EU data laws are to become more business-friendly after 19 November, when the EU Commission unveils its "digital omnibus" to cut red tape, amid privacy and security concerns.
The omnibus will target rules on cookies and other tracking technologies, cybersecurity incident reporting, and tweaks to the EU's flagship Artificial Intelligence Act.
"We want an innovation-friendly rulebook: both in the way we apply the rules, and in simplifying the laws where our objectives can be reached at lower costs," said EU digital commissioner Henna Virkkunen in a press release on 16 September.
"We aim for less paperwork, fewer overlaps and less complex rules for companies doing business in the EU," she said.
But experts warn that merging and amending such a wide range of digital rules could reopen contentious debates on enforcement, regulatory fragmentation, AI liability, and the scope of platforms’ responsibilities and capabilities.
And amid fears that protected rights are being disregarded to increase companies' profits, they also warn against 'deregulation in the name of simplification'.
EUobserver breaks down the dynamics behind this change and the challenges ahead.
Zooming in on the likely changes, the commission is expected to put forward a long-awaited simplification of cookies and tracking consent rules, aligning privacy provisions in the ePrivacy directive with GDPR and Digital Service Act standards.
It is also expected to harmonise obligations under NIS2 and the new Cyber Resilience Act to reduce duplicate-reporting burdens on companies.
Under the AI Act, companies and SMEs are expecting clarifications on high-risk AI categories, obligations for general-purpose AI models, and consistency with data-sharing frameworks.
There are calls to ensure that the Data Act and Data Governance Act use more coherent definitions of “data holders,” “intermediaries,” and “public sector bodies.”
But big-tech lobbying is pushing politicians for simplification measures to go even further.
On 15 October, the computer and communication industry association (CCIA), who represents Apple, Amazon, Meta, and more in Brussels, launched a campaign urging the commission to “unlock innovation” and expand beyond the currently proposed changes.
"Slowly the EU's simplification efforts are moving in the right direction, but things are not going fast enough. Now is the time for real ambition and decisive action," said CCIA Europe's vice-president Daniel Friedlaender.
France and Germany are uniting their political power to push Europe towards their vision of Europe's digital future.
In the Franco-German economic agenda from September, it states: "To unleash our companies' full potential of growth and productivity, it is also urgent to substantially ease the complexity and simplify the European Union’s regulatory environment".
The joint agreement also seeks steps beyond what the EU is to proposed, such as looking even deeper into GDPR to identify additional adjustments.
Their agenda involves a Berlin Digital Sovereignty Summit on 18 November, led by the two powers, bringing together public and private stakeholders.
The meeting is seen as putting pressure on Brussels to balance innovation with strategic autonomy – as many countries call to cut red tape for startups.
Meanwhile, Berlin and Paris are also pushing for more investments and stronger control of cloud and AI infrastructure.
"Digital sovereignty doesn't mean protectionism. We want to and must be accessible for the global market," Germany's digital minister Karsten Wildberger told Reuters.
He said European companies need to "actively participate in this (sector) as players".
"There is a huge growth market for technology, innovation, software, data and artificial intelligence," Wildberger said.
And in June, French president Emmanuel Macron hosted an exclusive dinner at the Élysée Palace with a special guest: Jensen Huang, the founder and CEO of Nvidia. “
"The problem in Europe and in France is: You are too slow," in terms of tech-law upgrades, Huang joked to the dinner guests, according to AI entrepreneur Eléonore Crespo.
There is a surge of initiatives across the continent, both public and private, to build and adopt AI systems in Europe.
The commission itself is investing billions to support the expansion and capabilities of European AI systems, including the EU's AI in Science Strategy, Apply AI Strategy, InvestAI, AI Innovation Package, and AI Factories.
Looking at one of these initiatives, InvestAI, launched in February this year is aiming to invest €200bn in AI development.
"InvestAI will be the largest public-private partnership in the world for the development of trustworthy AI," said commission president Ursula von der Leyen at the artificial intelligence action summit in Paris in February.
And Europe also has homegrown private AI companies trying to compete with US and Chinese AI giants, such as OpenAI and DeepSeek.
Europe's ventures include Mistral AI, Black Forest Labs, and Aleph Alpha.
They also want simplification in order to innovate.
Mistral and Black Forest Labs, along with 56 other European companies, signed an open letter calling for simplification and a pause on implementing regulations to commission president von der Leyen.
The EU Champions AI Initiative, which authored the letter, is specifically asking for a two-year "clock-stop," on implementing already passed AI regulation requirements.
As the law stands, it "jeopardises not only the development of European champions, but also the ability of all industries to deploy AI at the scale required by global competition", they said.
Simplification isn't inherently bad, and could streamline processes that currently overlap, but experts see a thin line between simplification and deregulation.
Currently, numerous cybersecurity regulations require companies to report similar incidents to multiple authorities, with compliance costs amounting to at least €60bn annually, according to the business association Digital Europe – this is an area where simplification can help.
However, civil society and academics highlight a difference between fixing overlapping legislation and changing it entirely.
In multiple open letters, Civil groups and academics wrote to the commission, arguing against simplification and reopening digital legislation, fearing that regulatory changes would impact essential protections.
Academics from the University of Amsterdam's highlighted changes in cookie requirements as an example of questionable change, in remarks to EUobserver.
"Simplification of the e-Privacy Directive rules on cookies and 'other tracking technologies' is liable to affect rules that have been providing safeguards against arbitrary or disproportionate state or commercial surveillance," said Plixavra Vogiatzoglou, a PhD candidate, studying digital sovereignty.
And the researchers are also concerned about how quickly the changes seem to be moving.
"The way the commission is rushing towards digital simplification should be a cause for concern," said Dutch digital law professor Kristina Irion.
"The bigger fish to fry is effective implementation and scalable enforcement," she said.
Ella Jakubowska, campaigner for European Digital Rights group (EDRi), echoes these concerns.
"There's no doubt that this is really about deregulation," Jakubowska said to EUobserver.
EDRi does not want the EU to strip protections for short-term economic gain.
Jakubowska warned that "weakening of safeguards in the AI Act, for example, could expose all of us to algorithmic harms that this law was designed to stop, for example, AI-driven discrimination."
She, like the Dutch academics, believes that guidance, enforcement and support of current legislation is the best way to improve the situation.
Rewiring current regulations, "jeopardises the EU's credibility and strength in a very uncertain geopolitical landscape," said Jakubowska.
The initiative also has critics in the European Parliament, who worry about citizens' digital safety.
"With ePrivacy dismantled, Europeans are left with nothing but the Charter to defend their right to privacy, while US tech giants enjoy a carte blanche to exploit our data for profit," German social-democrat MEP Birgit Sippel told EUobserver.
The US currently dominates the AI race.
US big-tech firm OpenAI's ChatGPT now has 700 million monthly users, and a valuation of $500 bn – for comparison, European Mistral AI has a 2025 valuation of $14 bn.
The US also currently holds by far the most AI compute capacity, accounting for around 75 percent of global AI supercomputer capacity — 9 times more than China and 17 times more than Europe — according to the 2025 State of AI report by Nathan Benaich and Air Street Capital.
And the US does not intend to limit its technology to its own borders, as president Trump signed an executive order in July specifically focusing on exporting US AI abroad.
The Trump order said: "The United States must not only lead in developing general-purpose and frontier AI capabilities, but also ensure that American AI technologies, standards, and governance models are adopted worldwide".
As professor Daniel Mügge wrote: "In digital tech, US corporate and political power are increasingly indistinguishable."
And the EU's European neighbours have already felt this force too.
In September, British PM Keir Starmer hosted Nvidia CEO and other US tech leaders to announce more than £31bn ($35.5bn) in AI funding, sparking criticism that the UK was handing strategic control to the US.
Europe is already reliant on other countries' tech for services like email, but experts said that to ensure new innovative tech, like AI, is built the European way, fighting and balancing geopolitical pressure is crucial.
"European democracy and the rights and freedoms of European citizens are not for sale, at any price," wrote AlgorithmWatch responding to US pressure to deregulate in an open letter to the commission.
Every month, hundreds of thousands of people read the journalism and opinion published by EUobserver. With your support, millions of others will as well.
If you're not already, become a supporting member today.
Owen Carpenter-Zehe is a junior reporter from the US at EUobserver, covering European politics.
Owen Carpenter-Zehe is a junior reporter from the US at EUobserver, covering European politics.