crunch time," and how companies should strategically use the new timelines. Learn why the AI ​​Omnibus represents not a weakening, but a necessary strengthening of the AI ​​Act.

Related to this:

• Digital EU bus and AI: How much special legislation can Europe's data order tolerate?

Classification and starting point

What is the fundamental topic of the current “AI Omnibus” in the European Parliament?

The so-called "AI Omnibus" (officially: Digital Omnibus on AI) is a legislative proposal from the European Commission that aims to amend the already adopted AI Act in specific areas and simplify its implementation. The goal is to clarify deadlines, procedures, and overlaps with other digital legislation without compromising the fundamental level of protection afforded by the AI ​​Act. The draft has now been submitted to the European Parliament as a draft report; all amendments from the political groups have been tabled, and an intensive phase of technical negotiations is beginning.

How does the AI ​​Omnibus fit into the larger "Digital Omnibus" package?

The AI ​​Omnibus is part of a broader Digital Omnibus package from the Commission, which aims to refine and better harmonize several key digital regulatory frameworks – in particular the AI ​​Act, the Data Act, and the General Data Protection Regulation (GDPR). While other parts of the package address topics such as cookie rules, data access rights, and reporting obligations, the AI ​​section focuses on targeted adjustments to AI rules, for example, regarding deadlines, governance, registration requirements, real-world laboratories, and the handling of sensitive data for bias correction.

Why do we even talk about the “AI Omnibus” or “Digital Omnibus on AI”?

In EU law, the term "omnibus" refers to a piece of legislation that amends several sets of rules simultaneously; in the case of the "Digital Omnibus on AI," it specifically concerns amendments to the AI ​​Act and the aviation regime (EASA Regulation) to make the application of AI rules more practical. The main focus is on simplifying obligations for high-risk AI, harmonizing with other digital legislation, and providing additional relief for small and medium-sized enterprises.

Relationship between AI Omnibus and AI Act

If the AI ​​Act has already been passed, why is an AI Omnibus being added now?

After the first few months of implementing the AI ​​Act, it became clear that some of its requirements, while ambitious, were difficult to implement in practice, due to tight deadlines, complex registration requirements, and overlaps with other legal acts such as GDPR, NIS2, and DORA. Therefore, on November 19, 2025, the Commission presented proposal COM(2025) 836 (“Digital Omnibus on AI”) to make targeted adjustments before most of the obligations for high-risk AI systems even come into effect. The AI ​​Omnibus is thus not a completely new regulation, but rather a kind of “fine-tuning” that responds to criticism from companies, authorities, and supervisory bodies.

What core practical problems is the AI ​​Omnibus intended to solve?

First, deadlines and implementation dates for high-risk AI systems should be adjusted to ensure they are realistic and coincide with the development of harmonized standards. Second, duplicate and multiple obligations should be reduced, for example, when a company would have to report, document, or assess multiple times in similar situations due to the AI ​​Act, GDPR, NIS2, or DORA. Third, certain obligations, such as database registration, documentation, and governance, should be balanced to remain risk-appropriate without unduly restricting the innovative capacity of smaller players in particular.

How exactly does the AI ​​Omnibus change the handling of high-risk AI?

The Commission's proposals aimed to link the application of key obligations for high-risk systems more closely to the availability of technical standards and guidelines, meaning that obligations would only take effect several months after a corresponding Commission decision, thus allowing for de facto postponements. In contrast, the European Parliament, in its draft report, proposed fixed deadlines: For systems classified as high-risk under Article 6(2) and Annex III of the AI ​​Act, the deadline would be December 2, 2027; for systems under Article 6(1) and Annex I (such as certain safety-critical products), it would be August 2, 2028. This is intended to increase legal clarity and predictability, even if it reduces the scope for flexible adjustments.

Legislative process and current status

At what stage is the AI ​​Omnibus currently located in the European Parliament?

The Commission presented its proposal COM(2025) 836 at the end of 2025, and in Parliament, the dossier was referred to the lead committees for the Internal Market and Consumer Protection (IMCO) and Civil Liberties, Justice and Home Affairs (LIBE), which deliberated jointly. On 5 February 2026, IMCO and LIBE adopted the joint draft report (PE782.530), which contains 24 amendments to the Commission proposal and marks Parliament's first official position. In parallel, other committees, such as JURI, are working on opinions that introduce additional substantive demands, such as additions to the list of prohibited AI practices.

What will happen in the upcoming “technical negotiations”?

Following the adoption of the draft report, so-called technical meetings begin between the shadow rapporteurs of the political groups and the rapporteurs, in which compromise texts are negotiated paragraph by paragraph. These meetings focus less on fundamental political speeches and more on very detailed drafting work: definitions are clarified, cross-references are aligned, deadlines are harmonized, and potential contradictions with other legal acts are resolved. The aforementioned first technical meeting on February 25th marks the start of a closely scheduled series of such negotiations, designed to determine whether a swift agreement in Parliament is possible.

What role do IMCO, LIBE and the Legal Affairs Committee (JURI) play in detail?

IMCO and LIBE are leading the co-decision process for the dossier, drafting the text on which the plenary later votes; they structure the debate, collect amendments, and negotiate compromise packages. The Legal Affairs Committee (JURI) issues an opinion, which, while not formally binding, can carry significant political weight in practice, particularly when it comes to fundamental rights-sensitive issues such as the prohibition of certain AI applications. For example, the JURI opinion proposes including an explicit ban on non-consensual "nudification" (AI-assisted undressing of individuals in images) in the list of prohibited practices under the AI ​​Act.

Role of rapporteurs, political groups and other actors

What role do the major factions play in connection with the AI ​​Omnibus?

The EPP Group in the European Parliament has clearly defined its shadow rapporteurs in the LIBE Committee for the “Digital Omnibus on AI”. These individuals are already known for their central role in the Parliament’s AI policy, including their work in special committees on the impact of AI and as prominent voices advocating for competitive yet fundamental rights-sensitive AI regulation. In the context of the AI ​​Omnibus, they place particular emphasis on legal certainty, uniform interpretation across the EU, and the reduction of bureaucratic hurdles for businesses.

What characterizes the political line of conservative and liberal forces in AI regulation?

Many parliamentarians have been critics of fragmentation and overregulation in digital law from the outset, warning for a long time that Europe could become a "digital colony" without manageable rules. In their statements on digitalization, they emphasize three key points: access to data as a prerequisite for competitive AI, the need for a uniform interpretation ("one interpretation, not several"), and the reduction of bureaucracy by eliminating overlapping obligations in different legal acts. Their position on the AI ​​Omnibus aligns with this, calling for greater harmonization and standardization as a bridge between regulation and the market.

Who is on the side of the lead rapporteurs for Parliament?

The joint report by IMCO and LIBE on the Digital Omnibus on AI is supported by the responsible rapporteurs from the EPP and the Renew Group as co-rapporteurs. They have proposed 24 targeted amendments to the Commission's proposal, primarily aimed at establishing firm deadlines, strengthening the protection of fundamental rights, and ensuring more consistent integration with other legal acts. In addition, the shadow rapporteurs from the other political groups – including the representatives on the LIBE Committee – are contributing to the formulation of the compromises.

What are the “AI Info Sessions” all about?

During the negotiations on the AI ​​Act, various members of parliament's offices and parliamentary staff organized a series of open "AI Info Sessions" in which stakeholders from business, civil society, and academia were given concise updates on the legislative process and could provide feedback. These formats were well received because they presented technical and political content transparently and offered easy access to the legislation. In the current AI Omnibus phase, this format will be revived to gather best practices, channel criticism, and make complex change mechanisms understandable.

Key points of contention

Why are deadlines for high-risk AI one of the biggest points of contention?

The Commission wanted to closely link the application of key obligations for high-risk AI to the availability of harmonized standards, specifications, or guidelines, meaning that obligations would only take effect several months after a corresponding Commission decision. Critics—including members of parliament and representatives of civil society—saw this as a risk of a "de facto suspension" of the AI ​​Act, because the actual effectiveness of the regulations could be postponed indefinitely if standards were not finalized in time. The parliamentary draft addresses this with fixed deadlines (December 2027 and August 2028) that are not tied to further decisions, in order to create predictability and underscore the binding nature of the regulations.

How is the topic of “AI Literacy” (AI competence) addressed in the AI ​​Omnibus?

In its omnibus proposal, the Commission had shifted the responsibility for promoting AI skills from individual companies more strongly to the Member States and the Commission itself, in order to relieve companies of very general training obligations. In contrast, the Parliament's draft report places greater emphasis on the obligation of providers and deployers to promote the AI ​​skills of their staff, particularly those responsible for operating, monitoring, or deploying AI systems. Parliament aims to ensure that technical and organizational safeguards do not merely exist on paper, but are actually implemented by adequately trained personnel.

What changes are planned for handling sensitive data for bias detection?

The AI ​​Omnibus establishes an explicit legal basis for processing special categories of personal data—such as data concerning origin, religion, or health—within strict limits for the detection and correction of bias in AI systems. This possibility is intended to apply not only to high-risk systems but also to broader contexts, always subject to strict safeguards and the principle of necessity. Data protection bodies such as the EDPB and EDPS generally welcome the enabling of bias correction but insist on clear purpose limitations, technical and organizational safeguards, and close involvement of data protection authorities, particularly in test environments.

How does the AI ​​Omnibus change the governance structure and the role of the “AI Office”?

The Digital Omnibus Package strengthens the new AI Office, which will assume key supervisory responsibilities for AI systems using Generalized AI Models (GPAI) and for AI in very large online platforms and search engines. Parliament aims to define this role more clearly, in particular by stipulating that the AI ​​Office has no jurisdiction over AI systems deployed by EU institutions themselves; these will remain under the supervision of the European Data Protection Supervisor (EDPS). At the same time, the Parliamentary proposal calls for close cooperation between the AI ​​Office, national authorities, and data protection authorities to prevent fragmentation and ensure the consistent application of the rules.

What changes are there regarding registration requirements and transparency registers?

A key simplification element is the elimination or weakening of certain registration requirements in the public EU register for AI systems, particularly for those falling under the scope of the AI ​​Act via a flexible high-risk classification. The Commission proposes removing the registration requirement for these systems, while the provider's obligation to internally document and justify its classification decision will remain in place and can be requested by supervisory authorities. Critics see this as the loss of a hard-won transparency instrument, while proponents point to the reduction of bureaucratic redundancies and costs.

Our EU and German expertise in business development, sales and marketing - Image: Xpert.Digital

Industry focus areas: B2B, digitalization (from AI to XR), mechanical engineering, logistics, renewable energies and industry

More information here:

• Expert Business Hub

A thematic hub offering insights and expertise:

• Knowledge platform covering global and regional economies, innovation and industry-specific trends
• A collection of analyses, insights, and background information from our key areas of focus
• A place for expertise and information on current developments in business and technology
• A hub for companies seeking information on markets, digitalization, and industry innovations

Impact on businesses and public administrations

What does the AI ​​Omnibus practically mean for companies that develop or use AI?

For companies, the primary change is in the timing and structure of their compliance roadmap: Fixed deadlines – instead of open-ended deadlines dependent on Commission decisions – allow them to better plan when which obligations will be activated for their high-risk systems. At the same time, redundant obligations are to be reduced, for example, when companies previously had to submit parallel reports and risk assessments under different digital laws. Combined with the strengthening of real-world laboratories and real-world testing, the Omnibus opens up more opportunities to test AI systems in controlled environments and gradually transition them to full operation.

What specific relief measures are planned for small and medium-sized enterprises (SMEs) and start-ups?

The AI ​​Omnibus expands upon the relief measures already provided for SMEs and so-called small and micro-cap companies in the AI ​​Act, for example through simplified technical documentation, proportionate quality management systems, and tiered sanction mechanisms. The aim is to align compliance requirements more closely with the size and risk profile of the company, rather than burdening small providers and large platforms equally. At the same time, the possibility of utilizing national and, where applicable, EU-wide real-world laboratories is explicitly positioned as an instrument from which innovative but resource-poor companies should particularly benefit.

What will change for public authorities and administrations?

Public bodies are often both users of AI systems (for example, in administration, the judiciary, or the police) and regulatory and supervisory authorities, and the AI ​​Omnibus aims to better reflect this dual role. On the one hand, public administrations benefit from clearer deadlines and simplified reporting channels, such as a "single entry point" concept, through which incidents and violations can be reported centrally and then distributed across different legal regimes. On the other hand, the EDPB and EDPS emphasize that the EDPS will remain responsible for the AI ​​systems of EU institutions and that the AI ​​Office will deliberately not be granted any competence in this area in order to avoid conflicts of interest.

What overall economic effects does the Commission expect from the Digital Omnibus?

The Commission estimates that simplifications in the areas of data, AI, and cybersecurity will enable cost savings of around €5 billion between 2025 and 2029, for example through reduced bureaucracy and more efficient compliance processes. Furthermore, annual efficiency gains of up to €150 billion are projected in connection with other components of the Digital Omnibus package, such as the introduction of business wallets. While these figures are subject to some uncertainty, they illustrate the political expectation that simplified and more coherent rules will strengthen Europe's digital competitiveness.

Related to this:

• “Digital by Default” in the EU is intended to help reduce bureaucracy – The digital administrative revolution

View of data protection bodies and supervisory authorities

How do the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) assess the AI ​​Omnibus?

In a joint statement 1/2026, the EDPB and EDPS generally welcome the objective of the AI ​​Omnibus to address implementation problems of the AI ​​Act through targeted simplifications. At the same time, however, they warn that simplifications must not come at the expense of fundamental rights protection, particularly where high-risk applications, sensitive data, or the oversight of powerful general AI models are concerned. They call for a clear delineation of the AI ​​Office's responsibilities and a precise definition of which types of general AI models should fall under its exclusive oversight.

What specific concerns do EDPB and EDPS have regarding sensitive data and bias correction?

Data protection bodies acknowledge that correcting discriminatory bias in AI systems is often virtually impossible without processing sensitive characteristics, but they demand clear guidelines for such processing. In particular, they require strict purpose limitation, a strict restriction to what is technically necessary, the use of strong technical safeguards (such as pseudonymization), and effective oversight by data protection authorities. In regulatory real-world laboratories where real-world data is used for testing, the bodies propose that data protection authorities be actively involved, not merely consulted.

How do regulatory authorities view the tension between simplification and effective enforcement?

The EDPB and EDPS acknowledge that overlapping legal acts and complicated reporting and documentation requirements are inefficient for the supervisory authorities themselves, and therefore generally support the idea of ​​better coordinated regulatory regimes. At the same time, they emphasize that simplification must not be synonymous with dismantling safeguards and call for clear structuring of cooperation mechanisms between the AI ​​Office, data protection authorities, and other sector authorities. In particular, they urge that fragmentation in interpretation be avoided by providing guidelines and, where appropriate, binding interpretive acts in a timely manner.

Timetable, “timetables” and next steps

What is the political roadmap for the AI ​​Omnibus in parliament?

Following the adoption of the draft report in IMCO and LIBE, a phase of intensive technical negotiations ensues, during which attempts are made to forge viable compromise packages between the political groups. In parallel, opinions from other committees – such as the Legal Affairs Committee (JURI) – are incorporated before the committee report is put to a vote in plenary. Subsequently, depending on the timetables of the other institutions, the trilogue negotiations between Parliament, Council, and Commission begin, in which the final compromises for the regulation are negotiated.

Why is the time pressure in the dossier so high that it is referred to as "crunch time"?

Firstly, the AI ​​Act originally stipulated August 2, 2026, as the key date for the implementation of many obligations for high-risk AI, leaving a narrow window for adjustments. Secondly, companies and public authorities urgently require clarity on the specific interaction between the AI ​​Act, GDPR, Data Protection Act, NIS2, DORA, and other legal acts, as they need to plan their internal compliance programs several years in advance. Finally, the Council – driven by the governments of the member states – is also exerting pressure for swift implementation, further restricting the negotiating windows in Parliament.

What is behind the “AI Timetables”?

In the context of the AI ​​Act, several members of parliament and their staff published graphically presented timelines ("AI timetables") that clearly illustrated the numerous meetings, deadlines, and milestones surrounding the AI ​​legislation. These timetables were picked up by media outlets such as POLITICO, Euractiv, and Tagesspiegel Background, helping to translate the complex processes into a format understandable for stakeholders. In the context of the AI ​​Omnibus, this format is now being reused in an updated form to make the crucial dates of technical meetings, committee sessions, and plenary votes accessible at a glance – as the text announces.

How can stakeholders meaningfully contribute during this phase?

Companies, associations, civil society organizations, and research institutions can submit written statements to the relevant Members of Parliament and committees and participate in open formats such as the AI ​​Info Sessions once these resume. In particular, targeted feedback on practical implementation issues—for example, on the interfaces between the AI ​​Act, data protection law, and industry-specific regulations—is valuable at this stage because it can be directly incorporated into technical amendment proposals. Participation in Commission consultations and in work on technical standards (e.g., in standards bodies) also gains additional importance due to the close link between obligations and standards.

Strategic classification for practice and policy

How should companies strategically classify the AI ​​Omnibus – as an opportunity, as a risk, or both?

For companies, the AI ​​Omnibus represents both a risk and an opportunity: a risk because certain compliance pathways – such as deadlines and documentation requirements – may be postponed or intensified; an opportunity because it aims to reduce bureaucratic redundancies and unclear interfaces. Those who map their AI systems early, assess the relevance of the AI ​​Act categories, and analyze the interactions with data protection and other digital laws can leverage the Omnibus adjustments to streamline and improve the coherence of their internal governance structures. Strategically, it makes sense to use the proposed fixed deadlines as benchmarks and to plan retrospectively as if these dates will remain essentially unchanged, even if minor adjustments occur during the trilogue negotiations.

What does the AI ​​Omnibus mean for public debates about “too much” or “too little” AI regulation?

The AI ​​Omnibus shifts the debate somewhat from the "whether" of regulation to the "how" of its practical implementation, without altering the fundamental guidelines of the AI ​​Act. Critics fear that postponing deadlines and reducing obligations could undermine the AI ​​Act's promise of protection, while proponents argue that without workable and coherent rules, neither fundamental rights can be effectively protected nor innovations scaled responsibly. Parliament's position, with its fixed deadlines, clearer AI literacy obligations, and strengthened fundamental rights and data protection perspectives, demonstrates Parliament's attempt to reconcile simplification with robust protection standards.

What are some common misconceptions about the AI ​​Omnibus that should be avoided?

A common misconception is that the AI ​​Omnibus is a "weakening" or even a "rollback" of the AI ​​Act; in fact, the structure, risk classes, and key prohibitions remain unchanged. The focus is on implementation details, deadlines, and overlaps with other legislation. Equally misleading is the assumption that companies can "wait" until everything is fully harmonized: many obligations under the AI ​​Act already apply or will become effective regardless of the outcome of the Omnibus negotiations, and the adjustments currently under discussion require early preparation. Finally, it should not be underestimated that even after the Omnibus is adopted, guidelines, standards, and supervisory decisions will continue to play a crucial role—the regulation alone provides only the framework, not all the details.

What is the significance of the interplay between political debate and technical standards in the context of the AI ​​Omnibus?

The AI ​​Omnibus makes it particularly clear that many practical questions of AI regulation—such as the specific design of risk management, logging, or robustness requirements—are not decided solely in the legal text, but also in subsequent standards and guidelines. Policymakers and legislators emphasize that technical standardization serves as an "organizing element" to make the complexity between innovation and bureaucracy manageable. For companies and public authorities, this means that legal and technical compliance cannot be considered separately: Participation in standardization processes and monitoring of guidelines will be just as important as following the legislation itself.

Konrad Wolfenstein

I would be happy to serve as your personal advisor.

contact me at wolfenstein ∂ xpert.digital

Just call me on +49 7348 4088 965 (Munich) .

LinkedIn