The EU's digital simplification push: what lies ahead for business?

After a decade of introducing ambitious digital laws and regulations, the European Commission is now rapidly advancing a digital simplification agenda: to streamline overlapping regulatory obligations, reduce compliance burdens and ensure consistency across the EU’s expanding digital framework.

At the heart of this agenda is the Commission's Omnibus IV package (published on 21 May 2025) and its upcoming Digital Omnibus (part of the Digital Package on Simplification), expected to be presented on or around 19 November 2025. 

The Digital Omnibus proposes targeted amendments to align definitions, reporting obligations and supervisory mechanisms across multiple digital laws on data, AI and cybersecurity. It has been shaped by the extensive feedback received on the Commission's recent call for evidence on areas where digital regulation in the EU can be made more coherent and proportionate. A Digital Fitness Check (a broader evaluation of the entire EU digital framework) is also expected to follow in the coming months.

These efforts feed directly into the Commission’s 2026 Work Programme, published on 22 October 2025, which aims to build on this simplification momentum by focusing on making "EU law lighter, clearer and easier to implement" as well as promoting swift and robust enforcement.

How has the digital simplification agenda progressed and how can businesses prepare for change?

Omnibus IV 

Omnibus IV includes proposals that will amend existing EU laws across a range of areas including data protection, product laws, digitalisation, sustainability and financial services. It is intended to provide targeted relief for smaller companies, targeted amendments to other existing regimes and a "digital by default" approach for product law compliance.

Targeted relief for smaller companies 

Omnibus IV is largely framed around the introduction of a new category of business enterprise – small-mid caps (SMCs) – which sit in between small and medium-sized enterprises (SMEs) and large enterprises.  SMCs are defined as having fewer than 750 employees and having either an annual turnover of up to €150m or total assets of up to €129m.

Businesses that have previously been categorised as "large" for the purposes of regulatory compliance and reporting requirements may fall into this new SMC category. SMCs will be subject to simplified rules and obligations, including:

• GDPR derogations: Certain derogations currently available to SMEs under the General Data Protection Regulation (GDPR) will be extended to SMCs, in particular relief from record-keeping obligations under Article 30 unless the processing of personal data would be considered to pose a "high risk" to individuals' rights under the GDPR.
• Simplified prospectus: SMCs will also benefit from amendments to the Prospectus Regulation and the Markets in Financial Instruments Directive II (MiFID II). Short-form and standardised prospectuses currently available for listed and to-be-listed SMEs will now be extended to all offers of securities to the public made by SMCs. The draft directive also proposes to amend MiFID II so that SMCs are defined as listed companies with an average market capitalisation equal to or higher than €200,000 and lower than €1bn on the basis of end-year quotes for the previous three calendar years – enabling SMCs to access capital markets through SME growth markets. 

Targeted amendments to other existing regimes 

Omnibus IV also aims to simplify and align provisions in product safety, batteries and other sectoral rules to reduce overlaps and contradictions that create legal uncertainty for businesses operating cross-border in the Single Market.

• EU Battery Regulation: The Commission has given all companies more time to comply with due diligence obligations under Battery Regulation (EU) 2023/1542, with obligations postponed from 18 August 2025 to 18 August 2027. Companies with a turnover of less than €150m will additionally be exempt from the due diligence obligations and the tracing of supply chains for battery raw materials. This derogation previously only applied to companies with a turnover of less than €40m.
• F-Gas Regulation: Importers and exporters of products and equipment containing fluorinated gases (F-gases) will only have to register on the EU F-gas portal if they are (i) importers who exceed certain annual F-gas thresholds or (ii) exporters of certain products and equipment containing F-gases with particularly high global warming potential  prohibited in the EU.

A 'digital by default' approach for product law compliance 

Under current product laws and regulations, companies are required to provide documentation in paper form. Omnibus IV proposes that these requirements are replaced with electronic Declarations of Conformity and instructions for use in digital format (with safety information to still be provided in paper format to protect the safety of consumers). It also proposes:

• digital contact points to facilitate communication between economic operators and national authorities;
• digitalising compliance and reporting obligations so that businesses can interact with authorities and upload required documentation electronically, rather than through paper-based regimes;
• the introduction of common specifications as an alternative to harmonised standards; and
• integration with Digital Product Passports where applicable.

Overall, the Commission estimates that Omnibus IV could cut approximately €400 million per year in administrative costs. 

Following Member States' approval of the EU Council's position on the Commission's proposals, Omnibus IV will now be considered by the Council and the Parliament with a view to agreeing on a final text. Although timeframes can vary, negotiations could span 12-18 months.

The Digital Omnibus and Digital Fitness Check

The primary objective of the Digital Omnibus initiative is to focus on the immediate adjustments that can be made to lower administrative costs for businesses, EU administrations and citizens without compromising the fundamental aims of the underlying rules. 

The Digital Omnibus proposes to simplify legislation on data, cybersecurity and AI while remaining aligned with the Commission's target set out in its earlier Competitiveness Compass to cut administrative burdens by at least 25% for all companies and at least 35% for SMEs.  

As part of the Digital Omnibus, the Commission opened a call for evidence, seeking views from businesses and industry stakeholders on its simplification proposals, including on the following:

• The data acquis comprising the Data Governance Act, the Free Flow of Non-Personal Data Regulation and the Open Data Directive.
• The ePrivacy Directive which lays down the rules on cookies and other tracking technologies
• Cybersecurity-related incident reporting obligations.
• The smooth application of the AI Act rules.
• Other aspects related to electronic identification and trust services under the European Digital Identity Framework, including in view of the regulatory alignment with the forthcoming proposal for an EU Business Wallet and applying the "one in, one out" principle.

The call for evidence closed on 14 October. With over 500 responses submitted, feedback was varied. While many respondents welcome the simplification measures, agreeing with targeted amendments to legislation to reduce red tape and compliance costs, others take a more cautious stance. 

Next steps

The Digital Omnibus package is expected to be presented around 19 November.

Once the immediate regulatory adjustments are established through the Digital Omnibus, the Commission will conduct a Digital Fitness Check to evaluate the cumulative effect, the coherence and the opportunities that can be created in the application of the digital acquis and related rules across the EU Single Market. It also intends to explore the potential for further simplification measures regarding data regulation, to enhance data availability and sharing.  

Another public consultation is expected to be published on the details of the Digital Finess Check. 

Osborne Clarke comment

Having laid much of the groundwork for its digital simplification agenda, the Commission is challenged with balancing the pursuit of simpler, streamlined regulatory frameworks against the need to ensure protections and safeguards are maintained. It is this tension which is likely to come under scrutiny during parliamentary negotiations.

For businesses, the scope and timing of regulatory change remains uncertain.  Indeed, recent reports suggest that the Commission will propose delaying the implementation of the AI Act's rules on high-risk AI by at least one year – a move that would go some way towards addressing concerns that the technical standards to be relied upon by companies to comply with the AI Act's high-risk AI requirements would not be ready in time to allow organisations adequate time to prepare for compliance by the current deadline of 2 August 2026. Similarly, there are suggestions that enforcement of some of the AI Act's rules on labelling AI-generated content will be pushed back, giving businesses time to adopt workable solutions.

Organisations should monitor developments closely and consider engaging with the proposed consultation on the Digital Fitness Check to ensure that their views are put to the Commission before it formalises its simplification package.

On a practical note, organisations that may fall in within scope of the new SMC category under Omnibus IV should begin assessing their eligibility and preparing for potential compliance changes/gaps, including relaxed reporting requirements.  In particular, businesses placing products on the EU market that maintain paper documentation should assess their current processes, how they will migrate to electronic formats and digital files as well as the cost of associated resources and personnel.

Osborne Clarke can help you prepare for, implement and comply with all aspects of digital regulation.  Please contact one of our experts if you have any questions, and read more about the next phases.