Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during September 2026 from the EU and UK.

The most significant development this month in the UK is that the government has accepted all 44 of the AI Commission’s recommendations for a new framework governing AI in health care. The recommendations call for a proportionate, lifecycle-based approach to regulation, including staged authorizations, enhanced post-market monitoring, and greater transparency requirements. The Medicines and Healthcare products Regulatory Agency (MHRA) is also expanding its use of regulatory sandboxes as part of their AI Airlock program and in collaboration with the National Health Service.

Meanwhile, across the channel, September has been a month busy with consultations. The European Commission (EC) carried out a consultation on a draft implementing regulation for HealthData@EU, which is intended to form the infrastructure across Europe for the access of electronic data for secondary use under the European Health Data Space (EHDS) Regulation. The EC plans to adopt the implementing regulation in Q4 2026, and this regulation would then apply from March 26, 2029. In addition, the EC has had a consultation on high-risk AI classification guidelines, to which MedTech Europe has responded expressing concern over potential legal uncertainty for medical devices combining rule-based and AI-based functionalities. Further, the European Data Protection Board has launched a consultation (open until November 13, 2026) on their draft guidelines on the interplay between fines and other General Data Protection Regulation (GDPR) corrective powers.

Continue Reading Virtual and Digital Health Digest – October 2026

On 21 October 2026, the UK Government confirmed that it will make the unilateral recognition of EU CE marks for medical devices and in vitro diagnostic devices (IVDs) in Great Britain indefinite. The confirmation is set out in the Government’s response to the consultation it ran earlier in the year on its proposals for indefinite recognition of EU CE marks (please see our previous blog post here).  

Continue Reading UK government announces indefinite recognition of EU CE marks for medical devices and in vitro diagnostics

As reported in our February 2026 blog post, in 2025 the Law Commission, an independent statutory body established to keep the law of England and Wales under review and recommend reform, launched a review of the law on liability for defective products (publishing its terms of reference in December 2025). On 8 October 2026, the Law Commission published its consultation on product liability law which sets out its provisional proposals and invites responses to 62 questions.

Background

 It has been over 40 years since the adoption of the EU Product Liability Directive 85/374/EEC, which was implemented into law in Great Britain by way of the Consumer Protection Act 1987 (CPA) and in Northern Ireland under the Consumer Protection (Northern Ireland) Order 1987. The EU legal framework was reformed in 2024 and EU Member States, and Northern Ireland, have until 9 December 2026 to implement the new Product Liability Directive (EU) 2024/2853 into national law. However, post-Brexit, the new EU Directive does not apply in Great Britain, and it is unclear whether the UK Government plans to overhaul the CPA. Although not binding on the Government, the Law Commission’s provisional proposals, which are similar in a number of key respects to the new Product Liability Directive (EU) 2024/2853, provide an indication of what may be on the horizon.

Continue Reading Will Great Britain follow the EU with reform of product liability law?

On 23 September 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy €7 million under the GDPR. The decision concerns a database of patient records collected from around 800 general practitioners and covering around a million patients. IQVIA used the database for observational studies requested by pharmaceutical companies. IQVIA treated the data as anonymous. The Garante did not agree with this classification and considered that the data is, instead, pseudonymised patient-level personal data that is subject to the GDPR.

This decision by the Garante is particularly interesting. As we discussed in our earlier post on the EU Digital Omnibus, the EU is in the middle of a wider effort to simplify its digital rulebook. One of the changes on the table in the Digital Omnibus is a narrower concept of personal data, so that coded data in the hands of a company that has no realistic way of identifying who the patients are would fall outside the scope of the GDPR. The Garante decision shows, however, that, in the meantime, regulators are  taking a strict and conservative approach to what constitutes personal data.

Continue Reading Pseudonymised, Not Anonymous: What the Italian Garante’s €7 Million IQVIA Fine Means for Health Data

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during August 2026 from the EU and UK.

The more significant developments this month have been in the data protection space. Notably, Uber was fined almost €825 million following a finding that they breached the general prohibition on fully automated decision-making in the General Data Protection Regulation (GDPR). This decision serves as an important reminder for the need for meaningful human review in the Life Sciences industry as companies increasingly rely on AI-assisted decision-making, for example in screening candidates for eligibility to take part in clinical trials.

Further, the European Data Protection Board (EDPB) has written to the European Commission to request that the commission “closely assess” the recent U.S. Supreme Court decision of Trump v. Slaughter and its impact on the EU-U.S. Data Privacy Framework (DPF) adequacy decision. The EDBP has raised that this decision, which holds that the statutory protection against removal of Federal Trade Commissioners are unconstitutional, may affect the validity of the DPF decision.

Other developments include that the International Medical Device Regulators Forum (IMDRF) has published technical guidance regarding Predetermined Change of Control Plans (PCCP) for medical device software. This guidance intends to foster regulatory harmonization by identifying the essential principles for developing PCCP. 

Continue Reading Virtual and Digital Health Digest – September 2026

The EU institutions have now published the updated text on the reform of the EU pharmaceutical legislation and the new Directive [link] and Regulation [link]. Formal adoption by the European Parliament and the Council is expected in the coming months. 

The publication follows the provisional political agreement on the text reached by the European Union Institutions on 11 December 2025, and the votes by the European Parliament and Council in March 2026.

We set out below some of the key elements of the provisional text. A more detailed advisory will follow.

Continue Reading Final text of the reform to the EU Regulatory Framework for Medicinal Products published

On 30 June 2026, the UK government introduced the Immigration and Asylum Bill (the Bill), proposing the most significant reforms to the Modern Slavery Act 2015 (the MSA) since its enactment. The MSA’s transparency-in-supply-chains regime relies on voluntary disclosure is subject to very limited  enforcement; the Bill would move the regime towards mandatory reporting, stronger corporate accountability and material sanctions for non-compliance.

Continue Reading Reform of UK Modern Slavery Act’s Supply Chain Reporting Regime

On 3 September 2026, Advocate General Kokott delivered a significant Opinion in Case C‑193/25, Poland v Parliament and Council, recommending the annulment of the provisions of the revised Urban Waste Water Treatment Directive 2024/3019 (UWWTD) that require pharmaceutical and cosmetics producers to finance 80% of the costs of quaternary wastewater treatment. While the AG accepts the legitimacy of applying the polluter-pays principle to micropollutants in wastewater, she concludes that the EU legislature failed adequately to substantiate the scientific basis for selecting  those industries to pay 80% of the costs.

Continue Reading AG Kokott recommends annulment of Urban Wastewater Directive’s pharmaceutical and cosmetics levy

The CJEU has delivered a preliminary ruling in Case C-427/24 Diagramm Halbach, which provides guidance on determining whether a product is a medical device within the meaning of Regulation (EU) 2017/745 (“MDR”). The judgment confirms that the manufacturer’s advertising of a product is not necessarily decisive in determining whether it has a “medical purpose” within the definition of “medical device” under the MDR, and that the product must also objectively perform one (or more) of those medical purposes to fall within that definition. The judgment also provides guidance on what constitutes a solely administrative function that does not fall within those medical purposes. The decision has the potential to guide other classification decisions of borderline products used in the healthcare sector.

Continue Reading CJEU ruling clarifies scope of medical device definition

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during July and early August 2026 from the EU and UK.

During July 2026, regulators in the EU and UK continued to focus on the practical implementation of AI and digital health regulation.

In the EU, the Digital Omnibus on AI introduced the first substantive amendments to the AI Act, while policymakers and industry groups turned their attention to how AI requirements will interact with existing frameworks. This included new principles on the use of AI in Joint Clinical Assessment dossiers under the Health Technology Assessment Regulation, the European Federation of Pharmaceutical Industries and Association’s (EFPIA) call for trusted AI testing environments and proportionate AI governance in its response to the Biotech Act consultation, and further debate on the treatment of software and AI-enabled technologies in the ongoing Medical Device Regulation (MDR)/In Vitro Diagnostic Regulation (IVDR) revision. Together, these developments reflect a growing focus on ensuring that AI-specific requirements integrate effectively with existing regulatory frameworks.

In the UK, regulators published a series of guidance documents addressing questions about when AI-enabled products qualify as medical devices and how they should be regulated. New Medicines and Healthcare products Regulatory Agency (MHRA) guidance on ambient voice technologies and updated guidance on digital mental health technologies provide greater clarity on the medical device boundary, while additional outputs from the AI Airlock program highlight the challenges associated with qualification, intended purpose, and lifecycle management of AI systems. These developments suggest that regulators are increasingly focused on addressing practical implementation questions.

Continue Reading Virtual and Digital Health Digest – August 2026