EU rules for small teams: law or proposal?

In one minute

Only one half of the EU’s “Digital Omnibus” is law: the changes to the AI Act, in force since 27 July 2026. The privacy, cookie and incident reporting changes are still proposals.
Today’s privacy rules apply as written. That includes the 72 hours to tell the regulator about a data leak. The proposal would make it 96 hours, and only for leaks likely to be high risk.
Rules for high risk AI uses now start on 2 December 2027. The duty to help staff understand the AI they use has applied since 2 February 2025. The AI Omnibus made it simpler from 27 July 2026.
If you sell software or connected devices, the Cyber Resilience Act has asked you to report exploited weaknesses since 11 September 2026. Most of the rest applies from 11 December 2027.
A small team usually meets these rules through a client contract or a supplier questionnaire, not through an inspector.

On this page

What is law today, and what is still a proposal?

In November 2025 the European Commission put two proposals on the table and called them, together, the Digital Omnibus. An omnibus is one bill that changes many laws at once, to tidy them up. The first proposal changed the AI Act. The second changed the rules on personal data and on how incidents are reported, and it pulled cookies into the same law.

The AI proposal moved fast. It entered into force on 27 July 2026. That part is law.

The data proposal is slower. By September, more than 1,750 amendments had been filed in the European Parliament’s committees. Reports say the Council of the EU, which speaks for the member states, agreed its own position on 21 October 2026. As far as the public record shows, the two sides have not started negotiating a joint text, and no vote date is known. Nothing in the data proposal is law as of 28.10.2026.

Until a proposal becomes law, the old rule is the rule.

What is the Digital Omnibus?

What the Digital Omnibus is.

A package from the Commission to simplify EU digital rules. It has two files: one for the AI Act, now adopted, and one for data and incident reporting, still under negotiation. The Commission’s aim is less paperwork for companies, especially smaller ones.

A separate package from May 2025, also called an omnibus, covers record keeping duties for smaller companies. It is a different proposal with a different timetable. Do not mix the two up when a client quotes one of them.

Four rules a small team can run into.

Most small teams meet these four through a client, an insurer or a supplier. The table says what each one is, who it touches, which dates matter and what the simplification package proposes to change. The state is as of 28.10.2026.

four EU ruleslaw and proposals

Rule	Who it touches	Dates that matter	What the package proposes
Privacy lawthe General Data Protection Regulation, GDPR	Any organisation that handles personal data of people in the EU, or offers them services.	Applies today. A leak that puts people at risk must be reported to the regulator within 72 hours.	Report only leaks likely to be high risk, within 96 hours. Every leak is still written down. Not law yet.
AI Actthe EU’s law on artificial intelligence	Companies that make AI systems or use them at work, including a team that uses an AI tool every day.	Bans and the staff AI literacy duty since 2 February 2025. Most other rules from 2 August 2026. High risk uses from 2 December 2027, AI inside regulated products from 2 August 2028.	Already law since 27 July 2026: the later high risk dates, lighter rules for small mid caps and a simpler staff AI duty.
NIS2the EU’s second network and information security directive	Medium and large organisations in 18 critical sectors, such as energy, transport and health. Smaller ones are generally outside, though a member state may add some. Covered organisations must manage risks from their suppliers.	National laws were due by 17 October 2024. On 8 July 2026 the Commission sent four member states to the EU Court of Justice for being late.	One reporting point for incidents, shared with the other laws. Separate changes to NIS2 itself were proposed on 20 January 2026. Both are proposals.
Cyber Resilience Actthe EU’s law on the security of software and connected devices	Makers of software and connected devices sold in the EU. Whether client work for an agency counts is a question for a lawyer.	In force since 10 December 2024. Reporting of exploited weaknesses and severe incidents since 11 September 2026, starting with an early warning within 24 hours. Full application from 11 December 2027.	Not changed by the AI part. The data proposal would build its one reporting point on the platform that already runs for this law.

Four rules and where each one stands. Proposed changes are not law.

What is the GDPR?

What the privacy law is.

The General Data Protection Regulation, GDPR for short, is the EU’s main privacy law. It sets rules for anyone who collects or uses information about identifiable people: names, emails, photos, customer lists, even an IP address.

If a data leak puts people at risk, the company in charge of the data has to tell the regulator within 72 hours. A company that only handles data for a client, such as an agency, has to tell that client.

What is a small mid cap?

What a small mid cap is.

The EU already sorts companies by size: micro under 10 staff, small under 50, medium under 250. A small mid cap sits just above medium. The new rules extend the lighter treatment that small companies get to these firms.

The exact line differs by law and was still being settled. In the separate record keeping proposal the Commission suggested fewer than 750 staff, and Parliament asked for fewer than 1,000. A team of ten or thirty is a small company under every version.

What the simplification package would change.

Two lists, kept apart. The first holds what the AI part has already changed, because it is adopted. The second holds what the data part proposes, and none of it binds anyone yet.

the simplification packagelaw and proposals

Law, in force since 27 July 2026

Rules for high risk AI uses start on 2 December 2027. Rules for AI built into regulated products start on 2 August 2028.
The lighter rules that small companies get now reach small mid caps too.
The duty to help staff understand the AI they use is simpler, and the Commission and member states take a stronger role in it.

Still a proposal, not law

One place to report an incident, instead of one per law. The Commission expects it to cut the reporting effort by about half for most organisations. Reports of the Council position say it wants one entry point in each member state, plus an EU level information point.
Tell the privacy regulator only about leaks likely to be high risk, within 96 hours instead of 72. Every leak is still written down.
Cookies: a way to refuse them all in a single step, browser choices respected for at least six months and an exemption for low risk uses such as counting visits.
A company may train AI on personal data under “legitimate interest”, and the person keeps an unconditional right to object.
Three data laws are folded into the Data Act, so there is one rulebook for non personal data instead of three.

The AI changes are in force. The data changes are only proposed.

The proposal also redefines “personal data”. Information that has been scrambled so a name cannot be read from it would stop counting as personal data for a recipient who cannot identify the person. The EU’s data protection regulators, in a joint opinion of 11 February 2026, support the high risk threshold and the 96 hours. They urge lawmakers strongly not to adopt the new definition.

According to reports of its October position, the Council wants to keep the high risk threshold and the 96 hours, and to replace one EU wide entry point with one per country. Parliament’s committees have not yet voted. Expect the text to move again before anything is adopted.

If you work from Switzerland.

Switzerland is not in the EU, and the EU privacy law is not binding on Switzerland. Swiss law has its own rules: the revised Federal Act on Data Protection, in force since 1 September 2023 and written to line up with EU and Council of Europe standards.

A Swiss agency can still feel the EU rule. An EU company that hands personal data to a service provider outside the EU has to bind that provider by contract, so the EU duties arrive in your client agreement. And a company that offers services to people in the EU falls under the EU law directly, whatever its nationality and whether or not those people pay.

Which side your own work falls on depends on the facts of each client. This guide is general information, not legal advice.

What to do this month.

None of this needs a new tool. It needs an afternoon and one person who owns it.

Write down which client personal data you hold, where it sits and who can open it. A client who asks will want that list first.
Put a one page plan for a data leak on paper: who decides, who tells the client, who records what happened. Clients who must report to a regulator work against a 72 hour limit today, so they will want your news fast.
If you sell software or connected devices, ask a lawyer whether the Cyber Resilience Act makes you a maker. If it does, reporting of exploited weaknesses already applies.
List the AI tools your team uses, and write two lines of rules for staff: what may go into them and what may not.
Keep dated proof of your Mac settings, such as disk encryption, screen lock and updates. Clients and insurers often ask for it.

Cybee helps with parts of the last two. It keeps a dated record of technical controls on the Macs it runs on, and it lists the AI assistants it finds on each Mac. That gives you facts for a client question. It does not make a company follow any of these laws, and none of the four is among the ten frameworks Cybee maps Mac settings to.

For a worked answer to a client’s questions about your Macs, read how to answer a client’s security questionnaire. If a client asks for an audit report, does your agency need SOC 2? explains what that means.

What to remember.

Before you quote a rule to a client, check whether it is law or a proposal, and write the date next to it. Rules in this area are changing month by month, and a dated note shows you checked. Where the stakes are high, ask a lawyer.

Sources.

Written by Cybee for small teams, from official pages read on 28.10.2026. The state of the data proposal can change at any time, so check the Parliament page before you rely on it.