Welcome to the latest installment of Arnold & Porter’s Virtual and Digital Health digest. This digest covers key virtual and digital health regulatory and public policy developments during September 2026 from the EU and UK.
The most significant development this month in the UK is that the government has accepted all 44 of the AI Commission’s recommendations for a new framework governing AI in health care. The recommendations call for a proportionate, lifecycle-based approach to regulation, including staged authorizations, enhanced post-market monitoring, and greater transparency requirements. The Medicines and Healthcare products Regulatory Agency (MHRA) is also expanding its use of regulatory sandboxes as part of their AI Airlock program and in collaboration with the National Health Service.
Meanwhile, across the channel, September has been a month busy with consultations. The European Commission (EC) carried out a consultation on a draft implementing regulation for HealthData@EU, which is intended to form the infrastructure across Europe for the access of electronic data for secondary use under the European Health Data Space (EHDS) Regulation. The EC plans to adopt the implementing regulation in Q4 2026, and this regulation would then apply from March 26, 2029. In addition, the EC has had a consultation on high-risk AI classification guidelines, to which MedTech Europe has responded expressing concern over potential legal uncertainty for medical devices combining rule-based and AI-based functionalities. Further, the European Data Protection Board has launched a consultation (open until November 13, 2026) on their draft guidelines on the interplay between fines and other General Data Protection Regulation (GDPR) corrective powers.
Link to Regulatory Updates Regulatory Updates
UK Government Publishes Fact Sheet and Impact Assessments on Health Bill Medicines Reforms. The Department of Health and Social Care published a fact sheet explaining the health bill’s reforms to medicines and medical devices regulation. The bill would make it easier to update regulations by allowing ambulatory references to external standards, more proportionate consultation, and the negative procedure for minor technical changes. It would also give the MHRA clearer powers to share information with UK and international partners without relying on individual agreements. Finally, it contains the enabling power for a future medical device licensing regime, including software- or AI-enabled devices, which could involve the MHRA assessing and licensing devices directly, rather than relying on third-party UK approved bodies. The detail of such regime has been left to later regulations. The MHRA reforms impact assessments indicate that the information sharing powers could shorten time to market by three to six months in some cases.
MHRA Launches Call for Evidence on AI in Medicines Development. The MHRA and the Regulatory Innovation Office (RIO) have launched a call for evidence on the use of AI in medicines safety and development. The survey seeks input from companies, researchers, and other stakeholders on how AI is being used, or could be used, to improve the prediction and assessment of medicine safety by combining preclinical, clinical, and real-world data across different populations and conditions. In particular, the focus is on the Absorption, Distribution, Metabolism, Excretion, and Toxicity (ADMET) of medicines to help identify safety risks earlier. Feedback will help inform the development of the UK’s “Beyond ADMET: AI for Medicines Safety” regulatory sandbox, announced in June 2026, and shape future regulatory policy and engagement in this area. Responses can be submitted until December 22, 2026, and stakeholders are encouraged to submit examples to demonstrate current practice and challenges.
UK Government Accepts UK AI Commission’s Recommendations for New AI Regulatory Framework in Health Care. In a significant development for AI governance in health care, the UK government has accepted all 44 recommendations made by the UK’s National Commission into the Regulation of AI in Healthcare and has set out how they will be used to create a future-ready regulatory framework for the development, regulation, and adoption of AI technologies. The move is intended to ensure that the UK remains at the forefront of safe and responsible AI innovation in health care. The commission, established by the MHRA, recommended that AI regulation should be proportionate, lifecycle-based, and system-wide, reflecting the evolving nature of AI technologies and their use in clinical practice. Key recommendations include staged authorizations for new AI models, enhanced and continuous post-market monitoring, greater transparency around the use and performance of AI systems, and strengthened enforcement powers if AI tools fail to meet requisite standards.
MHRA Launches Phase 3 of the AI Airlock. The MHRA has announced the launch of Phase 3 of AI Airlock, its regulatory sandbox for AI-enabled medical devices. Following a successful pilot and Phase 2 program, AI Airlock has secured a further three years of government funding, underscoring continued support for innovation in this area.
Phase 3 will focus on post-market surveillance and lifecycle regulation, aligning closely with the themes at the heart of both the commission’s recommendations and the government’s response outlined above. Applications are now open for innovators wishing to participate in the program, with a webinar for prospective applicants scheduled for October 22, 2026.
MHRA and Manchester NHS Launch Health Innovation Sandbox. The MHRA and Manchester University NHS Foundation Trust have launched a partnership to test health technologies in real-world NHS settings. The Manchester Sandbox will generate evidence on technologies’ safety, effectiveness, and impact on routine use, with the aim of supporting informed adoption across the NHS. Initial projects are expected to include AI-enabled medical devices, such as tools that identify patients at higher risk of complications from long-term conditions. The program will bring together health care providers, regulators, and innovators to evaluate technologies under appropriate oversight and regulatory safeguards. Lessons from the sandbox will be shared across the NHS, and the MHRA plans to invite expressions of interest from medical device developers for the program’s next phase.
EFPIA Supports European Commission’s Cloud and AI Proposal. The European Federation of Pharmaceutical Industries and Associations (EFPIA) has welcomed the EC’s proposed Cloud and AI Development Act (CADA), which aims to strengthen Europe’s cloud, computing, and AI infrastructure. EFPIA notes that AI and advanced computing are increasingly important across the health care and life sciences sectors, including for clinical research, real-world evidence generation, and pharmacovigilance. The industry body supports measures to expand access to computing capacity and promote AI adoption, while emphasizing the importance of maintaining interoperability and global scientific collaboration. EFPIA also highlights potential links with the European Health Data Space, which could support greater use of health data for AI-enabled research and innovation.
MedTech Europe Responds to Commission Consultation on High-Risk AI Classification Guidelines. MedTech Europe has responded to the EC’s consultation on draft guidelines for classifying high-risk AI systems under the AI Act, highlighting potential legal uncertainty for medical devices combining rule-based and AI-based functionalities. In particular, it calls for clarity on whether the whole system or only specific components should be considered AI, as well as on the definition of an AI system and the distinction between AI systems that are product components and those that are products in their own right. MedTech Europe also stresses the need to align the guidelines with the outcome of the Digital Omnibus on AI. For more details on the Digital Omnibus on AI generally, read our BioSlice Blog post.
Link to Privacy Updates Privacy Updates
ICO Updates FOI Guidance on the Public Interest Test Following Supreme Court Ruling. The ICO has updated its guidance on the public interest test under the Freedom of Information Act 2000 following the Supreme Court’s judgment in Department for Business and Trade v. Information Commissioner [2025] UKSC 27. The Court confirmed that where multiple qualified exemptions apply to the same information, the public interest factors supporting those exemptions can be considered cumulatively when weighed against the combined public interest in disclosure. The guidance also clarifies what authorities should tell applicants in a refusal notice and what is expected of them if the ICO receives a complaint.
ICO Becomes the Information Commission. On September 30, 2026, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 brought into force the Data (Use and Access) Act (DUAA) provisions abolishing the office of Information Commissioner and transferring its functions to the Information Commission, a new body corporate, led by a board (as flagged in our July edition). The government has confirmed that the commission takes over all of the ICO’s existing functions and responsibilities. No immediate action is required, but companies should update references to the regulator in privacy notices, data processing agreements, and breach-response procedures over time.
Italian DPA Fines IQVIA €7 Million Over Pseudonymized Health Data. On September 23, 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy €7 million under the GDPR. The decision concerns a database of patient records collected from around 800 general practitioners and covering around a million patients. See our BioSlice Blog for full details.
Commission Consults on Draft Implementing Regulation for HealthData@EU. The commission has launched a consultation on a draft implementing regulation setting out the technical framework for HealthData@EU, the cross-border infrastructure for accessing electronic health data for secondary use under the European Health Data Space Regulation (Regulation (EU) 2025/327). The draft covers the infrastructure’s architecture, security, and interoperability requirements. The regulation would also establish an “Enforcement Information Exchange Tool” for health data access bodies to exchange information on enforcement measures. The consultation closed on September 29, 2026. The commission plans to adopt the regulation in Q4 2026, and the regulation would then apply from March 26, 2029.
EDPB Adopts Guidelines on the Interplay Between Fines and Other GDPR Corrective Powers. At its September 17, 2026 plenary, the European Data Protection Board (EDPB) adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR. The guidelines set out a five-step methodology for supervisory authorities deciding whether to fine an infringement, replacing the WP29 fining guidelines. They are open for public consultation until November 13, 2026.
EDPB Finalizes Guidelines on the Interplay Between the DSA and the GDPR. Following public consultation, the EDPB adopted the final version of its guidelines on the interplay between the Disabled Students’ Allowance (DSA) and the GDPR. The guidelines support consistent application of both instruments, particularly where DSA provisions on intermediary service providers rely on GDPR concepts and definitions.