News Analysis
The European Commission (EC) proposed sweeping overhauls to its AI and data protection regulations. These changes still require the green light from the EU Council and Parliament before taking effect.
The package, released this week as part of the EC’s long-anticipated “digital simplification” agenda, introduces a narrower definition of personal data, relaxes consent requirements and postpones key elements of the EU AI Act by at least a year.
The changes are framed as an effort to reduce administrative burdens on European companies and boost competitiveness in the global technology market. Yet critics argue other forces are behind the proposal.
By streamlining rules, reducing overlaps, and limiting reporting burdens for businesses, this package delivers:
— European Commission (@EU_Commission) November 19, 2025
✅ Lower costs
✅ Easier compliance
All with one goal: unlocking innovation while safeguarding fundamental rights and values.
Table of Contents
- What the EC’s Overhaul Actually Changes
- AI Act Delay Follows Big Tech Pressure
- Critics Say Reforms Risk Weakening Privacy
- What Happens Next for the Digital Simplification Package
What the EC’s Overhaul Actually Changes
“By cutting red tape, simplifying EU laws, opening access to data and introducing a common European Business Wallet we are giving space for innovation to happen and to be marketed in Europe."
- Henna Virkkunen
EU Technology Czar
The digital simplification package introduces several major changes aimed at reducing regulatory complexity while supporting innovation.
A New Reporting Portal
A central feature is a unified cybersecurity incident reporting portal that will replace the current system requiring companies to file reports under multiple laws such as NIS2, GDPR and DORA.
Updates to GDPR
The package also includes targeted changes to the General Data Protection Regulation (GDPR) intended to clarify and harmonize rules without weakening core data protection principles. Cookie rules will be modernized to reduce frequent consent pop-ups, allowing users to manage preferences through a single browser or operating system setting.
A Consolidated Data Act
On the data front, the reforms streamline access and use by consolidating several laws into an updated Data Act, introducing exemptions to cloud-switching rules for smaller companies and providing model contractual terms to ease compliance.
The overall goal is to make it easier for European businesses — particularly AI developers — to tap into higher-quality datasets and accelerate innovation while maintaining key privacy safeguards.
Related Article: The Billion-Dollar AI Lab With No Website: Inside Project Prometheus
AI Act Delay Follows Big Tech Pressure
High-risk systems, which include AI used in healthcare, transportation, policing and employment, were initially subject to some of the strictest rules in the world under the 2024 legislation.
These rules, however, have had some adverse effects on competitiveness, according to the EC, writing, "Fast and visible improvements are needed for people and businesses, through a more cost-effective and innovation-friendly implementation of our rules — all the while maintaining high standards and agreed objectives."
The proposed softening of the AI Act was driven in part by intensified lobbying from the world's leading tech companies. Industry groups and multinational firms argue that the original rules impose costly requirements that could slow AI development and disadvantage European businesses relative to US and Chinese competitors.
Critics Say Reforms Risk Weakening Privacy
Privacy advocates warn that the reforms erode long-standing protections and grant unprecedented leeway for companies to collect, analyze and repurpose user data — including for AI training — without explicit consent.
Last week, an open letter signed by 127 civil society organizations, including Amnesty International, argued the “technical streamlining” of EU digital laws was actually an “attempt to covertly dismantle Europe’s strongest protections against digital threats”.
“By recasting vital laws... as ‘red tape,’ the EU is giving in to powerful corporate and state actors who oppose the principles of a fair, safe and democratic digital landscape and who want to lower the bar of EU laws for their own benefit,” the letter says.
Related Article: AI Regulation in the US: A State-by-State Guide
What Happens Next for the Digital Simplification Package
High risk systems still carry the most stringent requirements in the Act. This means organizations should prepare now for disciplined data governance across retention practices, model training workflows and cross-border data flows, according to Diana Kelley, chief information security officer at Noma Security.
“It also means building the capability to maintain training and validation datasets that are as accurate and bias tested as possible and ensuring continuous logging to support traceability and post-incident investigations once the relevant articles take effect,” she added.
Webinar
Nov
20
How to Build a Solid Knowledge Foundation for AI Success
See how leading brands keep their AI honest, compliant and actually helpful.
Register
Webinar
Dec
2
From Manual to Magical: How AI Transforms CX Teams
Learn how to replace manual support processes with automation that actually delivers.
Register
Webinar
Dec
9
Rebrand. Migrate. Optimize. How to Do It All (Without Slowing Down)
Cresta leveled up site speed, design flexibility and marketer sanity (in record time). Find out how.
Register
Webinar
Dec
10
Beyond Composability: How Modern Marketers Build Connected Experiences
Ready to launch campaigns faster, personalize smarter and prove your marketing ROI? Discover the power of a modern DXP.
Register
Webinar
Dec
10
Unlock Connected Service: How to Forecast, Staff & Support Every Channel
Stop juggling tools. 73% of CX leaders say silos damage CX. Build a seamless service operation instead.
Register
Webinar
Dec
16
Roundtable: Turning Real-Time CX Signals into Business Results
Four big brands. One live, unscripted discussion on how modern CX teams move from dashboards to real impact.
Register
The recent political rollbacks did not eliminate these underlying guardrails, said Kelley. For now, they primarily affect timelines, implementation guidance and certain documentation expectations.
The proposed delays and revisions will only take effect if both the Council and the European Parliament adopt their positions and then negotiate a single compromise text, a process that could significantly slow the timeline. Wrangling an agreement on the digital omnibus could drag into mid-2026 — potentially just weeks before high-risk AI rules are currently due to take effect in August.
