EU Digital Omnibus 2026: What Changed in the AI Act, GDPR and Cookie Rules
The 7 May 2026 package: Article 50 grace period cut to 3 months, wider ROPA exemption, binding one-click 'reject all'.
In short
The Digital Omnibus package, presented 7 May 2026, simplifies AI Act and privacy-framework implementation: it cuts the grace period for AI systems already on the market from six to three months (new deadline 2 December 2026) and pushes browser-level and centralised consent signals as an alternative to repeated cookie banners.
- Cookietrace Privacy Engineering Team — Published 2026-05-25 · Updated 2026-08-20 · 9 min read
What the Digital Omnibus is
The Digital Omnibus package, presented on 7 May 2026, adjusts how the AI Act and parts of the EU privacy framework are applied. It is a simplification package: fewer overlapping notifications, clearer deadlines and an explicit link between cookie consent practice and the wider digital rulebook.
The changes that affect websites
The grace period for AI systems already on the market drops from six months to three, moving the practical deadline to 2 December 2026. The package also carries the cookie pledge work forward, pushing browser-level and centralised consent signals as an accepted alternative to repeated banners.
- Grace period cut from six to three months
- Transparency duties aligned with Article 50 wording
- Cookie pledge: fewer banners, more machine-readable signals
- Stronger emphasis on documented, exportable evidence
What to do now
Inventory every AI feature on the site, note whether it existed before 2 August 2026, and attach a disclosure to each one. Keep consent and disclosure evidence in a format you can export, because the Omnibus reduces notifications but not the burden of proof.
Where Cookietrace fits
Cookietrace already stores consent and AI disclosure events in one signed, exportable log and supports centralised consent signals, so a site that follows the current setup guide needs no structural change to meet the revised deadlines.
Frequently asked questions
The Digital Omnibus package, presented 7 May 2026, simplifies AI Act and privacy-framework implementation: it cuts the grace period for AI systems already on the market from six to three months (new deadline 2 December 2026) and pushes browser-level and centralised consent signals as an alternative to repeated cookie banners.
What is the Digital Omnibus package?
It is a European Commission simplification package that adjusts how the AI Act and parts of the EU digital privacy framework apply, reducing overlapping notifications and clarifying deadlines rather than changing the underlying obligations.
Does it change my cookie compliance deadlines?
It does not remove the cookie consent requirement, but it advances the cookie pledge work, favouring machine-readable, centralised consent signals over repeated per-site banners.
How does it affect AI transparency deadlines?
It shortens the grace period for AI systems already on the market from six months to three, moving the practical compliance deadline to 2 December 2026 instead of 2 February 2027.
Sources
Official sources cited in this guide.
Who should read it
Website owners, marketing teams and developers responsible for cookie consent, analytics tagging and privacy documentation.
Cookietrace
Written and reviewed by the Cookietrace Privacy Engineering Team. (9 min — regulations)