EU to revise GDPR, AI Act as part of regulatory simplification push – News

The European Union has proposed a set of regulatory changes designed to make it easier for companies to comply with the bloc’s AI Act and GDPR privacy law.

The European Commission, the EU’s executive arm, announced the initiative today. The legislative updates are expected to save up to €5 billion in administrative costs for businesses by 2029. The move follows calls by U.S. tech giants to simplify the EU’s data regulations.

“Our companies, especially our start-ups and small businesses, are often held back by layers of rigid rules,” said European Commission Executive Vice President Henna Virkkunen. “By cutting red tape, simplifying EU laws, opening access to data and introducing a common European Business Wallet we are giving space for innovation to happen and to be marketed in Europe.”

The first batch of proposals focuses on the AI Act, a law the EU implemented last year to regulate artificial intelligence systems. Some of the rules set forth in the legislation apply only to AI systems that regulators deem to be high-risk. Under the proposed changes, the EU would delay the implementation of those rules from August 2026 to December 2027.

The AI Act includes certain regulatory exceptions for small and medium-sized businesses, as well as small-cap publicly traded companies. The EU is proposing to expand those exceptions. The change would encompass, among others, clauses that reduce the amount of technical documentation eligible companies must create about AI systems. The European Commission estimates that the regulatory update could save at least €225 million annually.

Officials are also pushing for certain other modifications to the AI Act. Notably, the EU hopes to expand companies’ access to regulatory sandboxes. Those are virtual environments in which a tech firm can test a new AI system before broadly releasing it.

The second set of changes the EU proposed today focuses on GDPR, the bloc’s privacy law. Officials are proposing updates that would reduce the frequency at which cookie consent banners show up on websites. 

Under the revised version of GDPR, consumers would gain the ability to accept cookies with one click. Furthermore, the changes would make it possible to centrally save cookie preferences in a browser or an operating system. That arrangement would reduce the need to individually configure privacy settings for each website.

The EU is also seeking to modify a piece of legislation called the Data Act. The law, which went into effect last year, requires cloud providers to provide a simple way for consumers to move their account data to competing services. The Data Act also sets forth certain other requirements, including that industrial equipment manufacturers enable customers to access data generated by their hardware.

According to the European Commission, the proposed changes would expand AI developers’ access to training datasets. Additionally, officials plan to release resources that will make it easier to comply with the AI Data Act. Those resources will include standardized contractual terms meant to make it easier for cloud providers to draft customer agreements.

The changes are part of a regulatory package that also calls for the creation of a European Business Wallet. It’s a set of resources intended to ease tasks such as launching business expansion initiatives that span multiple EU member states. According to the European Commission, the initiative could save billions of dollars per year for companies in the bloc. 

Image: Unsplash