On 23 September 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy €7 million under the GDPR. The decision concerns a database of patient records collected from around 800 general practitioners and covering around a million patients. IQVIA used the database for observational studies requested by pharmaceutical companies. IQVIA treated the data as anonymous. The Garante did not agree with this classification and considered that the data is, instead, pseudonymised patient-level personal data that is subject to the GDPR.

This decision by the Garante is particularly interesting. As we discussed in our earlier post on the EU Digital Omnibus, the EU is in the middle of a wider effort to simplify its digital rulebook. One of the changes on the table in the Digital Omnibus is a narrower concept of personal data, so that coded data in the hands of a company that has no realistic way of identifying who the patients are would fall outside the scope of the GDPR. The Garante decision shows, however, that, in the meantime, regulators are  taking a strict and conservative approach to what constitutes personal data.

Continue Reading Pseudonymised, Not Anonymous: What the Italian Garante’s €7 Million IQVIA Fine Means for Health Data

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during August 2026 from the EU and UK.

The more significant developments this month have been in the data protection space. Notably, Uber was fined almost €825 million following a finding that they breached the general prohibition on fully automated decision-making in the General Data Protection Regulation (GDPR). This decision serves as an important reminder for the need for meaningful human review in the Life Sciences industry as companies increasingly rely on AI-assisted decision-making, for example in screening candidates for eligibility to take part in clinical trials.

Further, the European Data Protection Board (EDPB) has written to the European Commission to request that the commission “closely assess” the recent U.S. Supreme Court decision of Trump v. Slaughter and its impact on the EU-U.S. Data Privacy Framework (DPF) adequacy decision. The EDBP has raised that this decision, which holds that the statutory protection against removal of Federal Trade Commissioners are unconstitutional, may affect the validity of the DPF decision.

Other developments include that the International Medical Device Regulators Forum (IMDRF) has published technical guidance regarding Predetermined Change of Control Plans (PCCP) for medical device software. This guidance intends to foster regulatory harmonization by identifying the essential principles for developing PCCP. 

Continue Reading Virtual and Digital Health Digest – September 2026

The EU institutions have now published the updated text on the reform of the EU pharmaceutical legislation and the new Directive [link] and Regulation [link]. Formal adoption by the European Parliament and the Council is expected in the coming months. 

The publication follows the provisional political agreement on the text reached by the European Union Institutions on 11 December 2025, and the votes by the European Parliament and Council in March 2026.

We set out below some of the key elements of the provisional text. A more detailed advisory will follow.

Continue Reading Final text of the reform to the EU Regulatory Framework for Medicinal Products published

On 30 June 2026, the UK government introduced the Immigration and Asylum Bill (the Bill), proposing the most significant reforms to the Modern Slavery Act 2015 (the MSA) since its enactment. The MSA’s transparency-in-supply-chains regime relies on voluntary disclosure is subject to very limited  enforcement; the Bill would move the regime towards mandatory reporting, stronger corporate accountability and material sanctions for non-compliance.

Continue Reading Reform of UK Modern Slavery Act’s Supply Chain Reporting Regime

On 3 September 2026, Advocate General Kokott delivered a significant Opinion in Case C‑193/25, Poland v Parliament and Council, recommending the annulment of the provisions of the revised Urban Waste Water Treatment Directive 2024/3019 (UWWTD) that require pharmaceutical and cosmetics producers to finance 80% of the costs of quaternary wastewater treatment. While the AG accepts the legitimacy of applying the polluter-pays principle to micropollutants in wastewater, she concludes that the EU legislature failed adequately to substantiate the scientific basis for selecting  those industries to pay 80% of the costs.

Continue Reading AG Kokott recommends annulment of Urban Wastewater Directive’s pharmaceutical and cosmetics levy

The CJEU has delivered a preliminary ruling in Case C-427/24 Diagramm Halbach, which provides guidance on determining whether a product is a medical device within the meaning of Regulation (EU) 2017/745 (“MDR”). The judgment confirms that the manufacturer’s advertising of a product is not necessarily decisive in determining whether it has a “medical purpose” within the definition of “medical device” under the MDR, and that the product must also objectively perform one (or more) of those medical purposes to fall within that definition. The judgment also provides guidance on what constitutes a solely administrative function that does not fall within those medical purposes. The decision has the potential to guide other classification decisions of borderline products used in the healthcare sector.

Continue Reading CJEU ruling clarifies scope of medical device definition

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during July and early August 2026 from the EU and UK.

During July 2026, regulators in the EU and UK continued to focus on the practical implementation of AI and digital health regulation.

In the EU, the Digital Omnibus on AI introduced the first substantive amendments to the AI Act, while policymakers and industry groups turned their attention to how AI requirements will interact with existing frameworks. This included new principles on the use of AI in Joint Clinical Assessment dossiers under the Health Technology Assessment Regulation, the European Federation of Pharmaceutical Industries and Association’s (EFPIA) call for trusted AI testing environments and proportionate AI governance in its response to the Biotech Act consultation, and further debate on the treatment of software and AI-enabled technologies in the ongoing Medical Device Regulation (MDR)/In Vitro Diagnostic Regulation (IVDR) revision. Together, these developments reflect a growing focus on ensuring that AI-specific requirements integrate effectively with existing regulatory frameworks.

In the UK, regulators published a series of guidance documents addressing questions about when AI-enabled products qualify as medical devices and how they should be regulated. New Medicines and Healthcare products Regulatory Agency (MHRA) guidance on ambient voice technologies and updated guidance on digital mental health technologies provide greater clarity on the medical device boundary, while additional outputs from the AI Airlock program highlight the challenges associated with qualification, intended purpose, and lifecycle management of AI systems. These developments suggest that regulators are increasingly focused on addressing practical implementation questions.

Continue Reading Virtual and Digital Health Digest – August 2026

On 1 July 2026, the Rapporteur in the European Parliament’s Committee on Public Health (SANT) published his draft report (the Draft Report) in response to the Commission’s proposal to amend Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) (the Commission Proposal). The details of the Commission Proposal are discussed in our December 2025 BioSlice blog post. The Draft Report contains over 130 suggested amendments to the Commission Proposal, giving an indication of what amendments the Parliament may target in the legislative process for the MDR/IVDR revision. The Report is therefore informative reading for industry on what amendments may ultimately be made to the MDR and IVDR.

The Draft Report, and the discussion of it in the SANT Committee, highlights that the Parliament is broadly supportive of the Commission’s attempts to promote a more proportionate regulatory framework. However, the proposed amendments would provide further simplification in some areas, while reintroducing obligations for manufacturers in others.

We discuss some of the key amendments proposed in the Draft Report below.

Continue Reading How will the EU Parliament shape the MDR/IVDR revision? Draft report indicates how Parliament may seek to amend Commission’s proposals

Since 12 September 2025, the EU Data Act (Regulation (EU) 2023/2854, the “EU Data Act”) has required manufacturers of connected products and providers of related services to make in-scope data accessible to users, whether through direct or indirect access mechanisms. On 12 September 2026, a further dimension of that obligation becomes applicable: new connected products and related services placed on the EU market after that date must be designed with direct access capabilities built in by default, where relevant and technically feasible. Because the obligation to provide direct access is explicitly not absolute, manufacturers that already offer users indirect access through a portal or account may find that the practical change is limited.

The September 2026 date is nonetheless a valuable opportunity for companies, including those in the life sciences sector, to review their compliance position: not only on access by design, but across the broader set of EU Data Act obligations that have been applicable for almost a year and are now increasingly attracting scrutiny from marketplaces, customers, and emerging national enforcement bodies.

Continue Reading The EU Data Act’s Access-by-Design Deadline: What Life Sciences Companies Need to Know Before September 2026

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during June and early July 2026 from the United Kingdom and European Union.

AI continues to be at the top of the agenda for regulators in Europe. The European Commission (EC) has been focused on preparing for the majority of the provisions in the AI Act to come into force this August. Among those provisions are the transparency requirements, and to assist organizations with compliance, the EC has published a voluntary Code of Practice on the marking and labeling of AI-generated content. Further, a Scientific Panel and an Advisory Forum have been appointed to advise the EC’s AI Office and national competent authorities on implementation and enforcement of the AI Act.

In the UK, we are seeing a continued commitment to regulating AI through guidance and codes of practice, as well as the provision of regulatory support through sandbox programs. The Information Commissioner’s Office (ICO), the data protection regulator, has published its plan for upcoming work in relation to AI, which sets out various plans for guidance and codes of practice. The Medicines and Healthcare products Regulatory Agency (MHRA) continues its focus on regulatory sandboxes and recently reported the outcome of the second phase of the AI Airlock. It has also announced further AI sandboxes in order to accelerate the development of medicines and to allow innovators to test AI tools that have the potential to predict how medicines behave in the body, and another, which will be London-focused.

The key legislative development this month is that the EU Council has adopted its position on the first part of the Biotech Act, which, together with the European Commission’s draft, will form the basis of the trilogue discussions between the European Union (EU) institutions, hopefully leading to agreement on a finalized text. 

Continue Reading Virtual and Digital Health Digest – July 2026