On 7 May 2026, the European Parliament and Council announced a provisional political agreement on the AI Act portion of the Digital Omnibus package. According to the European Parliament’s press release and the Council’s press release, the agreement aims to make compliance more workable, while maintaining its main provisions and risk-based approach. The agreed text has not yet been published, and the agreement remains provisional pending formal adoption by both institutions, which co-legislators intend to complete before 2 August 2026, the date on which the AI Act’s original high-risk system obligations were due to become applicable.

This blog post sets out what the press release describes as having been agreed, and flags the points most relevant to pharmaceutical and MedTech companies. As we noted in our earlier analysis, the Digital Omnibus on AI Proposal carries significant implications for life sciences companies. We will provide a fuller assessment once the agreed text is available and adopted.

Continue Reading EU AI Act Omnibus: Provisional Deal Announced – Initial Reflections for Life Sciences Companies

Background

On 20 April 2026, the Law Commission, an independent organisation established to keep the law of England and Wales under review and recommend reform, announced a new project to consider the potential introduction of a consumer class actions regime in England and Wales. While independent, the Law Commission’s project is sponsored by the Department for Business and Trade (DBT), which is completing its review of the current competition collective (class) action regime that was introduced in the UK in 2015.  There has long been speculation that the government would use competition claims as a pilot before expanding the regime to consumer claims, including product liability and other claims, and this could be the first step in that process.

The Terms of Reference do not shed much further light on the project at this stage, aside from identifying that its purpose is to “set out the benefits and risks associated with the introduction of a collective class actions regime for consumer law claims…”.

However, it is a further signal that consumer protection and providing meaningful recourse for consumers has become a greater policy priority as it follows the recent implementation of the Digital Markets, Competition and Consumers Act 2024, which significantly overhauled UK consumer protection in digital markets, strengthening rights against fake reviews, drip pricing, subscription contract traps and other unfair practices.

This project will not consider substantive consumer rights but is instead squarely focussed on the design of a powerful new private enforcement mechanism to allow opt-out class actions to facilitate mass consumer claims in the UK.  This should be seen against a backdrop of growing pressure on the existing competition collective action regime where claimants have sought to characterise consumer law claims as competition claims in order to bring them before the Competition Appeal Tribunal (CAT) as an opt-out collective action.  The CAT has pushed back on this, reminding parties in one recent case that “competition law is not a general law of consumer protection”. A dedicated consumer class actions regime would remove the need for such creative framing and, in doing so, would significantly expand the pool of claims that can be brought on an opt-out basis.

If the Law Commission’s decision is to recommend the introduction of a class actions regime for consumer claims, then it will also make recommendations as to the design of such a regime.

Continue Reading The Law Commission of England & Wales announces a review of a potential new class actions regime

On 5 May 2026, the European Commission published an implementing regulation setting new procedural requirements for Notified Body assessments in medical device and IVD conformity assessment procedures (the “Implementing Regulation”). The Implementing Regulation aims to give manufacturers greater certainty in their interactions with Notified Bodies during the initial conformity assessment process and in post-market modifications and re-certifications, as well as aiming to avoid inconsistent practices between Notified Bodies.

To achieve these objectives, the Implementing Regulation sets maximum timelines for Notified Body assessments, provides for standardised rules around quotes by Notified Bodies for carrying out assessments and standardises certain information and verification requirements. The Implementing Regulation also requires each Notified Body to monitor and report on the duration and costs of its assessment activities. Manufacturers will, therefore, have better oversight of the performance of each Notified Body when selecting one to carry out an assessment.

The Implementing Regulation has been developed in response to the inconsistent and divergent interpretation of the procedures for Notified Body assessments under the EU Medical Devices Regulation 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation 2017/746 (IVDR), which makes the processes unpredictable for manufacturers.

The European Commission had previously published the implementing regulation in draft form in December 2025 and opened a consultation, which closed in January 2026.

Continue Reading EU implements new rules on uniform procedural requirements for Notified Body assessments

Introduction

Assays used in clinical trials vary widely in complexity and regulatory status.. They may be fully developed and marketed as in vitro diagnostic medical devices (IVDs), including companion diagnostics (CDx), that clearly fall within the scope of the EU In Vitro Diagnostic Regulation (IVDR) and/or the UK Medical Devices Regulations 2002 (UK MDR). Alternatively, they may be bespoke assays created specifically for use in a given clinical trial or in connection with an investigational medicinal product (IMP).

Continue Reading Navigating IVD Regulation in Clinical Trials: A Comparative EU and UK Guide

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during February and early March 2026 from the the United Kingdom, and European Union.

February 2026 saw a period of substantial regulatory activity across both the UK and EU, particularly in relation to AI governance, medical technologies, and data protection. In the UK, the policy landscape continued to evolve with initiatives affecting the regulation of medical devices, clinical research, and AI deployment. Key developments included the Medicines and Healthcare products Regulatory Agency’s (MHRA) consultation on the indefinite recognition of CE-marked medical devices, record levels of medical device testing, and the Prescription Medicines Code of Practice Authority’s (PMCPA) revised guidance on the use of social media. AI remained a major focus in the UK, with the UK government’s response to the consultation on the AI Management Essentials tool, increased industry involvement in the UK AI Security Institute’s alignment program, and feedback relating to governmental research on AI adoption across UK businesses. Additional international collaboration efforts included UK engagement at the India AI Impact Summit and an expanded science and technology partnership with Japan, as well as the launch of the first-ever AI Strategy for UK Research and Innovation.

Continue Reading Virtual and Digital Health Digest – February 2026

On 19 March 2026, the Court of Justice of the European Union (CJEU or Court) issued its judgment in Case C-526/24, Brillen Rottler GmbH & Co. KG v TC. The case concerned a data subject who subscribed to a German optician’s newsletter and, thirteen days later, submitted an access request under Article 15 GDPR. The company refused the request, arguing it was abusive. The data subject maintained it was legitimate and claimed at least €1.000 in non-material damages.

The CJEU’s judgment addresses three questions of broad significance: (1) when a first access request can be refused as “excessive”; (2) whether a violation of the right of access alone can give rise to a compensation claim under Article 82 GDPR; and (3) how non-material damage should be assessed in that context. While the judgment is relevant to all companies subject tot GDPR, we examine below the considerations it raises for life sciences companies specifically.

Continue Reading CJEU rules on GDPR access rights and abuse of rights: what the Brillen Rottler judgment means for life sciences companies

On 16 December 2025, the European Commission published its Proposal for a Regulation establishing a framework of measures for strengthening the EU’s biotechnology and biomanufacturing sectors, particularly in the area of health (the “European Biotech Act” or the “Proposal”). The Proposal is ambitious in scope: it amends several major pieces of EU health legislation, including the Clinical Trials Regulation (“CTR”), the Veterinary Medicines Regulation, the Food Law Regulation and the Substances of Human Origin Regulation (“SoHO”), while also introducing a new framework for EU strategic projects, AI-enabled biotechnology, and biodefence.

On 10 March 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) adopted Joint Opinion 3/2026 on the Proposal (the “Joint Opinion”). While broadly supportive of the Proposal’s objectives, the EDPB and EDPS identified a number of significant data protection concerns, and issued recommendations. Although not legally binding, the Joint Opinion carries significant weight as it reflects the views of the EU’s primary data protection authorities and will directly shape the legislative debate ahead.

In this blog we examine the key data protection implications of the Proposal and the Joint Opinion for pharma and life sciences companies.

Continue Reading EDPB/EDPS Joint Opinion on the European Biotech Act Proposal: Key Data Protection Implications for Pharma and Life Sciences

Today, 6 March 2026, the Council of the European Union (“Council”) published the provisional agreement on the reform of the EU pharmaceutical legislation and the new Directive [link] and Regulation [link]. Formal adoption by the European Parliament and the Council is expected in the coming months. 

Continue Reading Provisional text of the political agreement on the reform to the EU Regulatory Framework for Medicinal Products is published

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during December 2025 and early January 2026 from the the United Kingdom, and European Union.

January 2026 saw significant activity as UK and EU authorities advanced major initiatives affecting the use of AI, digital technologies, data governance, and cybersecurity in healthcare and life sciences. Notable developments include EMA’s and FDA joint principles on the use of AI across the medicinal product lifecycle, the European Commission’s call for evidence on the proposed amendments to the Medical Devices Regulation (EU) 2017/745 (MDR) and In Vitro Diagnostic Regulation (EU) 2017/746 (IVDR), proposals to strengthen the EU Cybersecurity Act, and important data protection interventions. In parallel, UK and EU regulators continued to focus on the safe deployment of digital tools in healthcare, including new Medicines and Healthcare products Regulatory Agency (MHRA) guidance on mental health technologies and ongoing work to refine AI governance. These updates, alongside developments in Intellectual Property (IP) and product liability, signal a rapidly evolving regulatory environment that will help to shape digital innovation and compliance expectations throughout 2026.

Continue Reading Virtual and Digital Health Digest – January 2026

On 19 November 2025, the European Commission published two legislative proposals – the Digital Omnibus on AI Regulation Proposal and the broader Digital Omnibus Regulation Proposal (“Proposals”) – as part of a wider initiative to simplify and streamline the EU’s digital regulatory framework. Together, the Proposals introduce targeted but significant amendments across a broad range of instruments, including the EU AI Act (Regulation (EU) 2024/1689), the GDPR (Regulation (EU) 2016/679), the ePrivacy Directive (2002/58/EC), the NIS2 Directive ((EU) 2022/2555), and the EU Data Act (Regulation (EU) 2023/2854).

Continue Reading EU Digital Omnibus: What the Proposed Reforms Mean for Pharma and MedTech