Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during March and early April 2026 from the the United Kingdom, and European Union.

Regulatory activity in the EU and UK over the past month has focused on accelerating the alignment of digital, AI, and life sciences regulatory frameworks, alongside increasing scrutiny of data governance and market readiness for emerging technologies.

At the EU level, work to simplify and streamline EU AI-related legislation has advanced, with the Council of the European Union and European Parliament having adopted their positions on the European Commission’s (EC) Digital Omnibus reforms, and now entering trilogue negotiations on the final text. In parallel, MedTech Europe published its response to the EC consultation on the simplification of the EU AI rules as part of the Digital Omnibus, calling for clearer integration between the AI Act and other sectoral legislation, as well as extended implementation timelines. Separately, the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued a joint opinion on the proposed European Biotech Act, emphasizing the need for clearer safeguards, harmonized legal bases for processing clinical data, and strong protections when health and genetic data are used in biotech and AI contexts.

In the UK, developments have focused on the role of AI-enabled innovation within the health care system. A new parliamentary inquiry into personalized medicine and AI will examine ongoing challenges and barriers to National Health Service (NHS) adoption of new technologies, including procurement, digital infrastructure limitations, and system fragmentation. At the same time, the Medicines and Healthcare products Regulatory Agency (MHRA) has secured multi year funding to expand its AI Airlock Program to support the development of more ambitious AI medical devices. These initiatives signal a continued policy commitment to embedding digital and AI driven innovation into health care delivery and to strengthening the regulatory environment required to support safe deployment at scale.

Regulatory Updates

UK Government Publishes Explanatory Memorandum on Proposed EU MDR and IVDR Reforms. The UK government’s Department of Health and Social Care has published a memorandum explaining the European Commission’s proposal to amend Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). The memorandum notes that compliance with the current regulations involves high and often disproportionate compliance costs and delays, in part due to regulatory complexity. It explains that the proposed reforms aim to streamline processes, support innovation, and ensure smoother market functioning. Under the EC’s proposal, certain software-based devices will move to a lower risk class, meaning less stringent standards will apply, and it will become easier for manufacturers to seek authorization to implement planned and regular changes to software. Obligations of manufacturers of AI-based devices, where such devices are classified as high-risk under the EU AI Act, will also be reduced. The memorandum touches on UK aspects of the reforms, noting that the MDR and IVDR will apply in Northern Ireland via the Windsor Framework. It confirms that, currently, CE marked devices will be recognized in Great Britain without additional checks until June 2030 (though indefinite recognition is currently the subject of public consultation, as we have previously reported on).

New UK-U.S. Pharmaceutical Arrangement Includes MedTech. On April 2, 2026, the UK and U.S. finalized the landmark pharmaceutical partnership announced in December, which aims to give NHS patients faster access to innovative medicines while making the UK the first country in the world to secure zero tariff access for its pharmaceutical exports to the U.S. for at least three years. It has been confirmed that no additional U.S. tariffs will apply to UK HealthTech products for at least three years, providing welcome certainty for manufacturers. However, a notable imbalance remains, with HealthTech exports still subject to a 10% tariff, compared with the new zero tariff treatment for pharmaceuticals. Industry groups have stated they will continue to press officials on both sides of the Atlantic to address this discrepancy. Building on this agreement, the MHRA and FDA have also announced a deepening of regulatory cooperation on medical devices, including exploring future mutual recognition mechanisms to reduce duplication, streamline approval pathways, and accelerate access to safe, cutting edge medical technologies for patients in both countries, while maintaining independent, world class safety standards.

Team-NB Publishes Position Paper on Revisions of the EU Medical Devices and In Vitro Diagnostics Regulations. On March 2, 2026, Team-NB (the European association of notified bodies) published a position paper on the EC proposals to amend the MDR and the In Vitro Diagnostic Regulation 2017/746 (see our February 2026 Advisory for details on the proposals). Team-NB supports certain of the proposed measures, including increased digitalization (e.g., electronic documentation and labeling), earlier regulatory dialogue, and measures to support innovation (e.g., regulatory sandboxes for innovative technologies and combined studies). However, it identifies several concerns, in particular, reduced regulatory scrutiny (e.g., extended expiry dates) and implementation challenges in light of multiple ongoing regulatory initiatives. The position paper contributes to the ongoing legislative discussions on the revision of the MDR and IVDR.

Council of the European Union (Council) and European Parliament Each Adopt Their Position on the European Commission Proposal to Simplify the EU AI Rules. The proposal, part of the EU’s Digital Omnibus package, is aimed at simplifying the implementation of harmonized rules on AI under the EU AI Act. Both the EC and the European Parliament propose amendments to streamline various requirements, reduce administrative burdens, and provide more proportionate application of AI rules across EU Member States. Both institutes support the introduction of fixed application dates for high-risk AI tools: December 2, 2027, for standalone high-risk systems and August 2, 2028, for high-risk systems embedded in products subject to EU sectoral legislation. The EC’s position reinstates key compliance safeguards, including mandatory registration of AI systems deemed exempt from high-risk classification and the strict necessity standard for processing sensitive data for bias detection. The Council also requires the EC to issue guidance to support operators of high-risk AI systems in meeting their obligations while minimizing compliance burdens. The European Parliament favors a lighter application of AI Act obligations for products already regulated under sectoral laws (e.g., for medical devices). Interinstitutional negotiations between the European Parliament, the Council, and the European Commission (“trilogue negotiations”) will now commence to agree on the final form of the law.

UK MHRA Expands AI Airlock Program. The MHRA has secured a £3.6 million funding uplift to expand its AI Airlock program, the UK’s first regulatory sandbox for AI as a medical device. Since its launch in 2024, the program has identified several areas where AI medical devices raise new regulatory challenges. Following the completion of its second phase, the Department of Health and Social Care has committed £1.2 million per year over the next three years (2026-2029), allowing the program to move beyond the constraints of annual budgeting. This will enable the program to support more ambitious, longer-term testing models and strengthen the development of sustainable regulatory pathways for future AI medical technologies.

UK Parliament Launches Inquiry Into NHS Personalized Medicine and AI Innovation. The House of Lords Science and Technology Committee has opened an inquiry into innovation in the NHS, using personalized medicine and AI as case studies to understand why the health service struggles to adopt cutting-edge life sciences technologies. The inquiry will examine the scientific and technological foundations of personalized medicine, including developments in genomics, biotechnology, and AI-driven analytics, and will explore the research infrastructure needed to support their development and validation. It will assess gaps between early-stage research, clinical trials, and NHS-wide delivery, including procurement challenges, clinical pathway constraints, interoperability bottlenecks, and the role of regulators and clinical bodies. The committee will also consider whether regulatory and appraisal frameworks are appropriate and proportionate for AI-based and personalized technologies, as well as how NHS structural fragmentation contributes to uneven adoption. In addition, the inquiry will explore issues including the high cost of personalized treatments, the clinical academic workforce, and clinical trials infrastructure needed for rapid implementation across the NHS.

MedTech Europe Publishes Position Paper on the EC’s Proposal to Simplify the EU AI Rules. The position paper was submitted in response to the EC consultation on the Digital Omnibus package. While MedTech Europe supports the European Commission’s objective of improving regulatory coherence and simplifying EU digital legislation, it calls for greater clarity and targeted adjustments to ensure that the framework functions effectively for the medical technology sector. In particular, MedTech Europe calls for: (1) greater alignment with the MDR and the IVDR in relation to risk management, ensuring that AI related obligations do not duplicate or conflict with existing sector specific frameworks; (2) explicit confirmation that investigational devices under the MDR and devices used in performance studies under the IVDR are not considered “placed on the market” or “put into service” under the AI Act, to avoid such devices being subject to AI Act obligations; (3) a harmonized designation pathway for notified bodies, covering both the AI Act and sectoral medical device legislation; and (4) a longer transition period for the application of high-risk AI system obligations, extending the implementation timeline to two years, to allow sufficient time for the development of standards and guidance, and notified body capacity necessary for effective compliance.

UK Government Launches AI Pilots in Barnsley. The UK government has launched two AI pilot schemes in Barnsley, making it the UK’s first “tech town.” The schemes are aimed at improving NHS services and strengthening local AI and digital capacity. The first pilot centers on an £800,000 AI Upskilling Challenge Fund to provide targeted AI training to small- and medium-sized enterprises and residents who may lack digital confidence, with organizations invited to pitch for funding to deliver the training. The second pilot establishes a “Healthcare Living Lab” at Barnsley Hospital NHS Foundation Trust, to trial AI tools designed to cut waiting lists, reduce missed appointments, support clinical decision‑making, and ease administrative pressures on NHS staff. The initiatives are intended to form a blueprint for wider national adoption and are intended to reflect the government’s commitment to ensuring that the benefits of AI reach local communities and key industries across the UK.

Privacy Updates

European Data Protection Board and European Data Protection Supervisor Issue Joint Opinion 3/2026 on the European Commission Proposal for a Biotech Act. While the EDPB and EDPS broadly support the objectives of the EC proposal, they identify significant data protection concerns. In particular, they welcome the introduction of a harmonized legal basis under the General Data Protection Regulation (EU) 2016/679 (GDPR) for processing clinical trial data, which is intended to reduce fragmentation across EU Member States, but call for greater clarity on the scope and application of the legal basis, including more detailed protocol-level documentation, and clearer conditions for the further use of clinical trial data for scientific research.

The EDPB and EDPS also highlight important uncertainties around the allocation of controller roles between sponsors and investigators, and the scope of long-term data retention requirements. They further emphasize that, while regulatory sandboxes may allow for derogations from EU clinical trial requirements, this does not alter the application of existing obligations under the GDPR. The same applies to AI use and biotech data initiatives, which should be accompanied by appropriate safeguards, particularly where health and genetic data are involved. While non-binding, the Joint Opinion is expected to carry significant weight in the legislative negotiations. Find more details on the Joint Opinion in our March 2026 BioSlice Blog.

European Commission Publishes FAQ Guidance on EHDS Regulation Implementation. The EC has published guidance on frequently asked questions on the European Health Data Space (EHDS). The guidance explains that the aims of Regulation (EU) 2025/327 (EHDS Regulation) are to allow patients to have greater control over their health data, ensure secure cross border data sharing, and support health care delivery. The guidance also covers the relationship of the EHDS regulation with other areas of EU law, such as data protection, medical devices, and clinical trials.

IP Updates

EU and UK Copyright and AI Policy Developments. Following the UK government’s consultation on copyright and AI, which we reported on in our January 2025 Digest, the House of Lords Communications and Digital Committee published its report on March 6, 2026, followed by the UK government’s report and impact statement on March 18, 2026. At the EU level, the European Parliament adopted the “Voss Report” on March 10, 2026. Although the copyright and AI landscape remains largely unchanged with no immediate reform to copyright law, there are some notable takeaways:

  • Text and data mining exception: The UK government confirmed that a broad commercial text and data mining exception with an opt-out mechanism is no longer its preferred option and intends to gather further evidence before a final position is reached. 
  • Licensing models: A licensing-first approach draws consistent support across the EU and the UK, with the Lords Report recommending a model focused on consent and fair remuneration and the Voss Report calling for a sector-based voluntary licensing process. 
  • Transparency: The Lords Report proposes a mandatory transparency framework with granular disclosures on training data enforced by a designated regulator. Meanwhile, the Voss Report advocates itemized lists of all copyrighted works used in training, regardless of the place of training. 
  • Labeling: There is cross-jurisdictional consensus that AI developers, service providers, and platforms should be legally required to label wholly AI-generated content. 
  • Life sciences sector: The UK government expressly referenced the option of a focused exception for science and research to facilitate AI-driven research and accelerate drug discovery. 

The copyright and AI landscape await more definitive policy direction.

Fresh Doubts Over Patentability of AI-related Inventions in the UK. On March 27, 2026, the UK Intellectual Property Office (UKIPO) published an Examination Report in relation to the patent application (GB2583455) that was the subject of the Supreme Court judgment in Emotional Perception AI Limited v. Comptroller General of Patents, Designs and Trade Marks [2026] UKSC 3, as covered in our February 2026 Digest. The report confirms that the UKIPO will fully re-examine patentability, and expressed concerns over the application of the “intermediate step,” particularly in the analysis of “mixed-type inventions.” In its assessment that the invention lacks the necessary technical character and inventive step, the report casts new doubt on the UK’s approach to patentability of AI-related and computer-implemented inventions. The applicant, Emotional Perception AI Limited, has until April 27, 2026 to provide its reply

Product Liability Updates

UK Government Launches Consultations on New Product Safety Framework and Market Surveillance Rules. The UK government has launched two consultations on reforms to the product safety regime, with a strong emphasis on addressing risks arising from digital and AI‑enabled technologies. The first consultation sets out proposals for a new, modernized product safety framework, designed to ensure regulation keeps pace with increasingly complex digital products and connected devices. It highlights that traditional safety models are no longer adequate for technologies featuring software updates, connectivity, data driven functionality, or AI enabled behavior, and invites views on how the regime should identify and manage novel harms linked to digital features and AI enabled products. The second consultation focuses on strengthening the UK’s market surveillance and enforcement framework, proposing to consolidate dispersed enforcement powers into a single statutory instrument, introduce civil monetary penalties as an alternative to criminal prosecution, and ensure regulators have the tools needed to respond effectively to the challenges of digital supply chains and online marketplaces. Both consultations are open until June 23, 2026, and feedback can be submitted for the new product safety framework and for the market surveillance and enforcement consultation.

The MHRA has launched a consultation on proposed updates to the definition of gene therapy medicinal products (“GTMPs”) under the UK Human Medicines Regulations 2012 (“HMRs”). The current definition was originally developed in 2007, and was based on a smaller range of technologies. It is no longer considered to reflect the full range of modern gene therapy technologies now available, including therapies involving synthetic genetic material, new forms of genome editing, and highly engineered cells and tissues. This means there may not be a clear path to market for these technologies under the current legislation.

The proposals aim to address these limitations and align the regulatory framework with current scientific developments. The proposed reforms represent a targeted shift towards a more technology-neutral and mechanism-based approach. The proposals do not change the approval process, classification of existing products, or applicable safety and efficacy standards.

The MHRA is seeking input from stakeholders on whether the proposals are appropriate, proportionate and workable, including whether the revisions cover the correct categories of products, and whether these would cause any unintended consequences or operational challenges. The consultation is open until 22 June 2026 and feedback is requested in the form of a survey. Responses can be submitted online here.

Below, we outline the background, the key proposed changes, and the regulatory considerations that have shaped MHRA’s proposals.

Continue Reading MHRA launches consultation on modernising the definition of gene therapy medicinal products

On 11 May 2026, the Medicines and Healthcare products Regulatory Agency (“MHRA”) opened a call for evidence on proposed changes to pre-market medical device and in vitro diagnostic medical device (“IVD”) requirements in Great Britain (“GB”) under the Medical Device Regulations 2002 (“2002 Regulations”). The proposals are set out in the newly published draft Medical Devices (Amendment) Regulations 2026 (“Amending Regulations”). This call for evidence forms a critical part of the UK government’s process for assessing the real‑world implications of a major reform of GB’s medical devices regulatory framework.

These long awaited proposals, as referred to in the MHRA Roadmap published in December 2024, follow previous amendments made to the 2002 Regulations in June 2025, relating to post-market surveillance. Read about these amendments in our previous blog.

Below, we explain what the call for evidence is, why it matters, and provide an overview of some of the key regulatory proposals that stakeholders are being asked to comment on.

Continue Reading Draft UK Medical Device Amending Regulations: Key Proposals and MHRA Call for Evidence

On 7 May 2026, the European Parliament and Council announced a provisional political agreement on the AI Act portion of the Digital Omnibus package. According to the European Parliament’s press release and the Council’s press release, the agreement aims to make compliance more workable, while maintaining its main provisions and risk-based approach. The agreed text has not yet been published, and the agreement remains provisional pending formal adoption by both institutions, which co-legislators intend to complete before 2 August 2026, the date on which the AI Act’s original high-risk system obligations were due to become applicable.

This blog post sets out what the press release describes as having been agreed, and flags the points most relevant to pharmaceutical and MedTech companies. As we noted in our earlier analysis, the Digital Omnibus on AI Proposal carries significant implications for life sciences companies. We will provide a fuller assessment once the agreed text is available and adopted.

Continue Reading EU AI Act Omnibus: Provisional Deal Announced – Initial Reflections for Life Sciences Companies

Background

On 20 April 2026, the Law Commission, an independent organisation established to keep the law of England and Wales under review and recommend reform, announced a new project to consider the potential introduction of a consumer class actions regime in England and Wales. While independent, the Law Commission’s project is sponsored by the Department for Business and Trade (DBT), which is completing its review of the current competition collective (class) action regime that was introduced in the UK in 2015.  There has long been speculation that the government would use competition claims as a pilot before expanding the regime to consumer claims, including product liability and other claims, and this could be the first step in that process.

The Terms of Reference do not shed much further light on the project at this stage, aside from identifying that its purpose is to “set out the benefits and risks associated with the introduction of a collective class actions regime for consumer law claims…”.

However, it is a further signal that consumer protection and providing meaningful recourse for consumers has become a greater policy priority as it follows the recent implementation of the Digital Markets, Competition and Consumers Act 2024, which significantly overhauled UK consumer protection in digital markets, strengthening rights against fake reviews, drip pricing, subscription contract traps and other unfair practices.

This project will not consider substantive consumer rights but is instead squarely focussed on the design of a powerful new private enforcement mechanism to allow opt-out class actions to facilitate mass consumer claims in the UK.  This should be seen against a backdrop of growing pressure on the existing competition collective action regime where claimants have sought to characterise consumer law claims as competition claims in order to bring them before the Competition Appeal Tribunal (CAT) as an opt-out collective action.  The CAT has pushed back on this, reminding parties in one recent case that “competition law is not a general law of consumer protection”. A dedicated consumer class actions regime would remove the need for such creative framing and, in doing so, would significantly expand the pool of claims that can be brought on an opt-out basis.

If the Law Commission’s decision is to recommend the introduction of a class actions regime for consumer claims, then it will also make recommendations as to the design of such a regime.

Continue Reading The Law Commission of England & Wales announces a review of a potential new class actions regime

On 5 May 2026, the European Commission published an implementing regulation setting new procedural requirements for Notified Body assessments in medical device and IVD conformity assessment procedures (the “Implementing Regulation”). The Implementing Regulation aims to give manufacturers greater certainty in their interactions with Notified Bodies during the initial conformity assessment process and in post-market modifications and re-certifications, as well as aiming to avoid inconsistent practices between Notified Bodies.

To achieve these objectives, the Implementing Regulation sets maximum timelines for Notified Body assessments, provides for standardised rules around quotes by Notified Bodies for carrying out assessments and standardises certain information and verification requirements. The Implementing Regulation also requires each Notified Body to monitor and report on the duration and costs of its assessment activities. Manufacturers will, therefore, have better oversight of the performance of each Notified Body when selecting one to carry out an assessment.

The Implementing Regulation has been developed in response to the inconsistent and divergent interpretation of the procedures for Notified Body assessments under the EU Medical Devices Regulation 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation 2017/746 (IVDR), which makes the processes unpredictable for manufacturers.

The European Commission had previously published the implementing regulation in draft form in December 2025 and opened a consultation, which closed in January 2026.

Continue Reading EU implements new rules on uniform procedural requirements for Notified Body assessments

Introduction

Assays used in clinical trials vary widely in complexity and regulatory status.. They may be fully developed and marketed as in vitro diagnostic medical devices (IVDs), including companion diagnostics (CDx), that clearly fall within the scope of the EU In Vitro Diagnostic Regulation (IVDR) and/or the UK Medical Devices Regulations 2002 (UK MDR). Alternatively, they may be bespoke assays created specifically for use in a given clinical trial or in connection with an investigational medicinal product (IMP).

Continue Reading Navigating IVD Regulation in Clinical Trials: A Comparative EU and UK Guide

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during February and early March 2026 from the the United Kingdom, and European Union.

February 2026 saw a period of substantial regulatory activity across both the UK and EU, particularly in relation to AI governance, medical technologies, and data protection. In the UK, the policy landscape continued to evolve with initiatives affecting the regulation of medical devices, clinical research, and AI deployment. Key developments included the Medicines and Healthcare products Regulatory Agency’s (MHRA) consultation on the indefinite recognition of CE-marked medical devices, record levels of medical device testing, and the Prescription Medicines Code of Practice Authority’s (PMCPA) revised guidance on the use of social media. AI remained a major focus in the UK, with the UK government’s response to the consultation on the AI Management Essentials tool, increased industry involvement in the UK AI Security Institute’s alignment program, and feedback relating to governmental research on AI adoption across UK businesses. Additional international collaboration efforts included UK engagement at the India AI Impact Summit and an expanded science and technology partnership with Japan, as well as the launch of the first-ever AI Strategy for UK Research and Innovation.

Continue Reading Virtual and Digital Health Digest – February 2026

On 19 March 2026, the Court of Justice of the European Union (CJEU or Court) issued its judgment in Case C-526/24, Brillen Rottler GmbH & Co. KG v TC. The case concerned a data subject who subscribed to a German optician’s newsletter and, thirteen days later, submitted an access request under Article 15 GDPR. The company refused the request, arguing it was abusive. The data subject maintained it was legitimate and claimed at least €1.000 in non-material damages.

The CJEU’s judgment addresses three questions of broad significance: (1) when a first access request can be refused as “excessive”; (2) whether a violation of the right of access alone can give rise to a compensation claim under Article 82 GDPR; and (3) how non-material damage should be assessed in that context. While the judgment is relevant to all companies subject tot GDPR, we examine below the considerations it raises for life sciences companies specifically.

Continue Reading CJEU rules on GDPR access rights and abuse of rights: what the Brillen Rottler judgment means for life sciences companies

On 16 December 2025, the European Commission published its Proposal for a Regulation establishing a framework of measures for strengthening the EU’s biotechnology and biomanufacturing sectors, particularly in the area of health (the “European Biotech Act” or the “Proposal”). The Proposal is ambitious in scope: it amends several major pieces of EU health legislation, including the Clinical Trials Regulation (“CTR”), the Veterinary Medicines Regulation, the Food Law Regulation and the Substances of Human Origin Regulation (“SoHO”), while also introducing a new framework for EU strategic projects, AI-enabled biotechnology, and biodefence.

On 10 March 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) adopted Joint Opinion 3/2026 on the Proposal (the “Joint Opinion”). While broadly supportive of the Proposal’s objectives, the EDPB and EDPS identified a number of significant data protection concerns, and issued recommendations. Although not legally binding, the Joint Opinion carries significant weight as it reflects the views of the EU’s primary data protection authorities and will directly shape the legislative debate ahead.

In this blog we examine the key data protection implications of the Proposal and the Joint Opinion for pharma and life sciences companies.

Continue Reading EDPB/EDPS Joint Opinion on the European Biotech Act Proposal: Key Data Protection Implications for Pharma and Life Sciences