ZPP Newsletter
Warsaw, 9.12.2025
Open Letter on the Digital Omnibus Proposal
Dear Members of the Council of the European Union,
Dear Members of the European Parliament,
On behalf of the undersigned organisations, we express our strong support for the direction the European Commission has taken with its “Digital Omnibus” package proposal. However, we must unequivocally state that its current scope remains insufficient. This initiative marks a promising and much-needed first step toward meaningful deregulation in Europe, but it stops short of the bold, pragmatic, and forward-looking measures required to unlock Europe’s digital potential and secure its long-term economic prosperity.
Europe is steadily losing its global standing and must now take decisive, visionary action to reverse this trend. We cannot hope to achieve genuine “strategic autonomy” if we are incapable of developing our own foundational technologies. Nor can Europe expect to retain influence on the world stage in the 21st century without being a leading economic and technological power – an imperative more pressing than ever.
For these reasons, we urge that the European Commission’s proposal be seen not as a final goal, but as a starting point that must be strengthened and expanded. A vibrant, innovative, and data-driven economy is indispensable to the success of the European project. Economic progress is not a threat to our values – it is the very condition for preserving them.
CLARITY & SIMPLIFYING THE LAW
The growing complexity of EU regulation creates invisible barriers and mounting costs for business – particularly Europe’s SMEs and start-ups, the driving force of our economy. Instead of building new products, innovators are forced to spend resources on lawyers and consultants just to determine whether their idea is even legal. As a result, the AI Act and other recent EU proposals risk becoming a web of “spaghetti law” – decipherable only by paid experts, rather than clear, functional texts meant to guide innovation.
This excessive complexity risks turning the AI Act into an unintended barrier to entry. Companies may abandon AI development not because they cannot build safe products, but because they cannot confidently determine whether they comply with the rules. This chilling effect in practice favours only the largest, best-resourced players – undermining the very innovation Europe seeks to promote.
Call to action: To avoid this, the AI Act must be radically simplified. It should establish clear, proportionate and genuinely understandable compliance pathways for small and medium-sized enterprises, while upholding the high standards of fundamental rights protection that underpin the constitutional traditions of the Member States and of the Union as a whole.
STOP THE CLOCK
The AI Act, the world’s first comprehensive framework for regulating AI, has adopted an overly restrictive, a priori approach that treats AI primarily as a threat. Its extensive prohibitions and administratively burdensome obligations risk critically impeding innovation and placing European developers and users at a severe disadvantage in the global AI race. The urgent call to “stop the clock” is therefore imperative – specifically, the two-year postponement of the remaining provisions of the AI Act as proposed by initiatives such as the “EU AI Champions,” supported by major industry leaders including Airbus and Siemens. This pause would provide European companies with the necessary time for effective implementation while allowing for a fundamental review and simplification of the current framework, preventing Europe from falling further behind global competitors such as the United States, which are actively pursuing an AI strategy focused on “winning the race.”
Call to action: It is essential to unambiguously “stop the clock” and implement an unconditional two-year postponement of the remaining provisions of the AI Act, that haven’t yet entered into force. As a bare minimum the timeline extension should be a separate legislative proposal within the Omnibus package, enabling a swift adoption to avoid legal uncertainty for the industry.
GDPR
We commend the Commission for its political courage in presenting a meaningful improvement to the data protection regime that Europe’s digital industry so urgently needs. For years, public debate around Europe’s lag in the AI revolution has centered on the AI Act, but as the Draghi report rightly identified, our data protection framework has posed an even greater barrier to innovation. While we welcome the targeted amendments to the AI Act, the proposed clarification to the GDPR – specifically confirming that development and training of AI systems can rely on legitimate interest as a legal basis – represents perhaps the single most important step for creating truly European AI.
Call to action: Ensure that the rules governing the use of legitimate interest for AI development and training are clear, coherent and easily understandable for businesses. The framework must deliver genuine legal certainty and harmonisation across the Union, leaving no room for divergent or restrictive interpretations by supervisory authorities.
CYBERSECURITY
We welcome the Commission’s efforts to streamline cybersecurity rules through initiatives such as the Single Entry Point (SEP) for incident reporting. This is a positive first step toward reducing fragmentation. However, much more needs to be done to ensure clarity, harmonisation, and trust across the EU’s cybersecurity framework. Today, overlapping requirements under NIS2, CRA, and DORA create unnecessary complexity and compliance costs, diverting resources away from actual risk mitigation. Further simplification of AIA-CRA conformity is necessary for example. It should be possible to demonstrate conformity under both legal acts through common conformity assessment, not just certification (as currently foreseen by AI Act).
Many critical gaps remain: inconsistent reporting obligations across Europe, liability protection for reporting is missing, and conformity harmonisation is absent from the Digital Omnibus. Without addressing these issues, companies will continue to face redundant audits and fragmented national rules, undermining the goal of a unified cybersecurity framework.
Call to action:
- Ensure that the SEP allows companies to report to the relevant national authority in their country of main establishment.
- Ensure that companies operating across the EU report into the country of their main establishment.
- Introduce liability protection clauses for reporting to build trust and encourage transparency.
- Address fragmentation by including conformity harmonisation in the Digital Omnibus, eliminating overlapping audit requirements under NIS2, CRA, and DORA.
COPYRIGHT
The development of AI models needs clear and flexible copyright rules that permit the use of copyrighted works in training. The industry is relying on the Text and Data Mining (TDM) exceptions enshrined in Articles 3 and 4 of the copyright in the digital single market (CDSM) directive, which are not perfect, but are the result of a hard fought compromise. Recently however, this situation is being challenged – both politically within the European Parliament, and judicially by some member state courts. Without legal protection for acts of transient use of copyrighted works during AI model training all research in the field in Europe will stop. This would be a calamity with consequences far graver than the burdens of the AI Act and must be avoided.
Call to action: The legal basis for AI development in the EU in Articles 3 and 4 of the CDSM Directive is fundamental to innovation and must be firmly safeguarded against any attempt to narrow or undermine them. Furthermore, they must be clarified and expanded to provide a stable, pan-European legal basis for all forms of AI training across the EU.
We pledge our full support to advancing this proposal through the legislative process and expanding wherever possible. In particular, we will advocate for clear legal provisions enabling the postponement of the AI Act’s obligations and for the establishment of a robust legal basis for legitimate interest in AI training under the GDPR. We are committed to working closely with members of the European Parliament and the Council to ensure that this package is adopted swiftly and effectively, delivering on its promise and the broader objectives outlined in the above calls to action.
We stand ready to assist you in this essential mission.
Respectfully,
Tomasz Snażyk – CEO – AI Chamber
Csongor Bias – MD – Startup Hungary
Jakub Bińkowski – Board Member – The Union of Entrepreneurs and Employers (ZPP)
Simonas Černiauskas – CEO – Infobalt
Milena Jabůrková – Vice-President – Confederation of Industry of the Czech Republic
Jolanta Jaworska – President – Digital Technology Employers’ Association Lewiatan
Lukáš Kačena – Director – PRG.ai, Czech National AI platform
Michał Kanownik – CEO – Digital Poland Association
Michal Kardoš – Executive Director – Slovak Alliance for Innovation Economy (SAPIE)
Peter J. Kofler – Chairman of the Board – Danish Entrepreneurs
Egle Markeviciute – EU Affairs Manager – Consumer Choice Center Europe
Gergana Passy – President – Digital National Alliance, Bulgaria
Marek Tatała – CEO – Economic Freedom Foundation
