Insights and Analysis

The EU Digital Omnibus Package Webinar Series: Replay now available

21 April 2026

shot of the earth from space - showing Europe

Decode the Commission's reforms today and prepare your regulatory roadmap for 2026. The European Commission's released Digital Omnibus Package marks a significant development in the EU digital regulatory landscape. With targeted amendments spanning data protection, AI governance, cybersecurity, e-privacy, and the Data Act, the Omnibus seeks to respond to the calls for meaningful reform and simplify compliance, reduce fragmentation, and modernize key definitions and obligations. Our three-part webinar series brought together leading academics, regulators, legal practitioners, and industry experts to help organisations understand the impact of these reforms and prepare for the path ahead.

Session 1

Understanding the Digital Omnibus Package

Webinar agenda – Key topics

1. Political and Regulatory Context

Why are we where we are today? What are the process, procedures, and timelines? Why this is about better regulation rather than de-regulation?

2. Omnibus Package – Key Highlights

Overview of the key amendments: what are the positives, what are the negatives, and where are the opportunities to go further and avoid leaving the job half-done?

GDPR: A more risk-based approach to the definition of personal data? Why rethinking Special Category Data under the GDPR?
ePrivacy: What changes to the Terminal Equipment (“Cookies”) rules and Article 88b, and what do they mean in practice?
AI Act: Is a pause of the overall regime necessary, and what would it mean in practice?

Speakers:

The session featured contributions from: Dr. Mark Leiser (Academic, Author, and Legal Consultant), Nathalie Laneret (VP Government Affairs and Public Policy, Criteo), Luca Bolognini (President, Italian Institute for Privacy and Data Valorisation), Carolina Brånby (Director of Digital Policy, Confederation of Swedish Enterprise), Dr. Stefan Brink (Managing Director, Institut wida/Berlin), Etienne Drouard (Partner, Hogan Lovells), Theodore Christakis (Professor of European Law and Chair of Responsible AI, University Grenoble Alpes), and Dr. Barry Scannell (Partner, William Fry LLP and Member of the Irish Government's AI Advisory Council).

Session 2

AI Act Deep Dive Session

Webinar agenda – Key topics

“Stop the Clock” for the AI Act
Why the Omnibus proposes to pause AI Act implementation across the full framework - including GPAIMs - to reduce legal uncertainty and enable a broader competitiveness review.
Bias mitigation and special category of data
Why the Omnibus extends the use of special category of data to detect and mitigate bias across all AI systems and models, not just high-risk ones.
Preserving the risk-based approach
Why asymmetric obligations based on company size (SMEs vs. SMCs) undermine the AI Act’s core risk-based logic.
Strengthening central oversight and enforcement
The role of the AI Office as a central supervisor for GPAIMs and AI used in VLOPs and VLSEs, and the benefits of more consistent enforcement.

Speakers:

The session featured contributions from: Mikołaj Barczentewicz (Associate Professor, University of Surrey), Ängla Pändel (Head of the Swedish Institute of Law and Internet), Patrick Glauner (Full Professor of Artificial Intelligence, Deggendorf Institute of Technology), and Giulia Mariuz (Partner, Hogan Lovells).

Session 3

GDPR and ePrivacy Deep Dive

Webinar agenda – Key topics

Definition of personal data and special categories of data (SCD)
The Omnibus Proposal clarifies the definition of “personal data” to align it with CJEU case law. We will discuss what this means in practice, the need for more uniform interpretation across the EU, and why the current approach to SCD remains overly broad, including the need to modify existing derogations, subject to appropriate safeguards.
Key Omnibus gaps: joint controllership and beyond
Joint controllership was designed for genuine co-determination of means & purposes, but expansive interpretations have turned it into a broad liability framework, creating uncertainty and disproportionate compliance burdens. We will also address other gaps in the Omnibus, including the much-needed clarification on the “decisions producing legal or similarly significant effects” under Article 22.
Consent fatigue and fragmented rules: GDPR vs ePrivacy (and Article 88b)
Maintaining a split between GDPR and ePrivacy (GDPR Article 88a vs ePD Article 5(3)) continues to drive legal fragmentation and consent fatigue. We will discuss the Omnibus shift of certain cookie rules into the GDPR, the resulting risk of overlapping regimes and supervisory structures, and why introducing a mandatory machine-readable consent signal layer (Article 88b) may add legal and technical complexity rather than simplify compliance.

The session featured contributions from: Mikołaj Barczentewicz (Associate Professor in Law, University of Surrey), Peter Craddock (Partner, Keller and Heckman LLP), Dr. Stefan Brink (Managing Director, Institut wida/Berlin), Dr. Mark Leiser (Academic, Author, and Legal Consultant), Prof. Dr. Boris P. Paal (M.Jur. Oxford, Professor of Law), Etienne Drouard (Partner, Hogan Lovells Paris), and Chantal Van Dam (Counsel, Hogan Lovells Amsterdam).