Regulatory activity in the EU and UK over the past month has focused on AI in health care, health data access, and digital innovation frameworks. Recent regulatory developments in the EU and UK point to a decisive shift from high level policy ambition to the practical mechanics of enabling AI driven health care, with particular emphasis on health data governance, regulatory pilots, and institutional readiness.
At the EU level, attention is increasingly focused on building durable frameworks to support innovation while maintaining regulatory confidence. The European Medicines Agency is preparing to pilot enhanced regulatory support for breakthrough medical devices and in vitro diagnostics (IVD), an initiative expected to shape future reforms of the EU medical device and IVD regimes. In parallel, the European Commission has taken further steps to operationalize the European Health Data Space (EHDS) through new implementing rules on the governance of the European Health Data Space Board, signaling a move from legislation to execution. The European Data Protection Board (EDPB) has also issued draft guidelines on the application of the General Data Protection Regulation (GDPR) to scientific research, offering long awaited clarification on lawful bases, consent models, and secondary use of data, issues that are central to data intensive research and AI development and likely to influence practice across Member States once finalized.
In the UK, scrutiny has centered on whether existing data and regulatory structures are capable of supporting personalized medicine and AI at scale. Evidence to the House of Lords Science and Technology Committee highlighted the UK’s rich but underexploited health data assets and the persistence of access barriers since the pandemic, with witnesses pointing to fragmented governance and delays in data access as ongoing constraints. At the same time, the expansion of the Medicines and Healthcare products Regulatory Agency’s (MHRA) AI Airlock program, continued work by the National AI Commission, and targeted support for AI driven drug discovery reflect a more iterative, test and learn approach to AI regulation, focused on post market oversight rather than wholesale reform.
Regulatory Updates
European Medicines Agency (EMA) Will Launch Pilot to Support Breakthrough Medical Devices and IVDs. The pilot is expected to be launched in the second quarter of 2026 to support breakthrough medical devices and IVDs, with the objective of testing a pathway that accelerates patient access to highly innovative technologies while maintaining the EU’s high standards for safety and performance. Under the pilot, manufacturers of devices granted designated breakthrough will benefit from enhanced regulatory support, including priority scientific advice from EMA- administered medical device expert panels. The initiative builds on the MDCG 2025-9 Guidance on Breakthrough Devices adopted by the Medical Device Coordination Group (MDCG) in December 2025. Importantly, the pilot is intended to inform and shape a future EU breakthrough devices framework proposed by the European Commission in its December 2025 legislative revisions to Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), including the introduction of new Article 52a of the MDR and new Article 48a of the IVDR. As such, the pilot represents a key step in strengthening an innovation friendly regulatory environment for medical technologies within the EU.
IMDRF Opens Public Consultation on a Draft Technical Framework for AI Lifecycle Management.The framework builds on the IMDRF’s previously published Good Machine Learning Practice guiding principles and sets out an internationally harmonized set of considerations and concepts spanning the entire life cycle of AI-enabled medical devices, from design and development through deployment, performance monitoring, and change management. The framework is intended primarily for manufacturers of AI-enabled medical devices, including those incorporating machine learning, and recognizes that devices using generative, autonomous, or adaptive AI technologies may require additional or heightened considerations. It aims to promote harmonized concepts and regulatory considerations across jurisdictions by describing common terminology, risk based concepts, and life cycle practices that authorities may align with their own regulatory frameworks. The document is non-binding and is not intended to serve as regulation or jurisdiction-specific guidance. The IMDRF invites stakeholder feedback on the draft until July 10, 2026.
MHRA Announces Expansion of Its AI Airlock Program, Along With Major Additional Funding. The MHRA has secured a £3.6 million multi-year funding uplift to expand its AI Airlock program, the UK’s first regulatory sandbox for artificial intelligence as a medical device (AIaMD). As reported in the November 2025 Digest, Phase two of the program explored the challenges of regulating AI-powered diagnostics. Following the conclusion of the second phase, the Department of Health and Social Care has committed £1.2 million per year over the next three years (2026 to 2029). The MHRA anticipates that it will be able to support more ambitious and longer-term testing models. Reporting is expected in summer 2026, along with the findings from the pilot phase, informing the design of phase three.
UK National AI Commission Publishes Blog on the Future of AI in Health Care. Professor Henrietta Hughes, the Patient Safety Commissioner, has authored a blog post on the work of the National AI Commission into the regulation of AI in health care. She provides insight into the responses received to the call for evidence, aimed at helping to inform the commission with its recommendations. The post refers to concerns raised in responses to the call for evidence, including the post-market monitoring of AIaMD, uncertainty around liability when AI is involved in clinical decision-making, and the need for strong safeguards alongside innovation. Broader engagement work, including MHRA-led sector roundtables involving over 30 organizations and 117 clinicians, showed that the public is more comfortable with AI supporting clinicians than making high-stakes decisions independently. The commission’s recommendations are on track to be published in Summer 2026.
UK’s Government-Backed Sovereign AI Unit Announces Support for Companies Pioneering AI in Drug Discovery. Sovereign AI is the UK’s £500 million national initiative to support promising AI companies to start, scale, and compete globally from the UK. Designed to operate like a venture capital fund with the backing of the state, the Unit combines direct investment with a comprehensive support package, including fully funded access to the UK’s largest AI supercomputers and hands-on government support navigating data access, procurement, product validation, and routes into new regulatory approaches. The first companies to receive support include a company using AI to tackle brain diseases such as Alzheimer’s and Parkinson’s, and a company developing a foundation model for AI-driven strain design in engineering biology and biomanufacturing. In addition, several startups are receiving access to the AI Research Resource supercomputer network, enabling them to train advanced models and scale cutting edge AI technologies on sovereign UK infrastructure.
UK MHRA Strengthens Its Digital Health and Technology Expertise With New Appointment From the U.S. Centers for Disease Control and Prevention. It has been announced that Jason Bonander will join the MHRA as Chief Digital and Technology Officer from late May 2026, bringing extensive experience from his role as Chief Information Officer at the U.S. Centers for Disease Control and Prevention. In his new role at the MHRA, he will work to modernize the MHRA’s services and platforms to support efficiency, transparency, and faster regulation.
House of Lords Science and Technology Committee Holds Further Oral Evidence Sessions on Personalized Medicine and AI as Part of Its Inquiry Into NHS Innovation. On April 14, 2026, evidence was heard from Professor Andrew Morris (Director of Health Data Research UK) and Professor Cathie Sudlow (Director of the Usher Institute, University of Edinburgh, and author of the 2024 “Uniting the UK’s Health Data” review). Both witnesses highlighted that the UK possesses uniquely rich health data assets but continues to under-utilize their value due to fragmented access arrangements and persistent barriers to the linkage of individual level datasets, which they described as essential to enabling large scale research, innovation, and the effective deployment of AI. The work during the pandemic was praised as a proof-of-concept for how data can be leveraged at scale. However, it was noted that since then, access barriers to health data for bona fide research purposes have become more difficult, with delays, inconsistent decision making, and uncertainty in approval routes deterring researchers and innovators. The newly established Health Data Research Service (HDRS) was broadly welcomed as a potential national coordinating body for data access and governance. Key recommendations included treating health data as critical national infrastructure, streamlining the legal framework for data access, closing the primary care data gap, embedding continuous public engagement, and fostering public trust through transparency.
Privacy Updates
European Data Protection Board Adopts Guidelines 1/2026 on Processing of Personal Data for Scientific Research Purposes. The guidelines provide clarification on how the General Data Protection Regulation (EU) 2016/679 (GDPR) applies for scientific research purposes. In particular, the guidelines clarify the scope of “scientific research” under the GDPR and introduce six indicative factors (e.g., adherence to ethical standards, societal objectives), which, if met, create a presumption that an activity constitutes scientific research under the GDPR. The guidelines also provide guidance on the legal bases for data processing, and confirm that data controllers may rely on broad consent and dynamic consent, or a combination of both, under certain conditions. In addition, the guidelines confirm that further processing of the data for scientific research purposes is presumed compatible with the original purpose of collection under Article 5(1)(b) GDPR, and that personal data may be stored for longer periods of time for scientific research purposes, even if the original purposes for processing the data have been fulfilled. The EDPB has opened a public consultation on the guidelines, which closes on June 25, 2026.
European Commission Adopts Implementing Regulation (EU) 2026/771 on the EHDS. The Implementing Regulation sets out the rules for the implementation of the EHDS Regulation (EU) 2025/327 (see our March 2025 Advisory) in regard to the establishment, management, and functioning of the EHDS Board. The EHDS Board, which will be composed of representatives from EU Member States and the European Commission, will serve as a forum for cooperation and exchange of information among EU Member States. Some responsibilities of the EHDS Board include supporting the consistent implementation of the EHDS Regulation across EU Member States, and issuing guidance and opinions to national competent authorities and other stakeholders involved in the implementation of the EHDS Regulation.
UK Information Commissioner’s Office (ICO) Finalizes Guidance on Storage and Access Technologies (SATs). This guidance covers how the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR apply to cookies, tracking pixels, and device fingerprinting, reflecting changes introduced by the Data (Use and Access) Act 2025. It is intended to provide clarification on the law as it currently stands and is separate from the ICO’s ongoing work to review Regulation 6 of PECR for online advertising purposes. This guidance is relevant to life sciences companies operating patient-facing digital platforms, apps, and wearable device interfaces that use tracking technologies.