The EU's new Digital Omnibus proposals would delay high-risk AI rules, relax parts of GDPR and expand data reuse for AI, shifting European digital governance toward more permissive, industry-friendly regulation. Over time this could rebalance privacy, innovation and competitiveness, with global spillovers for AI safety norms and cross-border data flows.
Verdict: Digital Omnibus would slow-roll high-risk AI rules and widen data reuse while still requiring approval by EU governments and Parliament (Reuters, 2025-11-19; European Commission, 2025-11-19). Civil and consumer groups see the package as a major rollback of GDPR and AI protections, especially around consent and profiling (EDRi, 2025-11-19; BEUC, 2025-11-19; noyb, 2025-11-19). Over the next decade, a diluted but still strict EU rulebook with patchy enforcement is more likely than full deregulation (Euronews, 2025-11-19; EU Perspectives, 2025-11-19).
Parliament and member states accept only limited parts of the Digital Omnibus. High-risk AI rules remain robust, consent standards stay strong and de-identification criteria are tightened. Enforcement bodies receive extra funding and guidance to make compliance simpler without eroding rights, and courts quickly clarify grey areas.
After intense negotiations, a compromise package delays parts of the AI Act and broadens some data-reuse grounds but preserves core GDPR protections. Big platforms benefit from more legal clarity for AI training, while watchdogs rely on strategic cases to restrain the most abusive uses. Europe remains stricter than the US but with growing enforcement gaps between countries.
Most proposed flexibilities pass with minimal safeguards, making broad legitimate-interest AI training on personal data standard practice. Under-resourced regulators struggle to oversee complex models, and structural profiling harms pile up before test cases reach top courts. Public backlash triggers fragmented national responses, increasing legal uncertainty and weakening trust in EU institutions.
A major AI-driven rights scandal or security incident erupts, reshaping the politics of digital regulation. Lawmakers abruptly reverse course, shelving the Omnibus and adding emergency guardrails that overshoot, chilling innovation. In parallel, a rival jurisdiction sets a competing, business-friendly standard, forcing Europe into a second rapid renegotiation to avoid isolation.
Developments: By late 2026, EU institutions will still be haggling over the Omnibus details and accompanying guidance. National data protection authorities and AI offices will publish early interpretations, signalling where they will tolerate flexibility and where they will not. Companies will start pre-emptive documentation and DPIAs around new AI training practices, even before all provisions are in force.
Risks: Lobbying may further weaken safeguards on consent and profiling during trilogues. Confusion about what counts as sufficiently de-identified data could prompt risky early deployments. Some firms might move aggressively to harvest and reuse data under the new legal theories, betting that regulators will not react quickly.
Outlook: Expect regulatory noise, draft guidance and intense campaigning on all sides. Concrete business changes will begin but remain reversible. The real balance between innovation and rights will not yet be visible.
Developments: By 2027, a final but contested Omnibus package is likely adopted, with delayed high-risk AI timelines and clarified training-data rules. Several member states will transpose or align national laws and set up new AI supervisory structures. First strategic litigation and complaints will target invasive profiling and opaque credit, insurance or employment models built under the relaxed regime.
Risks: Divergent national interpretations may create a patchwork of de facto rules inside the single market. Understaffed regulators could prioritise narrow procedural compliance over substantive harms, undermining deterrence. Businesses might overestimate how permissive courts will be, creating latent legal liabilities that surface years later.
Outlook: The new framework will be on the books but not yet fully battle-tested. Some experimentation with expansive AI data use will proceed. Early enforcement signals will shape how far most actors are willing to push.
Developments: By 2028, high-risk AI provisions should be active, and supervisory authorities will have developed internal expertise. A handful of prominent cross-border cases and fines will clarify boundaries for AI profiling, biometric uses and automated decision-making. Industry will have adjusted governance processes to align with the compromise regime and emerging technical standards.
Risks: If court rulings diverge or drag on, regulatory uncertainty could persist, discouraging smaller innovators. Rights violations in marginalised communities might remain under-detected if complaint mechanisms are weak. Political pressure from future governments could reopen the rulebook again, extending the period of instability.
Outlook: The system will begin to resemble a stable regime, with clear do's and don'ts. However, uneven protection across member states will remain. Trust will depend heavily on visible enforcement outcomes.
Developments: Around 2030, the EU's hybrid of strict principles and pragmatic flexibilities will influence AI rules from Latin America to parts of Africa and Asia. Large platforms will maintain global compliance programmes anchored in EU requirements, while some mid-sized firms may geo-fence features. Interoperable standards for documentation, risk assessment and audit trails will be widely used across sectors.
Risks: If enforcement stays inconsistent, Europe's reputation as a rights leader could erode, weakening its soft power. Trade tensions with partners that see EU rules as de facto extraterritorial could intensify. A major AI harm linked to data reuse under EU law might trigger abrupt emergency tightening, disrupting long-term investments.
Outlook: EU digital policy will still act as a reference model, but no longer unchallenged. Businesses will treat compliance as a manageable, recurring cost. Citizens' actual experience of privacy and fairness may lag behind the law's formal ambitions.
Developments: By the mid-2030s, Omnibus-era compromises will be fully absorbed into jurisprudence, guidelines and technical practice. Generative and foundation models will routinely train on mixed datasets governed by layered consent, legitimate interest and contractual grounds. Cross-Atlantic and cross-Asian regulatory dialogues will have produced partial mutual recognition or interoperability for some AI assurance mechanisms.
Risks: Long-term data aggregation could enable powerful behavioural prediction and manipulation within the law's formal limits. Structural disparities in enforcement resources between countries may deepen internal market fragmentation. A new technological paradigm, such as ubiquitous embodied AI, could render parts of the rulebook obsolete faster than they can be revised.
Outlook: The EU will have a mature yet imperfect governance framework for AI and data. Political debates will center on distributional fairness and state surveillance, not only corporate power. Incremental reforms will continue rather than another grand overhaul.
Developments: By the mid-2040s, multiple generations of lawyers, engineers and regulators will have been trained under Omnibus-shaped assumptions about data and AI. Institutions, standards bodies and courts will exhibit strong path dependence, making radical shifts in direction difficult. EU norms on documentation, explainability and risk classification will be embedded in global infrastructure, from chips to cloud platforms.
Risks: Entrenched frameworks might inhibit beneficial experimentation or novel rights-protecting architectures. Historical data amassed under earlier, looser regimes could continue to shape automated decisions even if rules later tighten. Competing geopolitical blocs could weaponise regulatory divergence, fragmenting AI ecosystems and reducing cooperation on safety.
Outlook: The EU's choices in the 2020s will still echo through technical and legal systems. Reversing course will be expensive and slow. The main challenge will be adapting entrenched governance to unforeseen technologies and power structures.
Developments: By the 2070s, Omnibus-era debates will be seen as part of the founding chapter of global AI governance. Archival records will show how trade-offs between innovation, rights and power set precedents for later, more advanced machine systems. Long-lived socio-technical infrastructures built on 2020s data and models may still influence decision-making in subtle ways.
Risks: Historical under-protection of privacy and autonomy could have cumulative effects on democratic resilience, social cohesion and psychological well-being. If regulatory frameworks failed to anticipate concentrated control of AI infrastructure, their legacy may include entrenched oligopolies. Alternatively, repeated pendulum swings between permissive and restrictive regimes might have produced regulatory fatigue and cynicism.
Outlook: Precise details are highly uncertain, but early EU choices will help shape whether AI-augmented societies retain strong individual and collective rights. Governance institutions created now may either adapt successfully or become cautionary tales. Long-run outcomes will depend as much on civic culture and politics as on today's legal texts.