What do the EU Digital Omnibus and the Digital Sovereignty Declaration mean for business?

Hello and welcome to Topin Tech, our regular Global Council podcast where we unpack the new tech policy developments that are happening worldwide. I'm Megan Stagman, I'm a director in our TMT practice here and although this isn't one of our normal podcast weeks, we have added an extra episode because this is a real bumper addition of a week with lots going on, especially in Brussels and national capitals. So this week we are going to be talking about the long awaited EU digital omnibus as well as various developments that are happening around digital sovereignty given that we had the European summit on digital sovereignty happening in Berlin, which ended on Wednesday. So to discuss these important topics, I am joined by Gosha and Diffier who lead a lot of our tech policy work in our Brussels office and are much closer to the details of this than I am. So perhaps for me and others who are perhaps not so close to what has been happening around this digital omnibus idea, it would be useful. Diffier, maybe I can turn to you to say what is the digital omnibus? What does it mean for businesses? What should we be expecting from the developments that we've seen this week? Thanks Megan. Hi everyone, I'm Diffier. I'm a senior associate in our tech media telecoms practice here in Brussels. So essentially on the digital omnibus package, this is a major legislative package that the Commission unveiled yesterday to simplify and streamline the EU's digital rulebook. The political motivation is pretty straightforward. So over the last five years in a past commission mandate, the EU has adopted a huge amount of different digital files. We think about the AI Act, the Digital Services Act, and the Digital Markets Act, also known as the DSA and the DBA. So the Commission now recognizes that the cumulative effect of these rules is creating a lot of friction, especially for SMEs and mid caps, which is important for businesses. So the omnibus was framed as this regulatory simplification exercise, but it also is deeply political. It touches icons of EU digital policy, like the GDPR and E privacy and the AI Act, which is why it has sparked intense debate around whether simplification is simply just deregulation by self. Now bringing this into context, the digital package is the seventh omnibus in the Commission's overall simplification drive. This is a strong signal that Brussels wants to move forward to a more streamlined innovation friendly and interoperable digital regulatory environment. But there's a big open question there, which is, does this genuinely create a more business friendly landscape, or is this simply going to lead to more layers of legal uncertainty that will just overall create a really confusing landscape for businesses? And politically, the package is already contentious. We have socialists and liberals and the Greens in the European Parliament, all raising concerns about the potential erosion of privacy and fundamental rights. Some observers, including like think tanks, academics, they even see this as part of a broader pattern, a slow unraveling of the EU's traditional rule of law, posture, and the Brussels effect, which is accelerated by geopolitical and transatlantic pressures. So this is definitely one to watch. Okay, interesting. So I mean, as you say, I think it will be hard for many international observers of this, not to see it as in some way, growing back on, as you said, the EU taking a real leadership role in regulating technology. The US now imposing a lot of pressure for them to bring some of that back. And also, of course, internal pressure around kind of competitiveness as well, which I guess maybe we'll come back on to when we talk a bit more about the sovereignty idea. But it might be useful just to think about what this actually means in practice. So you mentioned the AI and GDPR. I think those are probably the two policy areas where a lot of our listeners will focus most. So what exactly are we planning these amendments to look like? Sure. So I'll start with the AI act amendments that it proposes, which is in the second part of the digital omnibus proposal. So essentially there are two proposals just to take a step back. There's the digital omnibus proposal itself, which looks at the GDPR and E privacy rights and cyber security rights as well. And then there's this digital omnibus proposal for the AI act, which proposes amendments to that act, particularly around high risk systems. So for just really quickly for the non-EU audience, what high risk AI means is essentially AI used in sensitive scenarios, so credit scoring, recruitment tools and medical devices. The idea there is that systems now require stricter obligations because they have a direct impact on fundamental rights and safety. The omnibus delays the compliance deadlines for these are high risk systems, especially if they connect to certain criterias. And this reflects a lot of the recognition that standards are late. The commission was late in coming up with these technical standards. And member states are just not ready with this. And industry is also not ready to meet this because the technical standards have been late. This would need to be adopted before August 2026 to avoid a regulatory gap where the original AI acts obligations could still technically apply even though we don't have any kind of technical standards in place. And this scenario risks fragmented enforcement for legal exposure, especially in the absence of updated technical standards. That's why it's something that's really important for businesses to keep an eye on, especially AI providers or businesses who use AI systems that can be considered as high risk. Then when we come to the GDPR, that's one of the most consequential aspects of the digital omnibus is that it amends the GDPR. So the omnibus merges and amends several regulations when it comes to data. So for instance, the data act, the data governance act and the open data directive with this idea of simplifying the legislation around there. Now, when it comes to the GDPR, which is the landmark EU privacy framework, the omnibus clarifies the companies can use legitimate interests to process personal data for developing and operating AI systems. So it provides strict safeguards, of course, and data minimization practices. So for industry, what this basically means is it's a relief. It addresses the legal uncertainty around training models on personal data. But for privacy advocates, this is a huge red line as it essentially unravels a lot of the privacy rights that we've been fighting for. And it can also open the door to broad interpretations of what counts as legitimate interest well beyond AI. There's also a concept of data altruism, which is introduced. And this relates to the voluntary sharing of data. And if it covers basic objectives of general interest, now healthcare is included here as well as scientific research and climate change, they're all concepts of legitimate interests. But here's a question and that I can already foresee is what counts as an objective of general interest. And it leaves a lot of room for ambiguity and risk for exploitation. So it is something I expect privacy advocates to to to fight on. And then finally, the commission is also trying to address cookie fatigue by bringing the GDPR any privacy closer together. The goal here is really simple. It's just to create a clear framework. But critics also worry that simplification can just quietly weaken the protections and shift the balance more towards business convenience. Very interesting. I think that piece that you were saying in particular about legitimate interest is something that people across the channel will be watching very closely here in the UK while we had the data bill going through parliament earlier this year. There was a lot of conversation about whether we could play around with the definition of what legitimate interest meant. And obviously there was a real nervousness given the upcoming adequacy agreement and would that jeopardize ongoing data transfers between the EU and the UK. So it's very interesting to see the EU is now perhaps also re-opening or at least clarifying what legitimate interest means in the context of AI. So lots of big ambitions there that you have set out, which were put forward in this digital omnibus idea. What is the actual protocol and process for taking this forward? What are the next steps now? Yeah, that's a really good question. So now tangibly this will have to go through the negotiation phase. So what this means is that the commission has submitted the proposals to the European Parliament and the council and the negotiations between the institutions can officially take place. Now this can take up to several months and I expect this to take a long time if we consider how long the first omnibus on the simplification of sustainability rules took, which that took about nine months. And in this case with the digital omnibus it's a far more contagious piece. We have so many political groups and civil society groups arguing on many different red lines and issues. So I'm expecting this to be a battle in the next year and it can create a lot of legal uncertainty as well for businesses, which is why it's really important for us to be to be tracking this. Also another thing to bear in mind is that we have the digital fitness check upcoming. So the omnibus is only the first step in this process of the simplification for digital issues. The commission has also launched on the same day a digital fitness check, which is open until March 2026. This is a systemic review of the EU's entire digital rulebook. It will assess the coherence and cumulative burden of different rules as well as their competitiveness impacts. So this will be really one that businesses should be responding to if they want to get a foot in the process. But ultimately the real test will be political. As I've mentioned, we've already seen the EU's environmental ambitions diluted with the green deal. This was a centerpiece of Von der Leyen's first mandate, the last mandate, and that was watered down. Now the same dynamic seems to be coming up with digital policy, where landmark frameworks like the GDPR is being reopened. And then we have the digital fitness check, which is examining the entire rulebook. Then we have the AI Act, which was, you could say, one of the successes of the last mandate as something that Von der Leyen put forward. And now, before you can even be implemented, there are many questions on the timeline and the feasibility of this, the technical standards. So the core challenge ahead is really how will the EU balance its foundational values with its desire to boost competitiveness. Which I would say is a major talk of that town. You will hear competitiveness really thrown around a lot, but it really is a case. What follows this round of simplification? And can it really fix the problem? Because if that really is the case, then there are many things that we need to also solve. Like the chronic lack of funding, insufficient scale-up infrastructure, the lack of skilling or re-skilling initiatives that really means something tangible to build the EU labor workforce. These are all things that the EU should be also considering when it comes to solving these bottleneck problems when it comes to building our competitiveness. So yes, I would say that's pretty much it in a nutshell. Very big nutshell. Lots going on there, which I guess means our listeners to this podcast. You will probably hear more about this as we kind of move through the next steps of this, but obviously if you have questions, do you reach out to Divya directly? I think that last piece where you landed on kind of how do we build European competitiveness actually segues quite nicely into the other piece that we want to discuss today, which is around what is digital sovereignty, kind of what is the kind of current European activity on this. And I guess it's been interesting to see this week in particular what's happening in Berlin. So Gosha, perhaps I can turn to you for kind of the headlines on what our listeners should know about this. With pleasure. Thanks for having me, Megan. Let me start by saying that this week began with Brussels buzzing in this knot in a very good way because the Cloudflare story, a seemingly very small outage, reignited a deeper anxiety about Europe's digital dependencies. For policymakers in Brussels, Berlin, Paris, but also in all member states that participated in the summit, it was a reminder that digital sovereignty isn't just a slogan, but it's becoming the organizing principle of Europe's digital strategy. We are in a situation right now that anything that is non-European, non EU, sorry, especially if it touches public services or critical infrastructure is suddenly under sort of a magnifying glass. And this mood, this sense of vulnerability was something that set the tone for the Berlin digital sovereignty summit during which the declaration on European digital sovereignty was signed. This declaration is an interesting piece because it started as a very technical, very Austrian message on resilience and ended up becoming a major political declaration on Europe's strategic autonomy. All 27 member states signed the declaration, but it's safe to say that's not all for the same reasons. However, the common denominator is that the EU would like to see more control over its digital assets, but also more investment from tier tech, and finally also more reliance on open source as a strategic asset. If I were to sum up in one word, I would say that this is Europe saying that it wants to steer the digital future not just to adapt to it. Great, thanks, Kasia. I saw something interesting. I can't remember if it was Macron or someone else saying that it's all good and well as being a leader in regulation, but if we don't have any technology actually based in Europe, then we don't have anything to regulate, which I think probably sums this up quite well as well. I also thought it was interesting what you were saying about all 27 member states having signed this declaration, particularly because it seems to me that this language is still quite vague. For example, I don't think that there is really a definition of what digital sovereignty is beyond what you've said there. I saw that obviously they are setting up their own working groups specifically to create a define this when it comes to AI, cloud and quantum and cyber, but I mean, I'd love to hear your thoughts on how much member states can really agree on this topic, where there isn't a definition that kind of binds them all together. I'll be seeing divergences with different member states taking different approaches would be good to your thoughts. So, of course, this debate is not a new topic in Brussels. It's been going on for several months, years even. However, this Berlin summit has given a new impetus to the debate, and we know that European leaders will also spend some time during the European summit later in December debating those issues. But going back to the, let's say, different positions of member states, whereas we expect them to unveil in the coming months, we already know that France and Germany obviously are the ones speaking the loudest, but not singing the same song, because France is seeing sovereignty through its own, it's a unique perspective. There's being a second-armed cloud lens, and France is putting emphasis on certified European providers, strategic autonomy, and the preference for homegrown solutions. Whereas Germany would, we can say that it sees it as a resilience through choice, that opens doors, but also manages risks. Austria, that I mentioned earlier, that initiated this, the signing of this declaration. I think it's safe to say that they imagined sovereignty as a sort of a pragmatic resilience strategy, but not a protectionist wall, in that sense. Other member states, I think, ensigned the declaration without fully grasping how politically loaded it would become, especially after France insisted on removing the definition of sovereignty from the final text. This divergence isn't simply academic, because more importantly, it will shape procurement, cloud certification schemes, and even Europe's approach to AI partnerships. So, important space to watch, and as I say, it will become more clear in the months to come on how member states define the digital sovereignty principle. Interesting, particularly that piece about, I hadn't realised it was France who took out the definition of digital sovereignty, and I guess that sort of explained, because I know there were a lot of rumours about France not wanting to sign the declaration at all. I had been wondering whether it was the cloud flare incident and kind of other things like that that had kind of prompted them into it, but it seems obviously some important last minute amendments took place. I think also maybe just to kind of reflect on it from the UK perspective, it is interesting to see these very different definitions cropping up and kind of what different countries want from the idea of sovereignty. I think the UK is in an interesting position itself. Obviously, sees the US as a very important strategic ally and has for many decades. But for example, we saw that obviously the UK US tech prosperity deal happened just earlier this summer, but then at the same time, we've got Starmer earlier this week having dinner with Macron and Mertz in a coalition of the willing dinner. So, the EU reset at the same time as clinging onto the US as an important strategic partner. It leaves the UK, I think, in quite an interesting stock in the middle, basically in between these two different dynamics. So, I guess maybe to come back to the same question I asked Divya about the omnibus. When it comes to the sovereignty piece, what comes next? What should others be watching out for? First thing to take into consideration here is that this declaration sign in Berlin is legally non-binding, so we can consider it more aspirational than legally binding in that sense. But what is here and what is sort of important is the political momentum. And the legal tools that the Commission is putting forward in the next year to come. For example, the 2026 revision of the public procurement directive is where the sovereignty debate will become real, where the bi-European could shift from slogan to requirements and this for cloud AI compute infrastructure and you name it. We'll also see definitely some movement on sovereign cloud frameworks, AI investment ecosystem, new data sovereignty tools, such as localization access control, extra territoriality safeguard. So, this all is coming and next year will be critical in that sense. Europe is quietly building a digital industrial policy in that sense. Interesting. And I guess maybe just to round this out, although clearly they have big ambitions here about building European owned champions, European owned capabilities and kind of reducing reliance and dependencies on others, namely the US. I guess maybe just a practical note at the end about how likely you think that actually is, particularly at a time where there is clearly this international narrative around an AI race, for example, with obviously US and China kind of at the front of this. If Europe now says we're going to strip out all of our kind of building blocks and start again from scratch, do you think that leaves some in a bit of a weak position? Like how do they square that circle? In my opinion, this whole sovereignty debate is not about isolation of Europe. It's more about having control. And whereas the politics, geopolitics pull toward autonomy, the technology reality still pulls towards collaboration. Europe's very much relies on US providers. And in my opinion, the governments aren't trying to cut off the US. They're just trying to get guarantees on the data security, data access and applicable laws. And actually, I mean, I guess on that point, it's worth noting, of course, that one of the main companies that has been pushing this idea of sovereignty before it was even cool was American company Nvidia, Jensen Huang has been talking about this for a very long time. So clearly, there's a role for American companies in sovereignty. But what exactly that looks like sounds like it's still to be defined. I'm conscious of time. So just maybe to wrap things up, I thought maybe it was worth bringing the two pieces of the podcast together and thinking about the link between digital sovereignty and the digital omnibus that Divya spoke to us about earlier. So perhaps I can turn to each of you in turn to say where you think that link is. Sure. I guess I will start then. So I would say there are really two pieces of the same coin. The digital sovereignty piece from, in my opinion, is the overall political willpower behind the member states. Like the fact that they signed this declaration says a lot about the direction they're going to go with this. And it's also interesting because this comes at a time after a lot of the political momentum around the year stack initiative was built and the year stack initiative basically calls for this. It has several different layers of the stack of chips and then all the way to the supply and the infrastructure. Then we have the Cloud and AI Development Act that is set for early next year, which will essentially do the same thing. We also see this move towards more infrastructure building policies like the apply AI strategy, which looks at building sectoral, the sectoral parts of the AI infrastructure. So how does AI relate to healthcare machinery, robotics and that kind of thing. So we're seeing overall a shift from simply just regulating things and regulating technologies before they come to fostering these technologies and fostering their development. And that's I think where the digital simplification package comes, but it still leaves a lot of that open questions that I talked about earlier. And that there are many pieces of the puzzle that still need to be placed before we we even get to that place where we can be competitive. Great, don't you share anything to rad? Yes, those files may look unrelated on paper. One is the geopolitical declaration, one is a legislative package aimed at simplifying law, but they could be considered, indeed, as the DVS says, two sides of the same coin with digital omnibus being the bureaucratization pillar and digital sovereignty being the strategic autonomy pillar, which complement each other, and represents some sort of attempts to be for Europe to be more competitive. And as I said, earlier, more in control of its own digital assets. Finally, I think it's worth flagging that both, they are driven by the same anxiety, the one that Europe's digital framework legal and geopolitical, if you wish, are too fragmented, too dependent and file, so too slow. So that's an interesting question and one to watch closely in the months to come. Great, thank you so much, both of you, really interesting. Clearly, these are both topics that we will need to watch very closely over the coming months, and actually should update listeners that we will be producing a more substantive written report in the early months of 2026 that will focus on digital sovereignty across lots of different countries. So do watch out for that, and obviously, if you have views, we are in the market for any interesting ideas. If you would like to get in touch to discuss this or anything else more broadly, please do reach out. Our contact details are on the website, it's www.globaldashcancell.com. Thank you so much for listening.