Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during June and early July 2026 from the United Kingdom and European Union.
AI continues to be at the top of the agenda for regulators in Europe. The European Commission (EC) has been focused on preparing for the majority of the provisions in the AI Act to come into force this August. Among those provisions are the transparency requirements, and to assist organizations with compliance, the EC has published a voluntary Code of Practice on the marking and labeling of AI-generated content. Further, a Scientific Panel and an Advisory Forum have been appointed to advise the EC’s AI Office and national competent authorities on implementation and enforcement of the AI Act.
In the UK, we are seeing a continued commitment to regulating AI through guidance and codes of practice, as well as the provision of regulatory support through sandbox programs. The Information Commissioner’s Office (ICO), the data protection regulator, has published its plan for upcoming work in relation to AI, which sets out various plans for guidance and codes of practice. The Medicines and Healthcare products Regulatory Agency (MHRA) continues its focus on regulatory sandboxes and recently reported the outcome of the second phase of the AI Airlock. It has also announced further AI sandboxes in order to accelerate the development of medicines and to allow innovators to test AI tools that have the potential to predict how medicines behave in the body, and another, which will be London-focused.
The key legislative development this month is that the EU Council has adopted its position on the first part of the Biotech Act, which, together with the European Commission’s draft, will form the basis of the trilogue discussions between the European Union (EU) institutions, hopefully leading to agreement on a finalized text.
Regulatory Updates
Council of the European Union (Council) Adopts Position on the EU Biotech Act I. The Council of the European Union has adopted its general approach on the European Commission’s proposed Biotech Act Part I (For more details on the European Commission proposal, read our January 2026 Digest). This general approach will serve as its negotiating mandate for trilogue discussions with the European Parliament, should they take place. Among the key amendments, the Council has clarified that, in the context of the processing of personal data, it may be considered to be carried out in the public interest where necessary to ensure patient safety, maintain high health care standards, or support cross-border analysis of transplant outcomes.
European Federation of Pharmaceutical Industries and Associations (EFPIA) Publishes Its Position on the EC-Proposed EU Biotech Act Part I. The position welcomes key measures proposed by the EC, including a harmonized General Data Protection Regulation (EU) 2016/679 (GDPR) legal basis for clinical trial data processing, clearer and harmonized responsibilities regarding controllership of data under the GDPR, and the possibility for further use of clinical trial data for research purposes under certain conditions. At the same time, EFPIA calls for risk-based guidance from the European Medicines Agency and the European Medicines Regulatory Network on the use of AI models and systems.
European Commission Publishes Code of Practice on Marking and Labeling AI-Generated Content. The code is voluntary, but it sets out practical steps to help providers and deployers of generative AI systems meet the AI Act transparency obligations that will apply from August 2, 2026. The AI Act will require clear labeling, particularly for deepfakes and AI-generated or AI-manipulated text published on matters of public interest. The European Commission has also created a set of icons that deployers may use to label their AI-generated content. Providers and deployers of generative AI systems may sign up to the code using the signatory form.
European Commission’s Medical Device Coordination Group (MDCG) Publishes Position Paper on Manufacturer Responsibility to Upload Summary of Safety and Clinical Performance (SSCP) and Summary of Safety and Performance (SSP) Documents in EUDAMED. The position paper clarifies the future responsibilities for uploading the SSCP and SSP to EUDAMED, the EU centralized database for medical devices and in vitro diagnostics. Under the current process, the SSCP and SSP documents are uploaded by the Notified Body when registering certificate information. The MDCG guidance MDCG 2019-9 Rev. 1 is being revised such that the manufacturer will have responsibility for uploading the SSCPs and SSPs in EUDAMED. It will also be the responsibility of the manufacturer to ensure the uploaded SSCP or SSP is the one validated by the Notified Body. The MDCG foresees a transition period whereby Notified Bodies will continue uploading the validated master SSCPs and SSPs until the new functionality is available in October 2026.
MedTech Europe Reaction to Provisional Agreement on the AI Digital Omnibus. MedTech Europe has reacted to the Digital Omnibus package that was presented by the European Commission in November 2025, aiming to streamline rules on AI, cybersecurity, and data. MedTech Europe advocates for a sectoral approach for medical devices to avoid overlapping obligations. However, the provisional agreement does not include a sectoral approach for medical technologies, which remain subject to parallel requirements under both the AI Act and the Medical Devices Regulation 2017/745 (MDR)/In Vitro Diagnostic Regulation 2017/746 (IVDR). Some of MedTech Europe’s other recommendations have been implemented, such as the postponement of the application of AI Act requirements for high-risk AI systems embedded in products, including medical technologies, from August 2026 to August 2028.
European Commission Appoints a Scientific Panel and an Advisory Forum to Support AI Act Enforcement. The two bodies will advise the European Commission’s AI Office and national competent authorities on the implementation and enforcement of the AI Act. The Scientific Panel, comprising 60 independent experts, will provide advice on matters relating to, among others, general-purpose AI models and systems, systemic risks, model classification, evaluation methodologies, and cross-border market surveillance. The Advisory Forum, comprising representatives from academia, civil society, and industry, including small and medium-sized enterprises and startups, will provide advice on matters relating to, among others, standardization, AI literacy, and AI Act implementation.
UK MHRA Launches AI Sandboxes to Accelerate Medicines Development. The MHRA has launched an initiative to test how AI can accelerate medicines development and improve safety. The program will allow innovators to test AI tools that have the potential to predict how medicines behave in the body, including how they are absorbed, processed, and whether they may cause harm. The MHRA intends to use this work to understand how reliable these AI tools are and whether they can be used to support decisions about the safety of new medicines. Up to five AI-driven approaches will be tested in the first phase. The MHRA will begin working with industry and academic partners over the coming months to shape how the sandbox operates. In addition, the MHRA is launching a similar sandbox focused on London for up to 10 AI manufacturers, and will invite expressions of interest from AI medical device manufacturers in July 2026.
UK MHRA Publishes Report on AI Airlock Sandbox Phase 2. The MHRA has published its report of Phase 2 of the AI Airlock regulatory sandbox, alongside three simulation workshop summary reports. The program ran from April 2025 to March 2026 and worked with seven AI technologies across a range of clinical applications, including AI-powered clinical note-taking, advanced cancer diagnostics, rare eye disease detection, and obesity management systems. In a MedRegs blog post, the MHRA notes that pre-market evidence needs to be designed with deployment conditions in mind, and post-market monitoring is critical for these technologies. The MHRA also states that clinical relevance should underpin performance metrics, as a consistent finding across candidate cases was that statistical significance did not always equate to clinical importance. The insights from the AI Airlock pilot phase were reported in the November 2025 Digest.
UK MHRA Publishes Findings on National Commission’s Research Into the Use of AI in Healthcare. The MHRA has published two reports summarizing the findings from the research and engagement activities of the National Commission into the Regulation of AI in Healthcare, as well as the outcome of the associated Call for Evidence (which we initially reported on in the December 2025 Digest). In a press release, the MHRA says the overarching view from the engagement is a recognition of the potential benefits of AI in healthcare, provided that rules appropriately set standards for safety and efficacy. The MHRA also says there is a broad consensus that existing regulatory approaches need to be adapted to meet the rapid pace of change and development of AI technology. These reports will inform the AI commission’s recommendations, which are due to be published later this year to assist the MHRA in shaping rules that protect patients and support innovation.
UK MHRA Publishes Blog Post on Use of AI in GxP Inspection Responses. The MHRA has published a blog post on its position on the use of AI in submissions made to its compliance teams following GxP inspections. The post acknowledges that AI tools can support better regulatory outcomes and improve patient safety, but the agency has encountered responses containing references to MHRA guidance that does not exist, citations of inappropriate regulatory frameworks, and responses to serious deficiencies that appear designed to mislead rather than address underlying problems. The MHRA sets out several clarifications, stressing that all submissions must be accurate and supported by evidence. It also offers organizations the opportunity to voluntarily disclose AI use in responses to compliance teams, to help the MHRA understand how the sector is evolving. The MHRA says inspectors will consider this disclosure positively when assessing organizational compliance.
Pricing and Reimbursement Updates
UK Government Publishes Guidance for NHS Buyers Assessing Medical Technology. The UK government has published guidance for National Health Service (NHS) buyers on “value based procurement” when buying medical technology. The guidance provides a standard set of questions and scoring criteria to help assess the wider value of the technology, not just its purchase price. These other value criteria include benefits for productivity and efficiency in hospitals, patient experience and outcomes, staff experience and safety, the environment, and supply chain resilience. The guidance is intended for use at the quality assessment stage of the procurement process.
Privacy Updates
UK ICO Sets Out AI Workplan Priorities in Response to Government Request. On May 29, 2026, the ICO published its response to a joint request from the Technology and Business Secretaries to set out a plan for enabling safe AI-powered innovation. The response builds on the ICO’s June 2025 AI and biometrics strategy and confirms that its 2026/2027 workplan will focus on: developing an AI and automated decision-making (ADM) statutory code of practice (informed by the ADM consultation which closed on May 29, 2026, with final guidance due Summer 2026); publishing dedicated guidance on agentic AI; and supporting consumers navigating an increasingly personalized AI landscape. This is relevant to life sciences companies deploying AI-enabled tools in clinical, diagnostic, or patient-facing contexts, an area the ICO has previously flagged as a priority.
UK ICO Publishes Final Guidance on Consumer IoT Products and Services. On June 11, 2026, the ICO published its finalized guidance on consumer Internet of Things (IoT) products and services, following a 12-week consultation held last year. The guidance covers smart speakers, connected televisions, fitness trackers, wearables, smart doorbells, and other consumer connected devices, and applies to manufacturers, app developers, operating system providers, and cloud providers in the IoT supply chain (it does not cover smart meters, connected/autonomous vehicles, or enterprise/industrial IoT). It sets out expectations that privacy be built in by default, that consent be specific and as easy to withdraw as to give, and that most IoT processing will require a Data Protection Impact Assessment, with an even higher bar where children are likely users. This is relevant for life sciences companies developing consumer-facing wearables or health-monitoring devices that sit outside the medical device regulatory perimeter. The ICO has confirmed it is now turning its attention to connected televisions.