LEAKED: EU’s ‘Digital Omnibus on AI’ points to pragmatic fixes for a smoother AI Act rollout

A leaked European Commission working draft proposes a targeted “Digital Omnibus on AI” designed to simplify and stabilise implementation of the AI Act, without it claims lowering protections. The proposal seeks to align timelines, streamline governance, and rationalise procedures. The key points are set out below.

• Timing relief: the draft would grant providers of generative AI already on the market a one year grace period to retrofit machine readable watermarking, with penalties for Article 50(2) watermarking starting on 2 August 2027. 
• SME/SMC measures: the draft would extend the advantages currently conferred under the EU AI Act to small and medium-sized enterprises (“SMEs”) to small mid cap enterprises (roughly those with  around 250-749 employees), including in respect of proportionate quality management and simplified technical documentation via a Commission template that notified bodies must accept. 
• Data governance: the proposal suggests a narrow legal basis for providers and deployers of AI systems to process special category data solely to detect and correct bias, subject to strict safeguards. 
• Testing and conformity: AI regulatory sandboxes and real world testing to be broadened out to high risk systems. This would include enabling an EU level AI regulatory sandbox run by the AI Office to complement national regimes and support cross border coordination. To cut duplication, notified bodies could use single applications/assessments across regimes, with Cyber Resilience Act compliance deemed to meet overlapping cybersecurity requirements. 
• Centralised governance: governance would tilt toward the centre, with the AI Office supervising general purpose AI based systems where model and system share a provider, and systems embedded in designated large online platforms and search engines. The Commission would set enforcement procedures, run pre market testing for certain high risk systems, and streamline cooperation with fundamental rights authorities, backed by added resources for the AI Office, aiming for simpler, faster and more predictable implementation while preserving core protections.  

Comment

The draft reflects the tension between the regulatory instincts of the Commission and the recognition that the heavy regulatory regime within the EU may be choking off innovation and new business, also mirrored by its proposed wider Digital Fitness Check: a stocktake of whether the EU’s range of digital rules is hitting the mark or inhibiting business and investment.  

It remains to be seen what will be kept in the final draft.  If implemented the proposals would provide a welcome respite in respect of some obligations under the Act, but fall well short of a wholesale retreat.  Moreover, many provisions of the AI Act are already in force with a further tranche due in February and then in August of 2026 so the Commission would have to move very fast to abate in any way the effect of the rolling implementation of the Act.