Photo of Alexander Roussanov

Alexander Roussanov

Subscribe to Alexander Roussanov's Posts
Contact:Read more about Alexander Roussanov

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during February and early March 2026 from the the United Kingdom, and European Union.

February 2026 saw a period of substantial regulatory activity across both the UK and EU, particularly in relation to AI governance, medical technologies, and data protection. In the UK, the policy landscape continued to evolve with initiatives affecting the regulation of medical devices, clinical research, and AI deployment. Key developments included the Medicines and Healthcare products Regulatory Agency’s (MHRA) consultation on the indefinite recognition of CE-marked medical devices, record levels of medical device testing, and the Prescription Medicines Code of Practice Authority’s (PMCPA) revised guidance on the use of social media. AI remained a major focus in the UK, with the UK government’s response to the consultation on the AI Management Essentials tool, increased industry involvement in the UK AI Security Institute’s alignment program, and feedback relating to governmental research on AI adoption across UK businesses. Additional international collaboration efforts included UK engagement at the India AI Impact Summit and an expanded science and technology partnership with Japan, as well as the launch of the first-ever AI Strategy for UK Research and Innovation.Continue Reading Virtual and Digital Health Digest – February 2026

On 19 March 2026, the Court of Justice of the European Union (CJEU or Court) issued its judgment in Case C-526/24, Brillen Rottler GmbH & Co. KG v TC. The case concerned a data subject who subscribed to a German optician’s newsletter and, thirteen days later, submitted an access request under Article 15 GDPR. The company refused the request, arguing it was abusive. The data subject maintained it was legitimate and claimed at least €1.000 in non-material damages.

The CJEU’s judgment addresses three questions of broad significance: (1) when a first access request can be refused as “excessive”; (2) whether a violation of the right of access alone can give rise to a compensation claim under Article 82 GDPR; and (3) how non-material damage should be assessed in that context. While the judgment is relevant to all companies subject tot GDPR, we examine below the considerations it raises for life sciences companies specifically.Continue Reading CJEU rules on GDPR access rights and abuse of rights: what the Brillen Rottler judgment means for life sciences companies

On 16 December 2025, the European Commission published its Proposal for a Regulation establishing a framework of measures for strengthening the EU’s biotechnology and biomanufacturing sectors, particularly in the area of health (the “European Biotech Act” or the “Proposal”). The Proposal is ambitious in scope: it amends several major pieces of EU health legislation, including the Clinical Trials Regulation (“CTR”), the Veterinary Medicines Regulation, the Food Law Regulation and the Substances of Human Origin Regulation (“SoHO”), while also introducing a new framework for EU strategic projects, AI-enabled biotechnology, and biodefence.

On 10 March 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) adopted Joint Opinion 3/2026 on the Proposal (the “Joint Opinion”). While broadly supportive of the Proposal’s objectives, the EDPB and EDPS identified a number of significant data protection concerns, and issued recommendations. Although not legally binding, the Joint Opinion carries significant weight as it reflects the views of the EU’s primary data protection authorities and will directly shape the legislative debate ahead.

In this blog we examine the key data protection implications of the Proposal and the Joint Opinion for pharma and life sciences companies.Continue Reading EDPB/EDPS Joint Opinion on the European Biotech Act Proposal: Key Data Protection Implications for Pharma and Life Sciences

Today, 6 March 2026, the Council of the European Union (“Council”) published the provisional agreement on the reform of the EU pharmaceutical legislation and the new Directive [link] and Regulation [link]. Formal adoption by the European Parliament and the Council is expected in the coming months. Continue Reading Provisional text of the political agreement on the reform to the EU Regulatory Framework for Medicinal Products is published

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during December 2025 and early January 2026 from the the United Kingdom, and European Union.

January 2026 saw significant activity as UK and EU authorities advanced major initiatives affecting the use of AI, digital technologies, data governance, and cybersecurity in healthcare and life sciences. Notable developments include EMA’s and FDA joint principles on the use of AI across the medicinal product lifecycle, the European Commission’s call for evidence on the proposed amendments to the Medical Devices Regulation (EU) 2017/745 (MDR) and In Vitro Diagnostic Regulation (EU) 2017/746 (IVDR), proposals to strengthen the EU Cybersecurity Act, and important data protection interventions. In parallel, UK and EU regulators continued to focus on the safe deployment of digital tools in healthcare, including new Medicines and Healthcare products Regulatory Agency (MHRA) guidance on mental health technologies and ongoing work to refine AI governance. These updates, alongside developments in Intellectual Property (IP) and product liability, signal a rapidly evolving regulatory environment that will help to shape digital innovation and compliance expectations throughout 2026.Continue Reading Virtual and Digital Health Digest – January 2026

On 19 November 2025, the European Commission published two legislative proposals – the Digital Omnibus on AI Regulation Proposal and the broader Digital Omnibus Regulation Proposal (“Proposals”) – as part of a wider initiative to simplify and streamline the EU’s digital regulatory framework. Together, the Proposals introduce targeted but significant amendments across a broad range of instruments, including the EU AI Act (Regulation (EU) 2024/1689), the GDPR (Regulation (EU) 2016/679), the ePrivacy Directive (2002/58/EC), the NIS2 Directive ((EU) 2022/2555), and the EU Data Act (Regulation (EU) 2023/2854).Continue Reading EU Digital Omnibus: What the Proposed Reforms Mean for Pharma and MedTech

The Data (Use and Access) Act 2025 (“DUAA”) represents the UK’s first major reform of data protection law since leaving the EU. The Act aims to modernise the UK’s data protection framework by reducing administrative burdens on businesses, supporting innovation and maintaining high standards of data protection while enhancing the UK’s position as a competitive destination for data-driven industries.

As most of the data protection reforms introduced by the DUAA came into effect on 5 February 2026, life sciences companies should consider how the new framework reshapes their data protection compliance. While the DUAA introduces new rules, it also creates opportunities for the sector.Continue Reading UK’s Data (Use and Access) Act: What Life Sciences Companies Need to Know

Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during December 2025 and early January 2026 from the the United Kingdom, and European Union.Continue Reading Virtual and Digital Health Digest – December 2025

Introduction

The European Commission has published its proposals on the amendment of the Medical Devices Regulation 2017/745 (MDR) and In Vitro Diagnostic Regulation 2017/746 (IVDR) (“the proposals”). This marks a pivotal moment for the EU healthcare and MedTech landscape, following a public consultation by the Commission in early 2025 (see our blog here) and a call for evidence in September 2025 (see our blog here). The proposals respond to industry concerns over complexity, cost, and delays which have been substantially hammering the MedTech industry since the implementation of the MDR and IVDR.

The proposals aim to streamline regulatory processes, reduce administrative burden, and enhance predictability, while maintaining patient safety and public health. From adaptive pathways for breakthrough and orphan devices to leaner conformity assessments, stronger notified body (NB) governance, and changes to classification, these changes are designed to future-proof the regulatory framework and foster innovation. For manufacturers, healthcare institutions, innovators, and industry stakeholders, the proposals signal a shift toward a more proportionate, risk-based system that supports timely access to critical technologies without compromising quality.

Below, we have set out an overview of some of the key proposals.  Additionally, while not released with the proposals, the European Commission published a draft Implementing Regulation on certain uniform quality management and procedural requirements for the conformity assessment activities carried out by Notified Bodies – see our separate blog on this here.

The proposals have now been submitted to the European Parliament and Council for review. Once the Parliament and Council have adopted their own positions on the text, there will be negotiations to agree a final text which can be formally adopted by the Council and the Parliament. At this stage, it is challenging to anticipate what would be the result of the political negotiations and unclear when the new rules will start to apply.

A feedback period has been opened, running from 7 January to 5 March 2026. All feedback received will be summarised by the Commission and presented to the European Parliament and Council with the aim of feeding into the legislative debate.Continue Reading From complexity to clarity: How the EU Commission plans to overhaul the MDR and IVDR

On 12 December 2025, the European Commission published a draft Implementing Regulation (“the Regulation”) on certain uniform quality management and procedural requirements for the conformity assessment activities carried out by Notified Bodies (“NBs”), introducing detailed requirements for NBs operating under the Medical Device Regulations (EU) 2017/745 (“MDR”) and the In Vitro Diagnostic Medical Device Regulations (EU) 2017/746 (“IVDR”).

The recitals describe serious systemic challenges that have emerged since the implementation of the MDR/IVDR and the proposals aim to set out a structured resolution to these challenges. An overview of these proposals is set out below. Overall, the Regulation aims to create a harmonised NB landscape that is predictable, transparent, and fair – supporting patient safety while easing unnecessary administrative burdens for manufacturers. Whether this goes far enough to address the challenges identified will have to be seen.

The Regulation is open for public consultation until 23 January 2026. Once feedback has been reviewed by the Commission, it will be published. The Commission  anticipates adoption of the Regulations in the first quarter of 2026, following which it will be sent to the European Parliament and Council for consideration. The timing of the formal adoption of the Regulation is not yet clear.Continue Reading A Deep Dive into the EU’s New Implementing Regulation for Notified Bodies