The European Commission today presented the Digital Omnibus Package. With this, the EC makes a proposal that simplifies existing digital regulations so that companies can innovate faster and experience less administrative pressure. This is a proposal, which also still needs to be approved by the European Parliament and the European Council (of heads of government of member states). It is therefore not yet certain that the proposal will actually be implemented in its current form. For the Netherlands and the AIC4NL ecosystem, two parts in particular are important: the relaxation of the AI Act and the adjustments to the GDPR (in relation to AI).
Simplification of the AI act
The Commission publishes a 65-page correction package that softens and delays the application of the AI Act. Reasons are the slow designation of regulators within the EU, the delayed harmonized standards from CEN-CENELEC (now expected in December 2026) and signals from industry that the burdens and ambiguities are too great. With this adjustment, the Commission expects a burden reduction of approximately €297 to €433 million.
The main proposed changes are:
- More flexibility for high-risk systems: obligations apply no later than Dec. 2, 2027 (Annex III) and Aug. 2, 2028 (Annex I).
- Extension of exceptions for SMEs and startups: especially simpler documentation and quality management requirements in high-risk applications.
- Stronger role for the AI Office: this body will have more enforcement powers and can conduct pre-market conformity assessments for GPAI models.
- Space for an EU-wide AI sandbox: to safely experiment with AI applications.
- Shift the AI literacy obligation: it will no longer rest with providers and users, but with member states and the Commission.
Simplifying GDPR for AI applications
It also proposes to make the GDPR more innovation-friendly. This should ensure more useful data when developing and training AI systems. The gist of the proposed changes:
- A narrower definition of personal data: only data that directly identifies a person is included.
- Training AI on personal data is seen as legitimate interest, facilitating data processing for training purposes.
What does this mean for the Netherlands?
With the Digital Omnibus Package, the European Commission is taking an important step toward a simpler, more innovation-friendly digital regulatory framework. For the Dutch AI ecosystem, the proposed relaxations of the AI Act and GDPR could provide substantial relief. At the same time, it remains only a proposal: negotiations in Brussels in the coming months will determine which elements will actually be implemented. From Values, Standards & Regulation (WNR), we are closely following these developments and will continue to inform our participants in a timely manner about the implications for policy, supervision and innovation. As soon as there is more clarity on the final package, we will come back with further interpretation and practical guidance.
