The Digital Omnibus: How Brussels May Soften the Data Act, and What Stays

If you follow EU tech regulation even loosely, you have seen the phrase "Digital Omnibus" this year. It is the Commission's simplification package for the EU's digital rulebook, and one of its targets is the Data Act. Some of the proposed changes are significant. But there is a difference between a proposal and the law, and right now every obligation you have read about on this site still stands. Here is what is actually on the table.

What the Omnibus proposes for the Data Act

Based on the Commission's proposal and the Council's compromise position from mid-2026, the main Data Act changes under discussion are these.

Legacy cloud contracts would get breathing room. Contracts concluded before 12 September 2025 could benefit from narrow transitional exemptions from the switching framework, rather than being pulled into it wholesale.

Early termination penalties would be partially rehabilitated. The current rules push switching costs toward zero; the proposal would permit proportionate early termination penalties in fixed-term cloud contracts, a meaningful concession to how enterprise cloud deals are actually priced.

Small providers would get relief. SMEs and so-called small mid-cap providers would be exempted from some switching obligations for legacy contracts, narrowing who has to rebuild old paper.

Trade secret refusals would get easier. The proposal strengthens data holders' ability to refuse access on trade secret grounds: the "exceptional circumstances" requirement would be dropped, the threshold for expected harm lowered, and new protections added against disclosure to entities in third countries without equivalent safeguards.

Government access would narrow. Chapter V's "exceptional need" regime would be tied almost exclusively to genuine emergencies such as public health crises, natural disasters and cybersecurity incidents.

What the Omnibus does not touch

Two things matter for anyone planning compliance. First, the access-by-design obligation that took effect on 12 September 2026 is in force and is not proposed for repeal. Products placed on the EU market must ship with built-in user data access today, whatever happens in Brussels next year.

Second, the withdrawal of cloud switching charges on 12 January 2027 stands. We have seen no adopted text moving that date. The proposed early-termination-penalty carve-out would, if adopted, soften the edges for fixed-term contracts, but the default rule that a customer cannot be charged for taking their data and leaving remains on schedule.

Where the process actually is

The Omnibus is still in the legislative machine: the Commission proposed, the Council has a compromise position, and negotiations with the European Parliament are ongoing. Texts change in trilogue, sometimes substantially, and adopted versions typically come with their own transition periods. Planning your 2026-2027 compliance around a proposal is a gamble; regulators enforce the law as it stands, and Germany's Bundesnetzagentur has been live since May 2026.

The practical read for founders

Treat the Omnibus as potential future relief, not present permission. If your contracts predate September 2025, watch the legacy-contract exemption closely, it may save you a renegotiation. If you are an SME cloud provider, the proposed relief is worth tracking before you invest in switching tooling for old contracts. Everyone else should assume the current rulebook: access-by-design now, zero switching charges from 12 January 2027, fair contract terms throughout.

And whichever way the Omnibus lands, the commercial pressure does not wait for Brussels: enterprise buyers are already writing Data Act compliance into procurement checklists, and "we are waiting for the Omnibus" is not an answer that closes deals.

Want to know which of the current obligations actually apply to your product? Our free 3-minute readiness assessment maps your answers to the exact articles and gives you an instant score and gap list, no signup, at https://www.dataactready.org.