Virtual And Digital Health Digest – October 2025

Welcome to the latest installment of Arnold & Porter's Virtual and Digital Health Digest. This digest covers key virtual and digital health regulatory and public policy developments during September and early October 2025 from the the United Kingdom, and European Union.

This month, the EU and UK have been actively processing the future of AI development and regulation in life sciences and health care through a combination of legislative initiatives, opportunities for stakeholder engagement, and investment in infrastructure. In the EU, the European Commission has published draft guidance on reporting serious AI incidents under the AI Act, and the European Medicines Agency has initiated a stakeholder survey to define AI priorities in medicines regulation. In the UK, the UK government has announced a National Commission on the Regulation of AI in Healthcare and a new AIR-SP cloud platform. These developments signal a shift from theoretical regulation to practical implementation. There have also been two important decisions from the Court of Justice of the European Union refining the legal boundaries of digital health services and data protection.

Regulatory Updates

European Commission Undertakes Public Consultation on AI Act Transparency Obligations. The consultation collected practical examples and sought to clarify the scope and application of the transparency obligations under the AI Act. The obligations, which apply to deployers and providers of AI systems, will come into effect on August 2, 2026. Feedback received will be taken into account in the upcoming European Commission guidelines and Code of Practice, which will provide practical examples within the scope of the transparency obligations, recommended disclosure practices, and further conceptual clarifications.

Global Harmonization Working Party (GHWP) Launches Call for Comments on Guidance on AI/Machine Learning (ML)-Based Computer-Assisted Detection (CADe) and Computer-Assisted Diagnosis Software as a Medical Device. The call will be open until October 27, 2025 at noon (GMT+8). Once feedback has been obtained, the GHWP, an international platform composed of experts from regulatory authorities and the industry, will finalize the guidance, which will apply broadly, not specifically to the EU. The guidance aims to guide manufacturers on regulatory considerations relating to the registration and pre-market approval of AI/ML-based software, either as stand-alone medical devices or as components integrated into other medical devices across jurisdictions. In particular, the guidance will provide details on the reporting protocols and risk-based strategies for managing modifications, including practical examples.

Court of Justice of the European Union (CJEU) Clarifies Legal Framework for Cross-Border Telemedicine. In Case C-115/24, the CJEU confirmed that telemedicine services are governed by the law of the country where the health care provider is established, rather than that of the country where the patient receives the service (i.e., country-of-origin principle). The CJEU also clarified that only services delivered entirely remotely via information and communication technologies qualify as "telemedicine" under the Directive on patients' rights in cross-border health care (Directive 2011/24). Mixed models involving both telemedicine and in-person care are excluded from the definition. The CJEU also clarified that the country-of-origin principle extends beyond reimbursement, requiring telemedicine services to comply with applicable legislation and guidelines of the provider's country of establishment.

MedTech Europe Calls for Urgent Regulatory Reform To Safeguard Innovation and Access to Medical Devices. MedTech Europe and the Association of British HealthTech Industries, along with 34 national associations, have issued an open letter to Commissioner Olivér Várhelyi urging swift action to secure access to medical technologies in Europe, with concerns about shortages having grown since the implementation of the Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) in the EU. The letter highlights the need for both short-term relief measures and long-term regulatory reform of the Regulations. Key proposals include harmonized rules for notified bodies, a targeted postponement of re-certification requirements, and pilot regulatory pathways for marketing of pediatric, orphan, and breakthrough devices. The industry also calls for increased investment in regulatory governance and resources to ensure Europe remains globally competitive.

Draft Guidance on the Reporting of Serious AI Incidents Under the EU AI Act. The European Commission has published draft guidance and a reporting template to help providers of high-risk AI systems comply with new obligations under Article 73 of the AI Act. Reporting requirements will apply from August 2, 2026, and reports of serious incidents will need to be submitted to national market surveillance authorities no later than 15 days from the date of knowledge of the serious incident (with some limited exceptions). The guidance clarifies the definition of "serious incident," offers practical examples to help determine whether an incident is serious, and addresses the interplay with other legal frameworks, including the MDR and IVDR. Given that all AI-enabled medical devices are classified as high risk under the AI Act, this guidance will apply to developers of such devices. However, the guidance makes clear that reporting for incidents relating to AI-enabled devices is limited to incidents involving fundamental rights violations only, to avoid duplication with reporting obligations under MDR/IVDR. Stakeholders are invited to submit feedback by November 7, 2025.

Launch of New UK National Commission on the Regulation of AI in Healthcare. The UK government has established a National Commission on the Regulation of AI in Healthcare (AI Commission) to accelerate the safe adoption of AI across the UK's National Health Service (NHS). The AI Commission will advise the Medicines and Healthcare products Regulatory Agency on developing a new regulatory framework for AI in health care, due in 2026. It brings together experts from tech firms, clinicians, researchers, and patient advocates to address regulatory barriers and enable faster access to AI tools such as remote monitoring systems, diagnostics, and ambient voice technology. The initiative supports the NHS' ongoing digital transformation and aims to position the UK as a global leader in responsible AI health care innovation. A formal call for evidence is expected shortly to allow stakeholders to share their views with the National Commission.

NHS to Trial AI Screening Tools Via New Cloud Platform. The UK government has announced an initiative to test AI tools to help analyze screening images and pinpoint abnormalities at scale across NHS' screening services. A new "AIR-SP cloud platform," an AI research screening platform in development by NHS England, will allow NHS trusts to participate in multisite trials by centralizing access to these "revolutionary AI tools," to help overcome current barriers caused by fragmented IT systems. This initiative aims to reduce setup time and costs for AI research studies, and ultimately lead to patients receiving faster diagnoses and treatments. It is part of broader efforts to digitize NHS services and improve patient outcomes through innovative technology. The new platform is expected to be rolled out for research in 2027 and will be first used in a trial identifying changes indicative of breast cancer.

Pricing and Reimbursement Updates

NICE Expands HealthTech Evaluations To Accelerate NHS Innovation. The National Institute for Health and Care Excellence (NICE) has announced an expansion of its HealthTech evaluation program, aiming to assess medical devices, diagnostics, and digital tools against the same standards as medicines. Technologies meeting such standards will be recommended for NHS-wide adoption, accompanied by evidence-based guidance on their value and clinical effectiveness. This move is designed to ensure faster and more consistent access to innovations like AI diagnostics and wearable monitors across the NHS. The initiative supports the NHS 10-Year Health Plan and the UK government's Life Sciences Sector Plan (discussed in our July 2025 BioSlice Blog). NICE has proposed changes to the evaluation methods, with a focus on high-impact technologies and a broader rollout planned in future years, and will now consider feedback received from stakeholders to produce an updated manual for technology appraisals.

Privacy Updates

Court of Justice of the European Union Clarifies Concept of Pseudonymized Data. In Case C 413/23 P, the CJEU held that pseudonymized data does not automatically constitute personal data in all cases and for every data recipient. Whether pseudonymized data qualifies as personal data depends on whether the specific data recipient is effectively prevented from identifying the data subject, assessed in light of the specific circumstances and factual context of the data processing in each individual case. This judgment is significant, as data that is no longer considered personal data falls outside of the scope of the Regulation (EU) 2016/679 (GDPR). For more details on the judgment, read our September 2025 BioSlice Blog.

General Court of the European Union (GCEU) Upholds the EU-U.S. Data Protection Framework (DPF). In Case T 553/23, the GCEU dismissed an action brought by a private citizen against the 2023 European Commission decision, which recognized that the DPF ensures an adequate level of protection for personal data transferred from the EU to the U.S. Under the GDPR, transfers of personal data to a third country (e.g., the U.S.) require protection "essentially equivalent" to that in the EU. The DPF succeeds the EU-U.S. Privacy Shield, invalidated by the CJEU in Schrems II (2020), and the EU-U.S. Safe Harbor Framework, invalidated by the CJEU Schrems I (2015). The GCEU confirmed that achieving an "essentially equivalent" protection does not require identical means to those in the EU. It is possible for the judgment to be appealed to the CJEU. For more details on the judgment, read our September 2025 Advisory.

IP Updates

U.S.-UK Tech Prosperity Deal To Advance Drug Discovery and Generate Employment. The UK and U.S. have signed their first Tech Prosperity Deal, a landmark technology partnership designed to accelerate advances in areas like AI, quantum computing, and nuclear innovation. A major focus is on using AI and quantum methods to revolutionize drug discovery and health care, enabling faster development of new therapies and more precise treatments. The pact includes over £30 billion of private investment from U.S. tech companies to expand the UK's AI infrastructure. This includes data centers, such as graphic processing units, and supercomputing power alongside new initiatives, such as an AI Growth Zone in the North East of England, expected to create more than 5,000 jobs.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.