The Digital Omnibus should be more than an administrative clean-up. It is an opportunity to create the right conditions for applied research, investment in AI and data-driven innovation across Europe, and strengthen our technological leadership. Above all, it must deliver genuine simplifi cation, not replace today’s complexity with more bureaucracy.

Two years after the Draghi report, Europe must show it is turning this goal into reality. AI is central to this, and AI is built on data. If European rules make it disproportionately difficult for European companies to use data, they cannot develop and deploy their AI models and systems. As a result, European AI won’t be competitive leaving no option but to continue relying on AI built elsewhere.

European companies want to develop responsible AI that protects privacy, cybersecurity, safety and to earn consumer trust. Lawmakers should refi ne the rules without falling for the false choice between protecting citizens and allowing industry to grow.

As Parliament prepares its position on the Digital Omnibus, we ask you to support the following nine fixes to make it work for European companies:

1. Protect trade secrets and keep data sharing workable. Data that are a trade secret, or from which a trade secret can be derived, should explicitly be exempted from mandatory data sharing, in line with the Trade Secrets Directive. Companies need a clear safeguard to prevent transfers that would put their unique and highly sensitive know-how at risk, including to competitors inside the EU.
2. Allow manufacturers’ access to non-personal data. A statutory right for the data holder to access non-personal product data, without jeopardising Data Act safeguards, would empower them to develop industrial AI and maintain, update and secure connected devices without the unnecessary burden of endless bilateral negotiations.
3. Incentivise the use of privacy-enhancing technologies (PETs). Companies using PETs protect data effectively by reducing or removing the risk of identifying individuals. GDPR obligations should be proportionate to that lower risk, giving companies a clear reason to invest and develop in PETs. To prevent privacy-washing and ensure fair competition, open standards for PETs should be developed through a multi-stakeholder approach. They avoid proprietary walled gardens and make PETs affordable for all businesses, so that privacy becomes a baseline, not a premium feature.
4. Confirm legitimate interest for AI training. Competitive European AI needs predictable rules for training models, running evaluations and correcting bias. Legitimate interest and the GDPR balancing test and safeguards (including PETs) protect citizens and give European businesses a fair chance to compete. Beyond AI training, companies also need to be able to rely on legitimate interest to prevent fraud and enhanced security.
5. Centralised consent is no solution to consent fatigue. Consent should remain meaningful without trivialising user choice. Handing Europe’s consent architecture to a few providers would cut European businesses’ direct relationship with their users. Aligning the terminal equipment rules with the GDPR would let companies rely on its full range of legal grounds and reserve consent for what users care about, such as personalised advertising across websites and sharing data with third parties. Security, fraud prevention and audience measurement should not rely on consent.
6. Support European Research. Applied scientific research in both the private and public sector should be able to rely on legitimate interest, where appropriate. Without research, there is no innovation and without innovation, there is no technological competitiveness.
7. Codify the relative approach to personal data. Data protection rules should reflect actual risk, not theoretical cases. The Commission rightly proposes to write the Court’s jurisprudence into the GDPR, confirming data is not personal for a company that cannot reasonably re-identify the person. It would give European companies immediate legal clarity and assurance that their national authorities and courts will apply the test evenly, while maintaining strong safeguards for individuals.
8. Keep human oversight obligations proportionate to risk. Human oversight in automated decision making should focus on decisions where safety, ethics and critical judgement matter, not on every routine, low-risk automated task. New procedural hurdles on applied research and development would stall promising projects and favour those who can absorb the compliance cost, rather than European SMEs.
9. Build one secure rulebook for incident reporting. A single entry point for breach and incident notifications is the right approach, with harmonised procedures, deadlines, definitions, thresholds and templates across the cyber and data rules. The single entry point must be resilient to cyber attacks and built to safeguard the information reported.

Simplification must be real. A single market should not mean 177 enforcing authorities, each interpreting the same rules diff erently. Done well, the Digital Omnibus will boost data-driven and AI innovation across Europe, cut compliance costs, while keeping privacy protection strong. Simpler rules and strong protection should reinforce each other, so that Europe becomes a place where companies choose to stay, scale and foster talent.

About EFA:

The European FinTech Association (EFA) is a not-for-profit organization representing leading FinTech companies of all sizes from across the EU. It brings together a diverse group of 40+  FinTech providers ranging from payments, to lending, banking, robo-advice, investment as well as software-as-a-service for the finance sector, with a clear focus on enabling a single market for digital financial services. For more information, visit www.eufintechs.com

Download the joint letter here.