By Marcus Venn | Digital Rule Book | March 2026 TL;DR — Key Points The EU Digital Omnibus Package, proposed 19 November 2025, is the most significant change to EU digital regulation since the AI Act itself. It proposes to simplify GDPR, delay the AI Act's high-risk deadlines by up to 16 months, merge cybersecurity reporting into a single entry point, and modernise cookie rules. For most EU businesses, the Omnibus will reduce compliance burden — but it has not been passed into law yet, and current deadlines still apply. The Digital Omnibus is not a weakening of the AI Act. It is a restructuring of the rollout to align with the actual readiness of the compliance ecosystem. This article explains every major proposal in plain English, so you know what is changing, when, and what it means for your business. DISCLAIMER: This article is for informational purposes only. The Digital Omnibus Package is a legislative proposal subject to amendment and rejection. Information ...
Will the Iran Crisis Speed Up or Freeze EU Digital Regulation?
By Marcus Venn | Digital Rule Book | March 5, 2026
When a crisis hits — a war, a pandemic, a financial collapse — the natural question for anyone working in regulated industries is: what does this mean for the rules? Will regulators ease requirements while businesses cope with immediate challenges? Or will the crisis demonstrate exactly why the regulations were needed, accelerating their implementation?
For EU digital regulation in 2026, the Iran conflict presents a fascinating and consequential test case. The EU has built the most comprehensive digital regulatory framework in the world over the past five years — GDPR, the AI Act, the Digital Services Act, the Digital Markets Act, NIS2, the Cyber Resilience Act. The question this week is: does a major Middle East war slow that framework down, or does it prove why every piece of it was necessary?
The answer, based on historical patterns and the specific nature of this crisis, is clear: the Iran conflict will accelerate EU digital regulation, not delay it. Here is why — and what it means for businesses that need to comply.
The Historical Pattern: Crises Accelerate EU Regulation
The EU's response to major crises follows a recognisable pattern. GDPR was accelerated after the 2013 Snowden revelations exposed mass surveillance. The NIS Directive was fast-tracked after a series of major European cyberattacks in 2016. The AI Act gained political urgency after the rapid proliferation of generative AI tools in 2023. The DSA was pushed through after the January 6, 2021 events in the US demonstrated the societal risks of unmoderated platforms.
In each case, a crisis did not pause regulation — it provided the political will to accelerate it. The EU's instinct when faced with new threats is to regulate. This is not criticism — it is a structural feature of how the EU operates. The bloc's power comes from setting rules. Rules require crises to justify them.
The Iran crisis fits this pattern perfectly. It is not a crisis that undermines EU digital regulation. It is a crisis that validates every significant piece of it.
How the Iran Crisis Validates Each Major EU Digital Regulation
The EU AI Act — Directly Validated
The cyberattack that dropped Iran's internet to 4% of normal traffic was not a simple technical operation. It combined artificial intelligence-driven target selection, AI-assisted electronic warfare systems, automated DDoS attacks at scale, and deep system intrusions that required machine-speed decision-making. This is AI used as a weapon of warfare.
The EU AI Act classifies AI systems used in critical infrastructure, law enforcement, and national security contexts. The regulation requires transparency about AI capabilities and strict governance of high-risk AI applications. The Iran conflict demonstrates in real time exactly what unregulated, weaponised AI looks like. Expect EU regulators to reference this crisis when justifying the Act's strictest provisions.
NIS2 — Already Being Strengthened
The timing is remarkable: on January 20, 2026 — just 39 days before the Iran strikes — the European Commission proposed targeted amendments to NIS2. The Commission specifically cited the need to 'increase legal clarity' and ease compliance while also expanding the directive's reach. These amendments were in progress before the crisis. After it, their passage becomes essentially certain and likely accelerated.
The amendments specifically introduce a new category for small and medium-cap enterprises, bringing 28,700 additional companies — including 6,200 micro and small businesses — into the NIS2 framework. If you thought NIS2 did not apply to your business, this week's events suggest you should check again carefully.
The Cyber Resilience Act — Now Urgently Relevant
The EU Cyber Resilience Act — which requires cybersecurity standards for products with digital elements — was already moving through EU legislative processes. The Iran conflict, which demonstrated how vulnerable digital infrastructure is to sophisticated state-sponsored attacks, will accelerate political support for this legislation. Product manufacturers and software developers selling to EU markets should treat Cyber Resilience Act compliance as an immediate priority, not a future consideration.
GDPR — The Crisis Data Protection Dimension
The Iran conflict creates GDPR obligations that many businesses have not considered. If your business uses cloud infrastructure that experienced disruption due to the conflict — whether through routing changes, data centre issues, or cyberattacks on infrastructure providers — you have potential data protection obligations. A disruption that affects the availability, integrity, or confidentiality of personal data you process may constitute a GDPR incident requiring assessment and potentially notification.
The Three Regulations Most Likely to Accelerate
What Smart Businesses Do Right Now
The businesses that will navigate the next 12 months most successfully are those that use this moment of regulatory attention to get ahead of the compliance curve. Here is what that means practically:
Do not wait for amended NIS2 to pass before assessing your obligations. The core requirements are already law. Start your risk assessment now.
Map your AI tool usage against EU AI Act categories. If you use AI for anything that affects customers — recommendations, content moderation, pricing — identify the risk category and understand your disclosure obligations.
Review your data processing agreements with cloud providers. If your provider operates infrastructure in the UAE or other affected regions, check whether your GDPR DPA covers disruption scenarios and cross-border data transfer implications.
Document your cybersecurity measures. Under NIS2, 'if it is not documented, it does not exist' is the enforcement principle. Every security measure you have implemented should be formally recorded and dated.
Monitor the EU regulatory response directly. The European Commission's digital regulation page at digital-strategy.ec.europa.eu is the authoritative source. Set up a Google Alert for 'NIS2 amendment' and 'EU Cyber Resilience Act' to receive updates automatically.
Frequently Asked Questions
Q: Could the Iran conflict cause the EU to delay some regulations to help businesses cope?
A: This is theoretically possible for regulations affecting physical supply chains or import/export. For digital regulations — especially cybersecurity and AI governance — delay is extremely unlikely. If anything, the crisis has demonstrated more urgency, not less.
Q: Does the EU AI Act cover AI used in cyberattacks?
A: The EU AI Act primarily governs commercial use of AI within EU jurisdiction. Military and national security AI applications are explicitly excluded from the Act's scope. However, dual-use AI — systems that have both civilian and military applications — falls into a complex regulatory grey area that EU legislators are actively addressing.
Q: What is the Cyber Solidarity Act and how does it apply now?
A: The Cyber Solidarity Act, adopted in 2024, established a European Cyber Shield — a network of national and cross-border security operations centres — and a Cyber Emergency Mechanism to help member states respond to major incidents. It also established an EU Cyber Reserve of trusted private providers. Given the current threat level, activation of the Cyber Emergency Mechanism is possible.
The Iran conflict is not a pause in EU digital regulation. It is a stress test that EU regulators will cite for years when justifying the necessity of their framework. For businesses navigating this environment, the message is consistent: the EU's direction of travel on digital regulation is fixed, it is accelerating, and the gap between those who are prepared and those who are not is growing wider every week.