# EU rules for small teams, in plain words. What the privacy law, the AI Act and the simplification package ask of you. > Which EU rules on privacy, AI and incident reports are law and which are still proposals, as of 28.10.2026, with dates and what a small team can do this month. Page: https://cybee.ai/blog/eu-digital-omnibus-compliance/ (EU rules for small teams: law or proposal?) - [Blog](https://cybee.ai/blog/) - EU rules for small teams client requests Your EU clients ask about rules you may never have read, and those rules are changing while you read this. One part of the change became law in July 2026. The larger part, on privacy and incident reports, is still a proposal. This guide keeps the two apart, as of 28.10.2026. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 10 minute read In one minute - Only one half of the EU’s “Digital Omnibus” is law: the changes to the AI Act, in force since 27 July 2026. The privacy, cookie and incident reporting changes are still proposals. - Today’s privacy rules apply as written. That includes the 72 hours to tell the regulator about a data leak. The proposal would make it 96 hours, and only for leaks likely to be high risk. - Rules for high risk AI uses now start on 2 December 2027. The duty to help staff understand the AI they use has applied since 2 February 2025. The AI Omnibus made it simpler from 27 July 2026. - If you sell software or connected devices, the Cyber Resilience Act has asked you to report exploited weaknesses since 11 September 2026. Most of the rest applies from 11 December 2027. - A small team usually meets these rules through a client contract or a supplier questionnaire, not through an inspector. ## What is law today, and what is still a proposal? In November 2025 the European Commission put two proposals on the table and called them, together, the Digital Omnibus. An omnibus is one bill that changes many laws at once, to tidy them up. The first proposal changed the AI Act. The second changed the rules on personal data and on how incidents are reported, and it pulled cookies into the same law. The AI proposal moved fast. It entered into force on 27 July 2026. That part is law. The data proposal is slower. By September, more than 1,750 amendments had been filed in the European Parliament’s committees. Reports say the Council of the EU, which speaks for the member states, agreed its own position on 21 October 2026. As far as the public record shows, the two sides have not started negotiating a joint text, and no vote date is known. Nothing in the data proposal is law as of 28.10.2026. > Until a proposal becomes law, the old rule is the rule. **Q:** What is the Digital Omnibus? ### What the Digital Omnibus is. A package from the Commission to simplify EU digital rules. It has two files: one for the AI Act, now adopted, and one for data and incident reporting, still under negotiation. The Commission’s aim is less paperwork for companies, especially smaller ones. A separate package from May 2025, also called an omnibus, covers record keeping duties for smaller companies. It is a different proposal with a different timetable. Do not mix the two up when a client quotes one of them. ## Four rules a small team can run into. Most small teams meet these four through a client, an insurer or a supplier. The table says what each one is, who it touches, which dates matter and what the simplification package proposes to change. The state is as of 28.10.2026. Figure: Four rules and where each one stands. Proposed changes are not law. **Q:** What is the GDPR? ### What the privacy law is. The General Data Protection Regulation, GDPR for short, is the EU’s main privacy law. It sets rules for anyone who collects or uses information about identifiable people: names, emails, photos, customer lists, even an IP address. If a data leak puts people at risk, the company in charge of the data has to tell the regulator within 72 hours. A company that only handles data for a client, such as an agency, has to tell that client. **Q:** What is a small mid cap? ### What a small mid cap is. The EU already sorts companies by size: micro under 10 staff, small under 50, medium under 250. A small mid cap sits just above medium. The new rules extend the lighter treatment that small companies get to these firms. The exact line differs by law and was still being settled. In the separate record keeping proposal the Commission suggested fewer than 750 staff, and Parliament asked for fewer than 1,000. A team of ten or thirty is a small company under every version. ## What the simplification package would change. Two lists, kept apart. The first holds what the AI part has already changed, because it is adopted. The second holds what the data part proposes, and none of it binds anyone yet. Figure: The AI changes are in force. The data changes are only proposed. The proposal also redefines “personal data”. Information that has been scrambled so a name cannot be read from it would stop counting as personal data for a recipient who cannot identify the person. The EU’s data protection regulators, in a joint opinion of 11 February 2026, support the high risk threshold and the 96 hours. They urge lawmakers strongly not to adopt the new definition. According to reports of its October position, the Council wants to keep the high risk threshold and the 96 hours, and to replace one EU wide entry point with one per country. Parliament’s committees have not yet voted. Expect the text to move again before anything is adopted. ## If you work from Switzerland. Switzerland is not in the EU, and the EU privacy law is not binding on Switzerland. Swiss law has its own rules: the revised Federal Act on Data Protection, in force since 1 September 2023 and written to line up with EU and Council of Europe standards. A Swiss agency can still feel the EU rule. An EU company that hands personal data to a service provider outside the EU has to bind that provider by contract, so the EU duties arrive in your client agreement. And a company that offers services to people in the EU falls under the EU law directly, whatever its nationality and whether or not those people pay. Which side your own work falls on depends on the facts of each client. This guide is general information, not legal advice. ## What to do this month. None of this needs a new tool. It needs an afternoon and one person who owns it. - Write down which client personal data you hold, where it sits and who can open it. A client who asks will want that list first. - Put a one page plan for a data leak on paper: who decides, who tells the client, who records what happened. Clients who must report to a regulator work against a 72 hour limit today, so they will want your news fast. - If you sell software or connected devices, ask a lawyer whether the Cyber Resilience Act makes you a maker. If it does, reporting of exploited weaknesses already applies. - List the AI tools your team uses, and write two lines of rules for staff: what may go into them and what may not. - Keep dated proof of your Mac settings, such as disk encryption, screen lock and updates. Clients and insurers often ask for it. Cybee helps with parts of the last two. It keeps a dated record of technical controls on the Macs it runs on, and it lists the AI assistants it finds on each Mac. That gives you facts for a client question. It does not make a company follow any of these laws, and none of the four is among the ten frameworks Cybee maps Mac settings to. For a worked answer to a client’s questions about your Macs, read [how to answer a client’s security questionnaire](https://cybee.ai/blog/mac-security-questionnaire/). If a client asks for an audit report, [does your agency need SOC 2?](https://cybee.ai/blog/soc-2-small-agency/) explains what that means. ## What to remember. Before you quote a rule to a client, check whether it is law or a proposal, and write the date next to it. Rules in this area are changing month by month, and a dated note shows you checked. Where the stakes are high, ask a lawyer. ## Sources. Written by Cybee for small teams, from official pages read on 28.10.2026. The state of the data proposal can change at any time, so check the Parliament page before you rely on it. - [European Commission: AI Omnibus enters into force](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force) - [European Commission: AI Act, regulatory framework](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - [AI Act Service Desk: timeline of the AI Act](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act) - [European Commission: FAQ on the Digital package](https://digital-strategy.ec.europa.eu/en/faqs/digital-package) - [European Commission: An agile digital rulebook for the EU](https://digital-strategy.ec.europa.eu/en/policies/digital-rulebook) - [European Parliament Legislative Train: the Digital Omnibus proposal](https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package) - [European Parliament: procedure file 2025/0360(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)) - [Council of the EU: position on the digital rulebook, 21 October 2026](https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/) - [EDPB and EDPS: Joint Opinion 2/2026 on the Digital Omnibus](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) - [European Parliament: simplified rules for small mid cap companies](https://www.europarl.europa.eu/news/en/press-room/20260220IPR35906/simplified-rules-for-small-mid-cap-companies) - [European Commission: SME definition](https://single-market-economy.ec.europa.eu/smes/sme-definition_en) - [European Commission: the NIS2 Directive](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) - [European Commission: the referral of four member states to the Court of Justice over NIS2](https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules) - [European Commission: the Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) - [European Commission: Cyber Resilience Act reporting](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) - [ENISA: the CRA single reporting platform is launched](https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched) - [EDPB: Guidelines 3/2018 on the territorial scope of the GDPR](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf) - [Swiss Federal Office of Justice: the revised Data Protection Act](https://www.bj.admin.ch/en/new-data-protection-legislation) ## When a client asks about your Macs. See a sample answer, the device facts behind it and the questions your team still owns. [Work through an example](https://cybee.ai/use-cases/security-questionnaires/) On this page - What is law, what is a proposal - Four rules you can run into - What the package would change - If you work from Switzerland - What to do this month - What to remember - Sources Cybee Keeps a dated record of how each Mac is protected, so a client’s device questions get dated answers. Protection is free on every Mac. [See how it works](https://cybee.ai/product/) ## The next question someone asks. Three more guides. [client requests How to answer a client’s security questionnaire. Answer from dated facts on your Macs, name what is missing and give every open question an owner. Read the guide](https://cybee.ai/blog/mac-security-questionnaire/) [client requests Does your agency need SOC 2 to win bigger clients? How to read a client’s request for an audit report, and when one fits your business. Read the guide](https://cybee.ai/blog/soc-2-small-agency/) [client requests What evidence should you prepare for cyber insurance? What an insurer asks about your Macs, and what to have ready before the renewal. Read the guide](https://cybee.ai/blog/cyber-insurance-evidence/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)