EU Digital Omnibus: what the simplification package changes in the AI Act, who gains relief as a small mid-cap and why waiting is still risky

The short answer first: the Digital Omnibus would change two things that matter for mid-market companies. The AI Act’s high-risk obligations would no longer start on fixed calendar dates but once the Commission confirms that harmonised standards and support tools exist, within a frame of at most 16 months. And the reliefs that today only SMEs enjoy would be extended to companies with up to 750 employees. Everything already in force stays untouched: the bans on unacceptable AI practices and the duties for general-purpose models apply regardless of what happens to the proposal.

This piece is written for the managing director who read about Brussels easing AI rules and now wonders whether the compliance project can be shelved. The honest answer is no, and the details explain why.

What the proposal actually does

On 19 November 2025 the Commission tabled COM(2025) 836 final, a regulation amending the AI Act to simplify its implementation. The official reasoning is practical: harmonised standards, guidance and compliance tools were arriving slower than the fixed application dates of 2 August 2026 and 2 August 2027, so companies would face obligations without the instruments to meet them. The proposal therefore couples the start of the high-risk rules to the availability of those instruments and caps the transition at 16 months.

The new size class that decides who wins

The more structural change sits in the size categories. Commission Recommendation (EU) 2025/1099 of 21 May 2025 created a new tier: small mid-cap enterprises are companies that have outgrown the SME definition, employ fewer than 750 people and stay below 150 million euros in annual turnover or 129 million euros in balance sheet total. The Commission counts roughly 38,000 of them in the EU. Until now the moment a company passed 250 employees it fell off a cliff into the full large-enterprise regime. The omnibus uses the new category to carry SME privileges upward: simplified technical documentation, a quality management system proportionate to size under Article 17, softer penalty assessment under Article 99 and priority guidance from national authorities.

For the German Mittelstand this is the concrete question worth checking: companies between 250 and 749 employees sit exactly in this band. They would gain the lighter compliance path precisely where the classic Mittelstand grows out of the small-enterprise bracket, which is where most of our readers’ organisations live.

The wider package beyond the AI Act

The AI omnibus is one part of a broader digital package the Commission presented the same day, summarised in its official press release. For operations the most relevant piece is a single entry point for cybersecurity incident reporting: today the same incident can trigger duties under NIS2, the Cyber Resilience Act and GDPR at once, a burden we documented in our pieces on the NIS2 reporting deadlines and the CRA duty that is live since September 2026. The package also touches GDPR in targeted ways, modernises cookie rules toward browser-level consent, proposes European Business Wallets and a Data Union strategy. The Commission estimates the simplifications could save five billion euros in administrative costs by 2029.

The honest risk calculation

Three qualifications keep this sober. First, the omnibus is a proposal: Parliament and Council hold it since November 2025 and can amend or reject it; if it fails, the August dates stand. Second, relief is not exemption: SMCs keep the same obligations, they just fulfil them with less paperwork. Third, the parts already in force were never touched, so a company that paused its AI inventory work on headline news has gained nothing. The practical stance is the same one we take in the AI Act deployer obligations guide: map which systems qualify, prepare the documentation path, and treat any delay as borrowed time rather than abolished duty.

Whoever takes one sentence from this piece: the Digital Omnibus would stretch the clock and lower the paperwork burden for most Mittelstand companies, but it changes the calendar, not the destination.

Frequently asked questions about the Digital Omnibus