EU Commission proposes to simplify digital rules and new digital wallets

Brussels, 19 November 2025

Europe’s businesses, from factories to start-ups, will spend less time on administrative work and compliance and more time innovating and scaling-up, thanks to the European Commission’s new digital package. This initiative opens opportunities for European companies to grow and to stay at the forefront of technology while at the same time promoting Europe’s highest standards of fundamental rights, data protection, safety and fairness.

At its core, the package includes a digital omnibus that streamlines rules on artificial intelligence (AI), cybersecurity and data, complemented by a Data Union Strategy to unlock high-quality data for AI and European Business Wallets that will offer companies a single digital identity to simplify paperwork and make it much easier to do business across EU Member States.

The package aims to ease compliance with simplification efforts estimated to save up to €5 billion in administrative costs by 2029. Additionally, the European Business Wallets could unlock another €150 billion in savings for businesses each year.

Digital Omnibus

With today’s digital omnibus, the Commission is proposing to simplify existing rules on Artificial Intelligence, cybersecurity, and data.

Innovation-friendly AI rules: Efficient implementation of the AI Act will have a positive impact on society, safety and fundamental rights. Guidance and support are essential for the roll-out of any new law, and this is no different for the AI Act.

The Commission proposes linking the entry into application of the rules governing high-risk AI systems to the availability of support tools, including the necessary standards.

The timeline for applying high-risk rules is adjusted to a maximum of 16 months, so the rules start applying once the Commission confirms the needed standards and support tools are available, giving companies support tools they need.

The Commission is also proposing targeted amendments to the AI Act that will:

Extend certain simplifications that are granted to small and medium-sized enterprises (SMEs) and small mid cap companies (SMCs), including simplified technical documentation requirements, saving at least €225 million per year;

Broaden compliance measures so more innovators can use regulatory soundboxes, including an EU-level sandbox from 2028 and more real-world testing, especially in core industries like the automotive;

Reinforce the AI Office’s powers and centralise oversight of AI systems built on general-purpose AI models, reducing governance fragmentation.

Simplifying cybersecurity reporting: The omnibus also introduces a single-entry point where companies can meet all incident-reporting obligations. Currently, companies must report cybersecurity incidents under several laws, including among others the NIS2 Directive, the General Data Protection Regulation (GDPR), and the Digital Operational Resilience Act (DORA). The interface will be developed with robust security safeguards and will undergo comprehensive testing to ensure its reliability and effectiveness.

An innovation-friendly privacy framework: Targeted amendments to the GDPR will harmonise, clarify and simplify certain rules to boost innovation and support compliance by organisations, while keeping intact the core of the GDPR, maintaining the highest level of personal data protection.

Modernising cookie rules to improve users’ experience online: The amendments will reduce the number of times cookie banners pop up and allow users to indicate their consent with one-click and save their cookie preferences through central settings of preferences in browsers and operating system.

Improving access to data: Today’s digital package aims to improve access to data as a key driver of innovation. It simplifies data rules and makes them practical for consumers and businesses by:

Consolidating EU data rules through the Data Act, merging four pieces of legislation into one for enhanced legal clarity;

Introducing targeted exemptions to some of the Data Act’s cloud-switching rules for SMEs and SMCs resulting in around €1.5 billion in one-off savings;

Offering new guidance on compliance with the Data Act through model contractual terms for data access and use, and standard contractual clauses for cloud computing contracts;

Boosting European AI companies by unlocking access to high-quality and fresh datasets for AI, strengthening the overall innovation potential of businesses across the EU.

Data Union Strategy

The new Data Union Strategy outlines additional measures to unlock more high-quality data for AI by expanding access, such as data labs. It puts in place a Data Act Legal Helpdesk, complementing further measures to support implementation of the Data Act. It also strengthens Europe’s data sovereignty through a strategic approach to international data policy: anti-leakage toolbox, measures to protect sensitive non-personal data and guidelines to assess fair treatment of EU data abroad.

European Business Wallet

This proposal will provide European companies and public sector bodies with a unified digital tool, enabling them to digitalise operations and interactions that in many cases currently still need to be done in person. Businesses will be able to digitally sign, timestamp and seal documents; securely create, store and exchange verified documents; and communicate securely with other businesses or public administrations in their own and the other 26 Member States.

Scaling up a business in other Member States, paying taxes and communicating with public authorities will be easier than ever before in the EU. Assuming broad uptake, the European Business Wallets will allow European companies to reduce administrative processes and costs, thereby unlock up to €150 billion in savings for businesses each year.

Next Steps

The digital omnibus legislative proposals will now be submitted to the European Parliament and the Council for adoption. Today’s proposals are a first step in the Commission’s strategy to simplify and make more effective the EU’s digital rulebook.

The Commission has today also launched the second step of the simplification agenda, with a wide consultation on the Digital Fitness Check open until 11 March 2026. The Fitness Check will ‘stress test’ how the rulebook delivers on its competitiveness objective, and examine the coherence and cumulative impact of the EU’s digital rules.

Background

The Digital package marks the seventh omnibus proposal. The Commission set a course to simplify EU rules to make the EU economy more competitive and more prosperous by making business in the EU simpler, less costly and more efficient. The Commission has a clear target to deliver an unprecedented simplification effort by achieving at least 25% reduction in administrative burdens, and at least 35% for SMEs until the end of 2029.

More information

Quote(s)

We have all the ingredients in the EU to succeed. We have talent, infrastructure, a large internal single market. But our companies, especially our start-ups and small businesses, are often held back by layers of rigid rules. By cutting red tape, simplifying EU laws, opening access to data and introducing a common European Business Wallet we are giving space for innovation to happen and to be marketed in Europe. This is being done in the European way: by making sure that fundamental rights of users remain fully protected.

^{Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy}

Closing the innovation gap and cutting red tape are key drivers to boost the EU’s productivity. Our Digital Omnibus seeks to do both. Today’s proposal represents an important first step in our digital simplification agenda, aiming to create a more favourable business environment for European companies. A Digital Fitness Check also launched today, comprising wide public consultation, will guide our next steps. By simplifying rules, reducing administrative burdens, and introducing more flexible and proportionate rules, we will continue delivering on our commitment to give EU businesses more space to innovate and grow.

^{Valdis Dombrovskis, Commissioner for Economy and Productivity; Implementation and Simplification}

The objective of the targeted amendments to the General Data Protection Regulation (GDPR) is to maintain the effectiveness and integrity of this landmark regulation while also addressing stakeholder calls to clarify, simplify and harmonise the GDPR. It is essential that the European Union acts to deliver on simplification and competitiveness while also maintaining a high level of protection for the fundamental rights of individuals – and this is precisely the balance this package strikes.

^{Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection}

Source – EU Commission

Remarks by Executive Vice-President Virkkunen, Commissioner Dombrovskis and Commissioner McGrath on the digital simplification package

Brussels, 19 November 2025

“Check against delivery”

Executive Vice-President Henna Virkkunen

The Commission is putting forward today a package of measures with a clear and determined goal: to give a boost to EU competitiveness.

From factories to start-ups, the digital package is the EU’s answer to calls to reduce burdens on our businesses.

We are doing so through three areas of action.

Firstly, I am presenting the Data Union Strategy, to fuel the digital economy with its essential resource: high quality data for the development of AI.

Secondly, the European Business Wallets, which offer a digital solution for businesses to interact effortlessly with authorities and other businesses across the EU.

And finally, digital omnibus simplifies digital rules in the areas of artificial intelligence, cybersecurity and data.

Commissioner Dombrovskis will shortly continue by telling you more about the joint simplification agenda of this Commission, and Commissioner McGrath will elaborate the GDPR perspective.

We are putting forward these measures, because Europe needs to act now, and to remain faithful to its core values.

We have identified these measures as the most urgent, following discussions with European businesses, including SMEs, civil society, and beyond.

But we are also clear that simplification does not mean softening our safeguards. We stand firmly behind our high standards for privacy, fairness and security.

Because EU regulation is a trustmark for businesses. We are the one place on the planet that has framed the rules of the game in this way, to protect our values and fundamental rights.

However, regulation alone is not enough. We must move from rulemaking to innovation-building. Our rules should not be a burden, but an added value.

For this, we need immediate steps to get rid of regulatory ‘clutter’, where there is any, and focus instead on clear and predictable rules, and solid enforcement.

And that is what we are doing today.

First, cutting all unnecessary administrative costs for compliance by at least €5 billion by 2029 through the digital omnibus and saving companies at least €150 billion per year with our European Business Wallets.

Second, we are stimulating innovation. With the Data Union Strategy, we are proposing measures for fundamentally scaling up the availability of high-quality data for AI development in the EU, and strengthening the EU’s approach to international data flows.

Today’s measures are unlocking the data for AI across Europe.

The Data Union Strategy builds on the AI Continent Action Plan and the Apply AI strategy, scaling up the availability of high-quality data for AI through data labs, synthetic data and boosting common European data spaces.

We are also strengthening the EU’s approach to international data flows to ensure better global access to data, while safeguarding EU sensitive non-personal data.

For businesses, this means easier compliance, better access to more data, more opportunities for innovation and greater EU data sovereignty.

Simplification is not just about rules but about giving people digital tools to make processes easier.

That is what we are doing with the European Business Wallets: offering companies a powerful new key to the single market.

The Wallets will make it simpler, faster and cheaper to do business in the EU. They will provide a unique digital identity valid across the entire Union so companies and public sector bodies will be able to identify, authenticate and exchange data in a secure and user-friendly way.

This means businesses will have 26 times less hassle when operating everywhere in the EU.

Let me continue now with the omnibus.

Here, we focus on simplifying the rules for the areas that are vital to the EU’s digital competitiveness: AI, cyber and data.

For the AI Act, we need to make adjustments to ensure the optimal application of the rules. This is not about backing down from the rules. It is about ensuring support tools like standards, specifications and guidelines are in place before high-risk rules apply.

Secondly, on cybersecurity, we are introducing a single-entry point for incident reporting, so companies no longer have to replicate reporting.

They will only need to report once, in one single place, and the information will reach all authorities that need to receive it.

Finally, we are making the data rulebook much leaner, cutting four legal acts down to one – the Data Act.

We are cutting administrative costs, for example with targeted exemptions for SMEs and small mid-caps in the Data Act and the AI Act.

We are ensuring that access to data and building value from data is a priority.

We are giving a face-lift with targeted amendments to the GDPR that reflect how technologies have evolved. In particular, we are adopting measures to ensure that AI development is encouraged in Europe and clearly framed by our rules.

With the AI Act amendments, we are also stimulating real up-take of AI: with EU-level sandboxes and real-life testing of AI.

This is not about backing down from the rules but ensuring support tools like standards, specifications and guidelines are in place before high-risk rules apply.

Simplification should not only be for businesses, but also for consumers. We are finally addressing cookie banner fatigue. I think we can all agree we have spent too much of our time accepting or rejecting cookies every time we visit a website.

Consumers need to make informed choices, not just click-through blindly so they can reach the content they want.

With today’s measures, consumers will stay in control, and can accept or refuse cookies with one click and with central controls.

This is a first set of measures, but not the last step.

We are also opening today a consultation for a full Digital Fitness Check, assessing the cumulative impact of the entire digital rulebook on EU’s competitiveness.

Together, we are building a simpler, clearer and faster Europe.

***

EU Commissioner Valdis Dombrovskis

I would like to begin by providing some broader context for today’s proposals on the digital omnibus.

Earlier this week, I presented the European Commission’s Autumn Economic Forecast.

It makes clear that the challenging external environment means that Europe’s future growth will be fuelled in large part by domestic drivers.

No one else is going to do it for us.

This means taking the initiative.

To unlock Europe’s full growth potential, and secure our long-term prosperity, we must redouble our efforts to implement the Competitiveness Compass.

The Draghi Report, which underpins the Compass, emphasises the importance of simplification when it comes to digital regulation.

Indeed, the Compass has cutting red tape at its core.

That’s why we have set a target to reduce administrative costs by 25% for all companies, and 35% for SMEs.

We have made a strong start to delivering our simplification agenda. And we will continue to present simplification proposals throughout the Commission’s current mandate.

However, for business to feel the end results, the proposals have to be approved by the co-legislators.

We will continue to work with the European Parliament and Council to make swift progress on the passage of this legislation.

The Draghi Report also emphasised the fundamental importance of closing the innovation gap in the emerging technologies that will drive future growth.

And this proposal responds to what we have learned through our engagement with stakeholders.

As Executive Vice-President Virkkunen has already explained, it will update and combine several existing digital laws that have grown complex over time.

It focuses on three main areas:

Making data rules easier to understand and use.
Simplifying how companies report cybersecurity incidents.
Helping with the smooth rollout of the new Artificial Intelligence (AI) Act.

Moreover, we continue extending benefits enjoyed by SMEs to Small Mid Cap companies, this time under the AI Act.

In doing so, we are delivering on our commitment in the Single Market Strategy and actions under the fourth omnibus package further to enable also Small Mid Cap companies to benefit from proportionate requirements.

Overall, we estimate that the digital omnibus could result in at least €1 billion in annual savings for our businesses, public administrations and citizens, from the moment of their entry into force.

That brings the total annual administrative savings stemming from the omnibus proposals and other simplification initiatives already presented, to €9.6 billion.

This already represents a very significant portion of the overall target of €37.5 billion in annual administrative cost savings by the end of this Commission’s mandate.

Our approach to simplification will not change or undermine the main objectives of the EU’s digital rules, such as protecting personal data or ensuring safe AI.

But it makes them more practical and consistent.

I would also like to emphasise that the digital omnibus is only the first step in the Commission’s simplification efforts in the digital domain.

It seeks to provide our businesses with immediate relief by targeting low-hanging fruit.

In parallel, the Digital Fitness Check launched today will stress test the entire EU digital acquis to identify further areas for potential simplification.

To conclude, Europe has not so far reaped the full benefits of the digital revolution.

We cannot afford to pay the price of failing to keep up with the demands of a changing world.

So, today’s package of measures sends a clear message.

Europe is willing and able to adapt to fully embrace the digital age and the AI technology that will drive productivity for future European growth.

***

EU Commissioner Michael McGrath

As part of today’s digital omnibus, I am pleased to present a series of targeted amendments to the General Data Protection Regulation.

Let me emphasise here the word ‘targeted’ – concrete changes to simplify things in the interest of citizens and businesses.

Let me also emphasise the word ‘amendments’ – these are clarifications of existing concepts and principles, not a reopening of the GDPR.

Its very core remains intact.

And this is precisely the balance this package strikes today.

These amendments aim:

To harmonise, clarify, and simplify the application of the GDPR – while continuing to ensure a high-level of data protection across the EU;
And to facilitate operators’ compliance with the GDPR and support technological innovation in the EU – including through the development of European AI.

They benefit citizens and consumers:

By ensuring a more uniform application of the GDPR; and
By bringing clarity to key GDPR concepts.

And they form part of the Commission’s broader agenda of simplifying EU rules to deliver a more competitive and prosperous European economy – as my colleagues Henna and Valdis have already explained.

Today’s proposed changes are based on continuous dialogue with stakeholders during this last year, including in the context of the Implementation Dialogue on the application of the GDPR which I held in July. This Implementation Dialogue brought together a wide range of stakeholders, businesses, and civil society organisations alike.

Member States have also expressed their views on how they see the GDPR going forward in the context of several Council discussions.

The core message from them was that they consider the GDPR to be an effective and balanced legal framework which has met its objectives. Overall, there was no call for a general reopening of the GDPR. In simple terms, the GDPR works.

However, it became clear that targeted measures to further harmonise the application of the GDPR and to simplify certain obligations are required. This is to ensure that the GDPR continues:

To protect fundamental rights and freedoms of citizens; and
To ensure the free flow of data between Member States.

The targeted amendments presented today also reflect recent significant judgments from the Court of Justice of the European Union as well as opinions from the European Data Protection Board.

Regarding the amendments themselves, let me highlight a few which concretely:

Clarify the notion of personal data to reflect the case law of the European Court of Justice;
Specify when data protection impact assessments should be conducted;
Simplify and facilitate data breach notifications from organisations to supervisory authorities;
Simplify the information that needs to be provided by companies to citizens in low-risk cases. This aims to address a long-standing request from smaller operators when managing their customer data, for example, local sports clubs when managing memberships; and
Clarify that personal data can be used in the development of AI subject to the strong GDPR safeguard we have in place.

We are also introducing changes to the current rules on cookie banners to make sure users can express real choices and keep their devices safe:

Users will stay in control and will be able to accept or refuse cookies with one click.
Organisations will need to respect users’ choices for 6 months.
We also propose to define further low-risk situations for which consent should not require to collect personal data from connected devices.
This would be the case for instance to maintain or restore the security of a device.

As is clear, these proposed amendments are very practical and concrete, and they fully respect the high level of protection of personal data that we are committed to.

But through clearer rules and simplified obligations, these changes will reduce administrative burdens and deliver cost savings to operators, companies, and organisations alike.

And they will also result in more efficient and harmonised data protection policies, and in focussing resources in areas where data protection is critical.

Source – EU Commission