EU Digital Omnibus 2026: What Changed in the AI Act, GDPR and Cookie Rules
Legal status of COM(2025) 836, the provisional 7 May 2026 agreement and the non-binding Cookie Pledge.
What the Digital Omnibus is
The Digital Omnibus package, presented on 7 May 2026, adjusts how the AI Act and parts of the EU privacy framework are applied. It is a simplification package: fewer overlapping notifications, clearer deadlines and an explicit link between cookie consent practice and the wider digital rulebook.
The changes that affect websites
COM(2025) 836 and the provisional political agreement remain part of a legislative process; they should not be presented as binding changes before formal adoption and publication. The Cookie Pledge is guidance, not by itself a binding GDPR or ePrivacy amendment.
- Grace period cut from six to three months
- Transparency duties aligned with Article 50 wording
- Cookie pledge: fewer banners, more machine-readable signals
- Stronger emphasis on documented, exportable evidence
What to do now
Inventory every AI feature on the site, note whether it existed before 2 August 2026, and attach a disclosure to each one. Keep consent and disclosure evidence in a format you can export, because the Omnibus reduces notifications but not the burden of proof.
Where CookieTrace fits
CookieTrace already stores consent and AI disclosure events in one signed, exportable log and supports centralised consent signals, so a site that follows the current setup guide needs no structural change to meet the revised deadlines.