EU Council adopts negotiating position on digital-rulebook simplification
On October 21, the Council of the EU agreed its negotiating position on changes intended to simplify data-protection, privacy and cybersecurity-reporting rules, and it published the mandate text on October 22.
Inside Practice · OCTOBER 22, 2026 · 1 MIN READ
On October 21, the Council of the EU agreed its negotiating position on changes intended to simplify data-protection, privacy and cybersecurity-reporting rules, and it published the mandate text on October 22. The proposal is part of the Omnibus VII package and sits alongside separate AI-related simplification measures adopted on June 29, 2026. Cross-border legal teams should version-control compliance projects against the Council position rather than treating the current proposal as final law, while identifying controls that could serve privacy, cyber and AI reporting together. The practical watchpoint is whether simplification reduces duplicate reporting without weakening jurisdiction-specific requirements, because that will determine how far multinationals can consolidate incident and data-governance workflows.