Digital Omnibus: less burden, more growth

Allied for Startups calls for simpler EU digital rules to help startups and scaleups grow efficiently

Between September and October 2025, the Commission launched a Call for Evidence, to gather input on how to simplify EU legislation on data, cybersecurity, and artificial intelligence within the framework of the Digital Omnibus. The Digital Package will outline the Commission’s simplification agenda for the coming years. Based on feedback from three public consultations, it will include a Digital Omnibus containing an initial set of measures aimed at quickly reducing the regulatory burden on businesses. These measures focus on data legislation, including rules on cookies and other tracking technologies; cybersecurity incident reporting; and targeted adjustments to the Artificial Intelligence Act to ensure the optimal implementation of the rules. Below, we publish the position of Allied for Startups, a global and European network of organizations representing startups, founders, and scaleups, comprising 50+ organizations in 35+ countries worldwide.

A call for a more startup-friendly digital framework

Allied For Startups (AFS) welcomes the opportunity to contribute to the development of the Digital Omnibus. We support the Commission’s ambition to streamline and strengthen the EU’s digital regulatory framework in order to foster innovation, enhance consumer protection, and create a well-functioning Digital Single Market. At the same time, implementation must remain practical, proportionate, and supportive of the unique realities faced by startups and scaleups.

For startups, simplification is not a question of convenience, it is essential to their ability to grow and compete. Complex, fragmented, and overlapping regulatory frameworks create uncertainty and impose high administrative costs that smaller companies are least equipped to bear. In the case of emerging technologies like artificial intelligence, regulatory complexity can delay adoption and innovation, limiting Europe’s ability to build globally competitive companies. While startups in other regions benefit from more predictable and agile regulatory environments, European founders often face a patchwork of obligations and unclear guidance, slowing down product development and discouraging cross-border expansion.

Simplifying the EU’s digital framework is therefore a prerequisite for ensuring competitiveness, innovation, and a thriving Digital Single Market. Startups should be able to navigate EU rules without needing extensive legal or compliance teams. Reducing unnecessary complexity would allow them to focus their time and resources on creating new technologies, serving customers, and scaling internationally.

Regulatory coherence and better regulation 

AFS urges the Commission to pause the introduction of new digital legislation until the implementation and harmonisation of existing laws are complete. Entrepreneurs are currently adapting to several major frameworks, including the AI Act, the Data Act, the DSA and DMA, and NIS2. Adding new rules before these have been fully implemented and tested risks amplifying uncertainty, particularly for smaller players.

Better regulation should include a systematic evaluation of how new EU legislation affects innovation. If the regulatory environment creates obstacles for startups or fails to provide conditions that attract key players, innovation may stall, initiatives may fail, or companies may relocate to regions with more supportive frameworks. Such innovation-related risks should be explicitly considered by the Regulatory Scrutiny Board when reviewing new proposals. Embedding this kind of innovation “stress test” within the EU’s policymaking process would help ensure that new legislation is coherent, proportionate, and future-proof. It would also provide an opportunity to identify potential overlaps or inconsistencies early on, making the overall regulatory environment more predictable and innovation-friendly for startups and scaleups operating across the Digital Single Market.

Cookies and ePrivacy

Allied for Startups welcome the Commission’s initiative to address the issue of cookie fatigue and improve consumer protection. Today, “accept all” banners often require users to consent to thousands of cookies at once, which does not allow for a meaningful or informed choice.

While improving transparency for consumers is essential, browsers and devices should not become de facto gatekeepers by rejecting or blocking third-party cookies automatically. Many startups rely on advertising revenue to reach users and sustain their operations, and overly restrictive measures could undermine their business models and access to markets. The focus should be on presenting consent options in a simpler and more transparent way, without transferring control to intermediaries. Aligning the ePrivacy framework more closely with the GDPR, particularly by allowing the use of legitimate interest as a legal basis, would create much-needed legal clarity and reduce compliance costs for startups operating across borders.

Implementation of the AI Act

AFS supports the EU’s ambition to foster a trustworthy, innovative, and globally competitive AI ecosystem. However, this objective depends on a smooth, harmonised, and realistic implementation of the AI Act. At present, harmonised standards are not yet finalised, while the obligations for high-risk AI systems are set to apply from August 2026. This timeline leaves little room for companies to prepare, especially for startups that lack dedicated compliance departments. Without clear and consistent guidance, startups risk facing fragmented interpretations and uncertain compliance pathways even when acting in good faith. 

The implementation process should therefore prioritise coherence and clarity. The AI Act must be interpreted consistently with existing frameworks such as the GDPR to avoid duplication or contradictions. The Commission should also work closely with Member States and standardisation bodies to ensure uniform interpretation across jurisdictions. Finally, the availability of clear, accessible, and practical compliance tools, tailored to the realities of startups, would help ensure that innovation continues to flourish within the EU’s trustworthy AI framework.

Data access and sharing

The Free Flow of Non-Personal Data Regulation has provided a strong foundation for a single market for data, but its potential remains underused. Stronger enforcement is needed to ensure that data can move freely across borders and sectors, as intended. The Open Data Directive represents another major opportunity for startups. Improved access to public sector data, such as in the fields of finance, insurance, or mobility, could unlock significant innovation potential. 

Startups are well placed to turn raw datasets into value-added products and services that benefit consumers and the wider economy.

However, such access must be accompanied by clear, consistent, and secure frameworks to maintain public trust and protect sensitive information. Similarly, the Data Governance Act could be strengthened by opening up more government and publicly funded data to startups. Better interoperability between systems and the adoption of common data standards would help ensure that data sharing translates into real innovation and cross-border growth.

The Data Act and its contractual risks for the SaaS ecosystem

The Data Act is another important piece of legislation that should be considered within the Digital Omnibus. While its objectives, such as improving access to and portability of cloud data, are welcome and can help reduce vendor lock-in, certain contractual rules risk undermining business models, particularly for SaaS companies. Many SaaS providers rely on multi-year contracts to finance growth, often only reaching profitability after one or two years. Granting mandatory short-term termination rights, regardless of contract length, could make revenues unpredictable and threaten the sustainability of these businesses.

To support innovation rather than hinder it, the Data Act should clearly distinguish between cloud data portability, which opens markets, and rules that could disrupt SaaS and AI business models. Without this clarity, the regulation risks damaging the very ecosystem it seeks to strengthen.

We welcome the Commission’s recognition of the need to simplify cybersecurity obligations, particularly incident reporting requirements. Startups should be able to implement strong cybersecurity practices without being overburdened by administrative formalities.

A supportive regulatory environment 

Europe’s ability to compete globally in the digital economy depends on its capacity to create a regulatory environment that rewards innovation and empowers entrepreneurs. For startups, simplification is about making rules clearer, more consistent, and more proportionate. By ensuring that existing frameworks are fully implemented before new ones are introduced, and by requiring a systematic evaluation of the innovation impact of new proposals, the Commission can make the Digital Single Market more predictable and startup-friendly. A streamlined, coherent, and future-proof digital framework will help Europe’s startups scale faster, compete globally, and deliver the next generation of digital solutions for citizens and businesses alike.

Relevance for industry players
Allied for Startups ensures that regulations affecting digital markets, AI, data, and cybersecurity consider the needs of startups and scaleups. By advocating for simpler, harmonized, and proportionate rules, it helps reduce compliance burdens, fosters innovation, and enables European companies to scale globally while remaining competitive.