Is EU Regulation complex?

Henna Virkkunen held a speech at the 2025 edition of the Davos World Economic Forum discussing the AI Act that the European Commission adopted early to avoid fragmentation in the Eurpean AI landscape. She argued that for example in the United States of America, the number of state-level AI regulations approaches 200 according to a research from Stanford University. In contrast to this, we deal with a single bill here in Europe which is adapted dynamically to suit the needs of society and all its stakeholders. See also our write up of the "Digital Omnibus".

Digital Omnibus

At the end of November 2025, the European Commission initiated the so-called "Digital Omnibus". Basically, this is a large initiative to adapt the regulations in force to suit the current needs of all stakeholders. Part of this was the consultation "Apply AI" to which we contributed feedback from the experience of running experiments together with you. 

The "Digital Omnibus" suggest a number of changes to the "AI Act" but also to legislation that addresses data privacy such as the General Data Protection Rules (GDPR). In depth material is available online and discussed at national institutions level. We have selected a few items that you might be interested in below.

 

topics addressed

  • extending regulatory simplifications granted to small and medium-sized enterprises (SMEs) to small mid-caps (SMCs), including simplified technical documentation requirements and special consideration in the application of penalties;
  • requiring the Commission and the Member States to foster AI literacy instead enforcing unspecified obligation on providers and deployers of AI systems in this respect, while training obligations for high-risk deployers remain;
  • offering more flexibility in the post-market monitoring by removing a prescription of a harmonised post-market monitoring plan;
  • reducing the registration burden for providers of AI systems that are used in highrisk areas but for which the provider has concluded that they are not high-risk as they are only used for narrow or procedural tasks;
  • Centralising oversight over a large number of AI systems built on general-purpose AI models or embedded in very large online platforms and very large search engines with the AI Office;
  • facilitating compliance with the data protection laws by allowing providers and deployers of all AI systems and models to process special categories of personal data for ensuring bias detection and correction, with the appropriate safeguards;
  • a broader use of AI regulatory sandboxes and real-world testing, that will benefit European key industries such as the automotive industry, and facilitating an EU-level AI regulatory sandbox which the AI Office will set up as from 2028;
  • targeted changes clarifying the interplay between the AI Act and other EU legislation and adjusting the AI Act’s procedures to improve its overall implementation and operation

paragraphs addressed

  • (9) in Article 17, paragraph 2 is replaced by the following: ‘2. The implementation of the aspects referred to in paragraph 1 shall be proportionate to the size of the provider’s organisation, in particular, if the provider is an SMC or an SME, including a start-up. Providers shall, in any event, respect the degree of rigour and the level of protection required to ensure the compliance of their high-risk AI systems with this Regulation.’;
  • (21) Article 63(1) is replaced by the following: ‘1. SMEs, including start-ups, may comply with certain elements of the quality management system required by Article 17 in a simplified manner. For that purpose, the Commission shall develop guidelines on the elements of the quality management system which may be complied with in a simplified manner considering the needs of SMEs, without affecting the level of protection or the need for compliance with the requirements in respect of high-risk AI systems.’;
  • (23) in Article 70, paragraph 8 is replaced by the following: ‘8. National competent authorities may provide guidance and advice on the implementation of this Regulation, in particular to SMCs and SMEs, including start-ups, taking into account the guidance and advice of the Board and the Commission, as appropriate. Whenever national competent authorities intend to provide guidance and advice with regard to an AI system in areas covered by other Union law, the national competent authorities under that Union law shall be consulted, as appropriate.’;
  • (27) Article 95, paragraph 4 is replaced by the following: ‘4. The AI Office and the Member States shall take into account the specific interests and needs of SMCs and SMEs, including start-ups, when encouraging and facilitating the drawing up of codes of conduct.’;
  • (28) in Article 96(1), the second subparagraph is replaced by the following: ‘When issuing such guidelines, the Commission shall pay particular attention to the needs of SMCs and SMEs including start-ups, of local public authorities and of the sectors most likely to be affected by this Regulation.’;
  • (29) Article 99 is amended as follows: (a) paragraph 1 is replaced by the following: ‘1. In accordance with the terms and conditions laid down in this Regulation, Member States shall lay down the rules on penalties and other enforcement measures, which may also include warnings and nonmonetary measures, applicable to infringements of this Regulation by operators, and shall take all measures necessary to ensure that they are properly and effectively implemented, thereby taking into account the guidelines issued by the Commission pursuant to Article 96. The penalties provided for shall be effective, proportionate and dissuasive. The Member States shall take into account the interests of SMCs and EN 30 EN SMEs, including start-ups, and their economic viability when imposing penalties.’; (b) paragraph 6 is replaced by the following: ‘6. In the case of SMCs and SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.’;