AI Act Changes Explained: What the EU Digital Omnibus Means for Businesses

The European Union is already revisiting the AI Act before many companies have even completed their first compliance assessments.

In this episode, Giulio Coraggio and Antonio Ravenna discuss the impact of the changes introduced by the EU Digital Omnibus package and what businesses should expect next from the evolving European AI regulatory framework.

The conversation explores:
• why the European Commission proposed changes to the AI Act
• the simplification measures affecting high-risk AI systems
• the relationship between the AI Act and machinery legislation
• the new timelines and delegated acts expected from the Commission
• whether the reforms will simplify compliance or increase uncertainty
• what companies should do now to prepare for AI governance obligations

Giulio Coraggio is a technology and data lawyer at the global law firm DLA Piper, where he focuses on artificial intelligence, privacy, cybersecurity, digital regulation, and technology transactions. He regularly advises international companies on AI governance and compliance strategies.

Antonio Ravenna is a journalist focused on artificial intelligence, innovation, and digital transformation, regularly covering the evolution of AI regulation and its impact on businesses and society.

As AI becomes embedded in everyday business operations, AI governance can no longer be postponed. The regulatory framework may evolve, but the need for responsible AI management remains critical.

Subscribe for more insights on artificial intelligence regulation, privacy, cybersecurity, technology law, and digital innovation.

📌 You can find our contacts 👉 www.dlapiper.com

Transcript

SPEAKER_00 0:00

I'm Giulio Coraggio. And I'm Antonio Ravenna. And today we're gonna talk about the changes introduced by the Digital Omnibus to the AI Act.

SPEAKER_01 0:08

And we're gonna make it during the time of a coffee break. So, Julio, what happened during the negotiation for the digital omnibus?

SPEAKER_00 0:19

Well, the negotiations on the digital omnibus have been ongoing for more than a year now.

SPEAKER_01 0:26

It's a very long time.

SPEAKER_00 0:27

It's really a long time. Uh bear in mind that the next deadline for the UAI Act is the 2nd of August of this year. So basically, companies were really in a stressful situation because they had an approaching deadline that the ongoing negotiations they didn't know whether the deadline was gonna be postponed and uh they were in a sort of limbo.

SPEAKER_01 0:53

So there was a lot of uncertainty.

SPEAKER_00 0:55

Absolutely, and uh well, I would say the uncertainty is still there because um we know that an agreement was reached. Uh apparently the meeting uh ended uh at four in the morning. And uh that reminds us the negotiations uh uh on the UAI Act. Uh all of us were on uh X Twitter, uh how it's called now, uh following uh the trilogue, the discussions, the discuss negotiations between the Parliament, Commission, and the Council on the text of the UAI Act. And it's so surprising that um after uh uh after a year they need to revise the text.

SPEAKER_01 1:38

So let's get practical. What companies should be doing in the next, I don't know, like three months.

SPEAKER_00 1:44

Well, uh they should be doing what uh they have been doing now because uh uh the uh agreement uh that was reached on the digital omnibus um uh is true that uh introduced um uh uh among others an extension of uh the most approaching deadlines. At the same time, companies are already adopting AI solutions. Um the idea behind the digital omnibus changes was to avoid duplications. Uh this was driven mainly by Germany because uh, in relation to machinery, for instance, there was um a risk that um on top of the already burdensome obligations in provided by uh uh machine-specific regulations, then there was an additional layer uh of obligation when AI was embedded uh into machines. And we know that uh the um for instance the the um IoT industry within Germany is so strong and that is normally powered up by AI, so basically compliance was gonna become uh an additional cost uh that um is more manageable by very large corporations, and uh so basically what had to become a competitive advantage for Europe, so regulating, I said, um, a common play field for everyone was gonna turn into a disadvantage because uh we know that the uh giant um US corporations have more financial capabilities, so they can afford uh on the one hand uh larger fines, on the other hand, um additional compliance obligations, while the smaller uh European companies uh don't have uh normally, well obviously with some exceptions, uh the economy of scale uh that allows to absorb the additional compliance burden. And uh so basically uh this was turning into a disadvantage for uh European companies.

SPEAKER_01 4:01

So a lot of certification we can say.

SPEAKER_00 4:03

Yeah, I mean uh uh someone would say it's a useless stratification, uh, because um the type of certifications that are already provided uh by uh sector-specific uh legislation, like let's think about uh the life sciences sector. Uh it's really high heavily regulated, and introducing an additional obligation of certification for uh high-risk uh AI systems would was gonna uh first of all delay the entrance into the market, uh, secondly increase the costs, and uh in a nutshell was uh uh turning into um less effective services for the European um uh economy and at the same time uh uh more reduced resources also to become more competitive uh uh globally. What I can see is uh the agreement on the digital uh omnibus is the first time, as far as I remember, that uh Europe understood that they need to have an approach that is sort of uh uh market driven. They need to understand that uh regulations cannot work in in uh silence. So I regulate this piece of a machine, I regulate this other piece, and uh and uh they it's on companies to put all the pieces together. Uh while um the Europe now understood that they need to put themselves into the shoes of um uh European companies uh that uh have uh when they put all the pieces together need to then uh offer their services on the market, and uh they need to have a more um uh kind of um um uh market-driven approach. They need to understand when these layers of um legislation become too burdensome, they are turning into a disadvantage. While uh I'm not saying that uh the US approach of total deregulation is should be the rule, but um a right balance should uh understand when regulating is necessary and when it is um excessive. So it's the first time that uh there is a this sort of acknowledgement by uh Europe. There could be definitely a turning point. I mean, we we see the same with the GDPR that is so much principle-based. Sometimes um I always say uh that um uh privacy rights are used by individuals in an abusive manner at the moment, uh, to to damage, for instance, their employers, to get some money from their suppliers. Uh while um it's true that um um there should be an ethical approach uh to business, but um uh then uh basically if uh the economy is not growing, everyone is paying more and everyone is having a worse living.

SPEAKER_01 7:31

So what's really changed with these digital omnibus in the AI sphere?

SPEAKER_00 7:36

Well, first of all, uh the we were saying before, uh duplications are reduced. So when in when there is uh um sector-specific legislation, uh then uh the the additional layer of obligations under uh the UAI Act uh are is complete is uh not removed totally but is considerably reduced. Uh secondly, the deadlines of August of this year uh are postponed to 2027, the end of 2027, and for um AI solutions that uh have um sector-specific legislation to uh 2028. I mean this all shows that um the uh legislator understood that the economy wasn't uh wasn't ready uh to afford this legislation. Uh let's bear in mind that the UAI Act is the first uh legislation that came into place before before the hype of that of the technology because we're still at um the infancy of the this uh uh legislation. Uh so let's see, because uh uh my big question, and uh it's uh oh maybe a question also for the audience um having a legislation that applies to a technology that is so evolving uh in a very quickly manner and uh will come into place in two to three years. Uh, are we really sure that this legislation can properly fit uh with a technology that in two to three years might be considerably different? Uh, just a last message, if I can, um Antonio. Uh the worst strategy for a business would be to say, okay, now I have more time. I I can uh I can pose. I mean uh uh let's bear in mind that uh companies' operations uh have considerably changed over the last 12 months because AI is now embedded in their operations and it will be more and more. If you think that you have more time and you can adopt solutions without doing a compliance assessment that should have a sort of a long-term view, um then you risk uh that um uh once this technology is an essential component of your operations, you realize that uh these solutions are not compliant, and uh just uh removing that piece of technology from your operations or making that compliant would be so expensive. So it's not that the message from uh the you is not that you have more time, uh you you can take a break. Uh you have more time to become compliant because they realize it takes longer.

SPEAKER_01 10:37

So, in a nutshell, it is uh really, really big news for everyone.

SPEAKER_00 10:42

Well, it's it's it's it's a it's a big news. I I remember what happened with the GDPR that we we we knew it was coming, but then we still remember the long nights of uh May 2018. Uh this is this cannot happen now because um, first of all, some provisions of the UAI Act are already in place. Uh, and secondly, uh the changing the direction, changing the technology at a later stage uh might be in some cases not affordable.

SPEAKER_01 11:16

So thank you, Julio. This is fantastic news for every company, and it is very, very clear that they should not just rest on this news but continue to acting through the implementation of the AI Act.

SPEAKER_00 11:28

You know, sometimes clients say that I'm hyperactive, well also my kids uh say that. Uh yeah, I mean uh we're here to help them and uh thank you Antonio for the career.