On 7 July 2026, the European Data Protection Board (“EDPB”) adopted its Guidelines 02/2026 on Anonymisation for public consultation (the “Guidelines”), replacing the Article 29 Working Party’s Opinion 05/2014 that served as one of the primary EU references on the topic for over a decade.

Since 2014, the legal landscape has, however, shifted considerably, most notably through the Court of Justice’s judgment in EDPS v SRB (Case C-413/23 P) (see our blog on that judgment), and the practical landscape even more so, with the proliferation of AI, large-scale data pooling, and cross-border research collaborations. For life sciences companies handling key-coded clinical data, safety reports, or real-world evidence, the Guidelines, once finalised and adopted, will set out a clear framework for determining when data is genuinely anonymous and therefore falls outside the GDPR’s scope.

Continue Reading EDPB Guidelines on Anonymisation: What Life Sciences Companies Need to Know

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during May and early June 2026 from the United Kingdom and European Union.

May 2026 saw continued momentum across the European Union (EU) and United Kingdom (UK) toward modernizing and streamlining the regulatory landscape for digital health, with a particular focus on accommodating AI-enabled technologies while reducing unnecessary complexity. A central development was the provisional agreement on the Digital Omnibus package, which seeks to simplify the application of the EU AI Act by clarifying overlaps with sector-specific legislation, deferring key obligations, and introducing more proportionate requirements.

In parallel, regulators on both sides of the Channel are advancing reforms to ensure that medical device frameworks remain fit for purpose in an increasingly software-driven and data-centric environment. In the EU, the activation of key European Database on Medical Devices (EUDAMED) modules marks a major step toward enhanced transparency and traceability, while ongoing discussions on the Medical Devices Regulation 2017/745 (MDR)/In Vitro Diagnostic Regulation 2017/746 (IVDR) revisions highlight a strong policy drive toward simplification and better integration of AI. In the UK, the Medicines and Healthcare products Regulatory Agency’s (MHRA) proposed pre-market reforms and broader thinking on AI regulation signal a shift toward more flexible, lifecycle-based oversight, with greater emphasis on post-market monitoring and innovation support.

Data governance and cybersecurity also remain high on the agenda. Industry and regulators alike are emphasizing the need for coherent, proportionate frameworks that avoid duplication while enabling innovation, particularly in light of expanding AI use cases and global supply chains. Together, these developments reflect a broader trend toward risk-based, innovation-friendly regulation, coupled with increasing expectations around transparency, accountability, and data protection in digital health.

Continue Reading Virtual and Digital Health Digest – June 2026

Regulatory activity in the EU and UK over the past month has focused on AI in health care, health data access, and digital innovation frameworks. Recent regulatory developments in the EU and UK point to a decisive shift from high level policy ambition to the practical mechanics of enabling AI driven health care, with particular emphasis on health data governance, regulatory pilots, and institutional readiness.

At the EU level, attention is increasingly focused on building durable frameworks to support innovation while maintaining regulatory confidence. The European Medicines Agency is preparing to pilot enhanced regulatory support for breakthrough medical devices and in vitro diagnostics (IVD), an initiative expected to shape future reforms of the EU medical device and IVD regimes. In parallel, the European Commission has taken further steps to operationalize the European Health Data Space (EHDS) through new implementing rules on the governance of the European Health Data Space Board, signaling a move from legislation to execution. The European Data Protection Board (EDPB) has also issued draft guidelines on the application of the General Data Protection Regulation (GDPR) to scientific research, offering long awaited clarification on lawful bases, consent models, and secondary use of data, issues that are central to data intensive research and AI development and likely to influence practice across Member States once finalized.

In the UK, scrutiny has centered on whether existing data and regulatory structures are capable of supporting personalized medicine and AI at scale. Evidence to the House of Lords Science and Technology Committee highlighted the UK’s rich but underexploited health data assets and the persistence of access barriers since the pandemic, with witnesses pointing to fragmented governance and delays in data access as ongoing constraints. At the same time, the expansion of the Medicines and Healthcare products Regulatory Agency’s (MHRA) AI Airlock program, continued work by the National AI Commission, and targeted support for AI driven drug discovery reflect a more iterative, test and learn approach to AI regulation, focused on post market oversight rather than wholesale reform.

Continue Reading Virtual and Digital Health Digest – May 2026

The MHRA’s proposed rare disease therapies regulatory framework (“the Proposed Framework”) represents an ambitious attempt to redesign medicines regulation around the realities of rare disease development.

On 21 May 2026, the MHRA launched its consultation on the Proposed Framework, representing a significant step in the UK’s ambition to become a global leader in the development of therapies for rare diseases.

The initiative reflects the scale of unmet need: around 1 in 17 people will be affected by a rare disease during their lifetime, equating to over 3.5 million people in the UK, yet only around 5% of rare diseases have an approved treatment.

The consultation acknowledges that traditional regulatory approaches, designed for common diseases with large patient populations and well‑established trial paradigms, are often unsuitable for rare disease therapies.  Against this backdrop, the Proposed Framework aims to enable earlier patient access to promising therapies, reduce development burden, and incentivise innovation, while maintaining the UK’s standards of safety, quality and efficacy.

The MHRA requests responses from industry, patient organisations and other stakeholders. The consultation closes on 30 July 2026.

Continue Reading UK MHRA consults on a new regulatory framework for rare disease therapies

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during March and early April 2026 from the the United Kingdom, and European Union.

Regulatory activity in the EU and UK over the past month has focused on accelerating the alignment of digital, AI, and life sciences regulatory frameworks, alongside increasing scrutiny of data governance and market readiness for emerging technologies.

At the EU level, work to simplify and streamline EU AI-related legislation has advanced, with the Council of the European Union and European Parliament having adopted their positions on the European Commission’s (EC) Digital Omnibus reforms, and now entering trilogue negotiations on the final text. In parallel, MedTech Europe published its response to the EC consultation on the simplification of the EU AI rules as part of the Digital Omnibus, calling for clearer integration between the AI Act and other sectoral legislation, as well as extended implementation timelines. Separately, the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued a joint opinion on the proposed European Biotech Act, emphasizing the need for clearer safeguards, harmonized legal bases for processing clinical data, and strong protections when health and genetic data are used in biotech and AI contexts.

In the UK, developments have focused on the role of AI-enabled innovation within the health care system. A new parliamentary inquiry into personalized medicine and AI will examine ongoing challenges and barriers to National Health Service (NHS) adoption of new technologies, including procurement, digital infrastructure limitations, and system fragmentation. At the same time, the Medicines and Healthcare products Regulatory Agency (MHRA) has secured multi year funding to expand its AI Airlock Program to support the development of more ambitious AI medical devices. These initiatives signal a continued policy commitment to embedding digital and AI driven innovation into health care delivery and to strengthening the regulatory environment required to support safe deployment at scale.

Continue Reading Virtual and Digital Health Digest – April 2026

The MHRA has launched a consultation on proposed updates to the definition of gene therapy medicinal products (“GTMPs”) under the UK Human Medicines Regulations 2012 (“HMRs”). The current definition was originally developed in 2007, and was based on a smaller range of technologies. It is no longer considered to reflect the full range of modern gene therapy technologies now available, including therapies involving synthetic genetic material, new forms of genome editing, and highly engineered cells and tissues. This means there may not be a clear path to market for these technologies under the current legislation.

The proposals aim to address these limitations and align the regulatory framework with current scientific developments. The proposed reforms represent a targeted shift towards a more technology-neutral and mechanism-based approach. The proposals do not change the approval process, classification of existing products, or applicable safety and efficacy standards.

The MHRA is seeking input from stakeholders on whether the proposals are appropriate, proportionate and workable, including whether the revisions cover the correct categories of products, and whether these would cause any unintended consequences or operational challenges. The consultation is open until 22 June 2026 and feedback is requested in the form of a survey. Responses can be submitted online here.

Below, we outline the background, the key proposed changes, and the regulatory considerations that have shaped MHRA’s proposals.

Continue Reading MHRA launches consultation on modernising the definition of gene therapy medicinal products

On 11 May 2026, the Medicines and Healthcare products Regulatory Agency (“MHRA”) opened a call for evidence on proposed changes to pre-market medical device and in vitro diagnostic medical device (“IVD”) requirements in Great Britain (“GB”) under the Medical Device Regulations 2002 (“2002 Regulations”). The proposals are set out in the newly published draft Medical Devices (Amendment) Regulations 2026 (“Amending Regulations”). This call for evidence forms a critical part of the UK government’s process for assessing the real‑world implications of a major reform of GB’s medical devices regulatory framework.

These long awaited proposals, as referred to in the MHRA Roadmap published in December 2024, follow previous amendments made to the 2002 Regulations in June 2025, relating to post-market surveillance. Read about these amendments in our previous blog.

Below, we explain what the call for evidence is, why it matters, and provide an overview of some of the key regulatory proposals that stakeholders are being asked to comment on.

Continue Reading Draft UK Medical Device Amending Regulations: Key Proposals and MHRA Call for Evidence

On 7 May 2026, the European Parliament and Council announced a provisional political agreement on the AI Act portion of the Digital Omnibus package. According to the European Parliament’s press release and the Council’s press release, the agreement aims to make compliance more workable, while maintaining its main provisions and risk-based approach. The agreed text has not yet been published, and the agreement remains provisional pending formal adoption by both institutions, which co-legislators intend to complete before 2 August 2026, the date on which the AI Act’s original high-risk system obligations were due to become applicable.

This blog post sets out what the press release describes as having been agreed, and flags the points most relevant to pharmaceutical and MedTech companies. As we noted in our earlier analysis, the Digital Omnibus on AI Proposal carries significant implications for life sciences companies. We will provide a fuller assessment once the agreed text is available and adopted.

Continue Reading EU AI Act Omnibus: Provisional Deal Announced – Initial Reflections for Life Sciences Companies

Background

On 20 April 2026, the Law Commission, an independent organisation established to keep the law of England and Wales under review and recommend reform, announced a new project to consider the potential introduction of a consumer class actions regime in England and Wales. While independent, the Law Commission’s project is sponsored by the Department for Business and Trade (DBT), which is completing its review of the current competition collective (class) action regime that was introduced in the UK in 2015.  There has long been speculation that the government would use competition claims as a pilot before expanding the regime to consumer claims, including product liability and other claims, and this could be the first step in that process.

The Terms of Reference do not shed much further light on the project at this stage, aside from identifying that its purpose is to “set out the benefits and risks associated with the introduction of a collective class actions regime for consumer law claims…”.

However, it is a further signal that consumer protection and providing meaningful recourse for consumers has become a greater policy priority as it follows the recent implementation of the Digital Markets, Competition and Consumers Act 2024, which significantly overhauled UK consumer protection in digital markets, strengthening rights against fake reviews, drip pricing, subscription contract traps and other unfair practices.

This project will not consider substantive consumer rights but is instead squarely focussed on the design of a powerful new private enforcement mechanism to allow opt-out class actions to facilitate mass consumer claims in the UK.  This should be seen against a backdrop of growing pressure on the existing competition collective action regime where claimants have sought to characterise consumer law claims as competition claims in order to bring them before the Competition Appeal Tribunal (CAT) as an opt-out collective action.  The CAT has pushed back on this, reminding parties in one recent case that “competition law is not a general law of consumer protection”. A dedicated consumer class actions regime would remove the need for such creative framing and, in doing so, would significantly expand the pool of claims that can be brought on an opt-out basis.

If the Law Commission’s decision is to recommend the introduction of a class actions regime for consumer claims, then it will also make recommendations as to the design of such a regime.

Continue Reading The Law Commission of England & Wales announces a review of a potential new class actions regime

On 5 May 2026, the European Commission published an implementing regulation setting new procedural requirements for Notified Body assessments in medical device and IVD conformity assessment procedures (the “Implementing Regulation”). The Implementing Regulation aims to give manufacturers greater certainty in their interactions with Notified Bodies during the initial conformity assessment process and in post-market modifications and re-certifications, as well as aiming to avoid inconsistent practices between Notified Bodies.

To achieve these objectives, the Implementing Regulation sets maximum timelines for Notified Body assessments, provides for standardised rules around quotes by Notified Bodies for carrying out assessments and standardises certain information and verification requirements. The Implementing Regulation also requires each Notified Body to monitor and report on the duration and costs of its assessment activities. Manufacturers will, therefore, have better oversight of the performance of each Notified Body when selecting one to carry out an assessment.

The Implementing Regulation has been developed in response to the inconsistent and divergent interpretation of the procedures for Notified Body assessments under the EU Medical Devices Regulation 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation 2017/746 (IVDR), which makes the processes unpredictable for manufacturers.

The European Commission had previously published the implementing regulation in draft form in December 2025 and opened a consultation, which closed in January 2026.

Continue Reading EU implements new rules on uniform procedural requirements for Notified Body assessments