Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
On November 4, 2026, the European Commission published its 2027 work programme and, with it, a map of which digital and AI fights it still wants to pick. The document is not law. It is a political calendar: new proposals, simplification packages, enforcement priorities, and a short list of long-stalled files the College now wants to abandon. For privacy, security, and product counsel, the useful question is not whether Brussels sounds ambitious. It is which 2027 boxes will force budget lines, impact assessments, and national transposition fights.
TL;DR
- On November 4, 2026, the Commission adopted its 2027 work programme, pairing delivery of existing files with a smaller set of new initiatives and planned withdrawals.
- Digital highlights include a Q2 2027 “digital transformation package, simplification and copyright,” industrial AI blueprints for five sectors, and actions across the AI stack from chips to compute funding.
- A Pact against gold-plating would push Member States to disclose national add-ons and face a European Semester “review and remove” track, while some stalled tax files, including corporate taxation of a significant digital presence, are marked for withdrawal.
What a work programme is, and is not
Every autumn the Commission tells Parliament, Council, and the public what it intends to table next year. The 2027 programme, presented with an annual overview report on simplification, implementation, and enforcement, leans hard on delivery. President Ursula von der Leyen framed it as equipping Europe for harder years ahead: deeper Single Market work, fewer barriers, and “strategic, streamlined policies.” Commissioner Valdis Dombrovskis, who holds the simplification portfolio, said twelve omnibus and related measures already tabled could yield up to about EUR 22.3 billion a year in recurrent administrative savings once fully applied—nearly 60% of the mandate target—and that 2027 priorities include banking, transport, digital markets, housing, and faster permitting.
That context matters for privacy teams juggling overlapping GDPR, ePrivacy, AI Act, DSA, and DMA duties. Simplification is now a political brand, not a side project. Industry groups have pushed for years for streamlining GDPR and ePrivacy rules; the work programme does not rewrite those statutes by itself, but it signals where new digital legislation will claim to cut burden while adding new duties.
The digital transformation package for Q2 2027
The factsheet annexed to the programme lists a legislative “Digital transformation package, simplification and copyright,” with an impact assessment, legal bases including Articles 53, 62, 114 and 173(3) TFEU, and a target window of the second quarter of 2027. The accompanying communication says the Commission will review Digital Decade targets and propose a broader package “to better reflect the latest developments.” It also pledges to harness AI for cultural and creative sectors, support creators, safeguard human creativity and cultural and linguistic diversity, and promote ethical AI use.
Copyright is not a throwaway word. The Commission recently ran a consultation on how copyright-protected content is used for generative AI; that consultation closed on November 3, 2026. Expect the Q2 package to mix simplification rhetoric with rules or soft-law hooks on AI training data, licensing pathways, and creator safeguards. Pinsent Masons’ Out-Law analysis likewise flags the digital package as a headline for businesses that need early insight into 2027 policy sequencing.
Compliance calendars should treat Q2 2027 as a watch window, not an enactment date. Co-legislators can reshape, delay, or split the package. Still, product, legal, and public-policy teams that wait for a final text before scoping AI-training and content-licensing risk will be late to the impact assessment comments that actually move drafts.
Industrial AI blueprints and the “AI stack”
Beyond horizontal AI Act implementation, the programme promises a blueprint for action in five industrial AI sectors: health, transport, agri-food, advanced manufacturing, and defence and space. It also commits to strengthen Europe’s position in the “AI stack,” spanning chips, data, compute, and innovative funding—especially equity—alongside other support instruments. Cyber preparedness and resilience get a streamlined mention in the same breath.
For regulated industries, “blueprint” language usually means strategies, funding calls, and sectoral guidance before hard new acts. Health AI teams already navigate the uneasy overlap of medical device rules, GDPR special-category data, and AI Act high-risk duties, including questions explored in coverage of when AI medical advice meets GDPR patient rights. Transport and agri-food blueprints will pull in safety regulators and data-sharing schemes. Defence and space will stress sovereignty and supply-chain controls that privacy policies alone cannot answer.
None of this replaces the AI Act. It layers industrial policy on top of it. Governance, risk, and compliance functions that still treat AI as a single policy workstream will need separate tracks for product conformity, sector funding conditions, and compute or data-localization expectations that ride with “stack” investments. That is classic governance, risk, and compliance work: map owners, evidence, and residual risk per initiative rather than filing everything under “AI strategy.”
Pact against gold-plating
One of the sharper institutional ideas in the communication is a Pact against gold-plating. The Commission’s concern is familiar: EU institutions agree a rule, then Member States add national extras that restore the burden Brussels claims to have removed. Under the envisaged pact, Member States should be transparent about additions they make when bringing EU law into national rules and about the impact of those additions on businesses and the Single Market. A “review and remove” mechanism would sit in the European Semester process to tackle burdens attributed to gold-plating.
Privacy lawyers should read this with mixed feelings. Gold-plating is how some Member States enact stronger employee monitoring limits, children’s codes, or cookie rules. A transparency-and-Semester approach does not automatically forbid stricter national law, and constitutional or Charter arguments can still support higher protection. KPMG’s EU Tax Centre note already flags political sensitivity: efforts to discourage going beyond EU frameworks have drawn pushback in areas such as public country-by-country reporting, and similar tensions appear in Tax Omnibus talks. NGOs and some national regulators will argue that “gold-plating” is sometimes the point.
For companies, the near-term practical effect is documentary. When a Member State transposes DSA, AI Act, or data-law updates with extras, firms will want a clear delta analysis: EU baseline versus national add-on, business impact, and whether Semester pressure later forces a rollback. That delta belongs in the same living register as cookie-banner redesigns and Digital Omnibus ideas for browser-level consent, which remain co-legislator business even as the 2027 programme looks ahead.
Children online, democracy tools, and unfinished omnibus files
The communication states that the Commission will “make digital policy future-proof and protect children from online harm.” That is a thematic priority, not a single line-item bill in the factsheet excerpt for children’s safety alone. It sits alongside Democracy Shield work, a planned Recommendation on safety in politics, consultation follow-up on political advertising rules, and exploration of options on online hate offences. Disinformation amplified by AI is named explicitly as a pressure on democratic systems.
Meanwhile, earlier digital simplification proposals—from late 2025 onward—remain partly unsettled. AI Act adjustments moved faster than the wider rewrite of data and digital rules. The European Data Protection Board’s attention to how Digital Omnibus GDPR amendments would change controllers’ daily work is unfinished business that 2027 delivery politics will either accelerate or dilute. Parallel guidance on the interplay between the DMA and the GDPR shows how “simplification” still leaves gatekeepers and privacy authorities negotiating the same datasets.
Withdrawals: clearing the legislative attic
Work programmes also announce what the Commission no longer wants to defend. Pinsent Masons notes planned withdrawals that include the proposed Green Claims Directive and the Financial Data Access Regulation, plus one of two EU digital tax proposals. KPMG’s November 5–6, 2026 tax flash is more granular on the direct-tax side: among files marked to be withdrawn within about six months are BEFIT (2023), the Head Office Tax system for SMEs (2023), and the 2018 proposal on corporate taxation of a significant digital presence—the long-stalled idea of a taxable nexus based on digital revenue, users, or contracts in a Member State. The Commission’s rationale, as summarized there, is lack of Council progress and low odds of unanimity.
That withdrawal, if formally completed in the Official Journal, does not erase national digital services taxes or OECD workstreams. KPMG notes that the separate 2018 EU Digital Services Tax proposal was not listed for withdrawal and is not on the priority list either—an ambiguous limbo. Privacy teams should not confuse a tax-nexus withdrawal with changes to DSA, DMA, or GDPR transfer rules. It does, however, remove one overhang that digital platforms have tracked for eight years.
A five-step calendar for 2027 compliance planning
- Park Q2 2027 for the digital/copyright package. Assign owners for AI training-data, licensing, and creative-sector issues now; comment windows move faster than internal steering committees.
- Split AI Act conformity from industrial AI blueprints. Health, transport, agri-food, manufacturing, and defence/space each need a sector lead who can read funding conditions and safety regulators, not only Annex III risk tiers.
- Build a gold-plating delta register. For every major EU digital file, record national extras, business cost, and whether Semester “review and remove” pressure appears in country reports.
- Track withdrawals to Official Journal publication. A work-programme line is intent; OJ publication closes the file. Until then, treat BEFIT, HOT, and digital-presence corporate tax as dying, not dead.
- Keep Omnibus and DSA/DMA enforcement on the same dashboard. Simplification proposals and VLOP investigations will collide in the same budget year; do not staff them as unrelated projects.
Enforcement context from the Commission’s own stocktaking reinforces that last point: it reported launching 874 infringement procedures—the highest in a decade—referring 61 cases to the Court of Justice and seeking financial sanctions in 25, while closing 499 after Member State compliance. Delivery politics includes suing capitals, not only drafting Brussels PDFs.
Frequently asked questions
Does the 2027 work programme change the GDPR or the AI Act tomorrow?
No. It announces intended initiatives and political priorities. Binding changes still require proposals, co-legislator agreement, and usually transitional periods.
When would the digital transformation package become law?
The Commission aims to table it in Q2 2027. Enactment timing depends on Parliament and Council. Plan scenarios in years, not weeks, after the proposal drops.
What is gold-plating in this context?
National rules that go beyond the EU baseline when Member States transpose or implement Union law. The envisaged pact emphasizes transparency and a Semester review mechanism, not an automatic ban on stricter national measures.
Is children’s online safety a new regulation in the programme?
The communication names protecting children from online harm as a digital-policy priority. Treat it as a theme that may surface inside the digital package or related instruments, and verify each concrete proposal as it appears—do not invent a finished children’s act from the slogan alone.
Calendars beat slogans
Commission work programmes reward the boring discipline of dating ownership. Q2 2027 for digital and copyright, industrial AI blueprints across five sectors, Semester fights over national add-ons, and a clear-out of tax files that never found unanimity—that is the actionable core. Companies that only quote the sovereignty slogan will miss the week their impact-assessment comments were due. Teams that put the dates on a shared calendar will still argue with the drafts—they just will not be surprised by them.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
