EU’s AI shake-up ‘injects new uncertainty’
William Fry technology partner Barry Scannell says that European Commission plans to overhaul its digital framework “inject new uncertainty” into the EU’s most ambitious technology law.
He was commenting after the commission last week unveiled its Digital Omnibus Package, which includes a proposed Digital Omnibus Regulation and a Digital Omnibus on AI Regulation.
The package includes changes across data law, cyber-security, digital identity and the EU’s AI Act.
High-risk AI systems
In an analysis on the firm’s website, Scannell writes that nowhere is the new uncertainty more visible than in the future of high-risk AI.
The William Fry partner points out that the AI Act originally set a clear timetable, with high-risk systems due to fall under binding obligations in 2026 and 2027.
“The omnibus breaks that certainty. The new rules will only apply once the commission adopts a formal decision confirming that harmonised standards, common specifications, and support tools are available,” he states.
Scannell notes that, if the commission delays, the regime will not start until backstop dates of December 2027 for some high-risk AI systems and August 2028 for others.
He adds that the omnibus also reshapes the governance architecture of the act, with several changes that include the extension of simplified compliance measures from SMEs to ‘small mid-caps’ (companies with fewer than 750 employees).
GDPR changes
The package also includes several amendments to the GDPR, which include clarification on the definition of ‘personal data’ and the streamlining of rules on cookies.
Users will be able to refuse non-essential cookies with one click and set preferences centrally at the browser level.
Scannell also notes that the GDPR changes clarify the use of legitimate interest as a basis for training AI models, provided GDPR safeguards are observed and individuals can object.
Dates ‘shape investment decisions’
The William Fry partner says that many of the reforms achieve the commission’s stated objective of simplifying rules and saving businesses billions in costs.
“Yet the core uncertainty introduced by the floating start date for high-risk AI is significant.
“Businesses are uncertain whether their most stringent obligations will apply in 2026, 2027, or 2028,” he says, adding that this will shape investment decisions, product design, compliance planning, and the strategic positioning of AI development across Europe.
“The EU has set out to refine its digital rulebook. It has also created a regulatory horizon that is more efficient on paper, but less predictable in practice,” Scannell concludes.