Simplification, yes – weaker personality protection, no: the Digital Omnibus regulates the wrong web

On 19 November 2025, the European Commission proposed its Digital Omnibus, the simplification package for the EU’s digital rulebook. It consists of two proposals: the Digital Omnibus on AI, which amends the AI Act, and a horizontal Digital Omnibus, which amends the GDPR, the ePrivacy Directive, the Data Act and the NIS2 Directive while repealing the Data Governance Act. The declared goal is to cut administrative burden by at least 25 % – and 35 % for small and medium-sized enterprises. The AI part has been in force as Regulation (EU) 2026/1744 since 27 July 2026. The GDPR and data part is still in first reading – and it is the most contested.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation, the standards institute of the Trusted WEB 4.0 concept – welcomes the declared objective of simplification. Bureaucracy reduction, consolidation of contradictory rules and relief for smaller companies are overdue. But in two central points the proposal confuses cause and effect.

1. Weakening the concept of „personal data“ is the wrong path

The proposal softens the definition of personal data, in particular for pseudonymised data, extends the use of „legitimate interest“ as a legal basis for AI training, and relaxes breach notification from 72 to 96 hours. Consent fatigue is not a protection-standard problem – it is an architecture problem. A web that relates every movement to the person inevitably produces consent banners, whether with one click or with three. Trusted WEB 4.0 demonstrates the alternative: WAN anonymity, no cookies, no privacy settings, and assignment only via trust station key sets. Those who structurally avoid personal reference do not need a de facto deregulation of the GDPR protection level. The European Data Protection Board and the European Data Protection Supervisor have strongly urged the co-legislators not to adopt the proposed GDPR changes – GISAD concurs with this position.

2. Postponing high-risk AI obligations while incidents are rising is risky

Under the adopted amendments, stand-alone high-risk AI systems are not subject to binding obligations until 2 December 2027, and systems embedded in regulated products not until 2 August 2028 – while incidents involving autonomous AI agents continue to accumulate. The Hugging Face attack of 2026 showed where this leads. AI security needs binding breakout and control mechanisms – not an extension of self-regulation. The Finder-KI-Escape switch of the European Digital System (EU-D-S) proves that breakout protection is technically feasible: step-by-step release for critical actions, signed instance numbers issued by the trust station, measurement outside the manipulable area, supplemented by an event-driven, read-only concept-fidelity audit under GISAD standards.

3. The package centralises where decentralised structures are needed

„Once only“, central data pooling, a single reporting entry point and expanded central powers of the EU AI Office all increase single points of failure. The CrowdStrike outage and the Charité incident showed what a single central failure can do to an entire economy and a hospital. Decentralised networking does not replace a single cable – but it takes the catastrophic effect out of every cable break.

The Digital Fitness Check, which the Commission is currently using to examine the cumulative impact of all EU digital rules, would be the right place to assess this alternative systematically for the first time. Re-regulating the centralised, person-related web will not deliver digital sovereignty. A trust-based, structurally anonymous and decentralised architecture can.