EU Digital Omnibus: Takeaways for financial services

The European Commission plans to simplify some EU rules on AI, cybersecurity and data. Its Digital Omnibus package proposes amending the AI Act, DORA and other EU legislation.

The proposals on the EU AI Act include:

• delaying the start date of the high-risk AI regime by 16 months to 2 December 2027,

• removing the AI literacy requirement for AI providers and deployers and replacing it with an obligation on the Commission and Member States to foster AI literacy, and

• transferring oversight of some AI systems to the Commission’s AI Office.

A separate proposal on digital legislation envisages creating a single entry point for companies to report incidents and cyber attacks. This would harmonise existing procedures across GDPR, DORA and NIS2. The Commission hopes that a “report once, share many” approach will reduce the administrative burden on firms.

The European Parliament and Council will now consider the Commission's proposals. The Commission has also launched a wider consultation exploring whether the EU’s digital rules are effective, proportionate and fit for the future. This Digital Fitness Check is open for comments until 11 March 2026.