Vital Signs: Digital Health Law Update | Spring/Summer 2026

Note From the Editors

This Spring/Summer 2026 edition of Vital Signs examines the accelerating convergence of AI, digital health, and health care regulation. We begin with an Industry Insights feature addressing AI-washing risks in digital health transactions. In the United States, we highlight recent FDA activity on digital health technologies, new approach methodologies, and real-time AI-enabled clinical trials, alongside DOJ telemedicine enforcement, HHS initiatives, and key cybersecurity and privacy developments. Globally, we cover significant EU and UK developments—including high-risk AI guidance, medical device and clinical trial reforms, and national AI and cloud health data initiatives across Europe. Our Jones Day contributors hope these insights help you navigate the rapidly evolving legal and regulatory landscape for digital health.

Industry Insights

Unmasking AI Washing in Digital Health Transactions

Artificial intelligence ("AI") has transformed the traditional M&A playbook, particularly with significant implications for the digital health sector. Buyers pursuing health tech targets frequently face "AI washing": a phenomenon in which target companies disguise basic analytics as proprietary medical diagnostics, exaggerating their actual AI capabilities to inflate valuations. These assets present unique challenges for standard due diligence: opaque model architectures, unverifiable training datasets, and an unsettled intellectual property landscape where copyright exposure, open-source license considerations, and data provenance issues remain largely unquantified. Old review checklists cannot account for these risks, and regulators are rapidly adding compliance dimensions that increase transactional complexity. The underlying technology cannot be audited line by line like regular software; its capabilities emerge from numerical parameters derived through training on data of varying provenance and legality. As a result, buyers applying traditional frameworks risk overpaying for basic tech, while potentially rejecting transformative health care assets over remediable issues that, with proper structuring, need not defeat the transaction.

To spot AI washing, buyers must first address the threshold question: what exactly is being purchased? Defining the target company's competitive advantage, often called its "moat," is essential. The biggest valuation question is whether the technology is a proprietary foundation model or if it is a basic "wrapper" on a third-party application programming interface ("API"). A digital health company commanding a premium "AI company" price may only possess engineered prompts and an API connection to a commercial foundation model, or a thin integration layer built on third-party machine learning services. This setup offers minimal defensibility and significant platform dependency risks. Conversely, a proprietary foundation model trained from scratch on demonstrably clean data, with genuinely novel architecture, represents a highly defensible asset with significant enterprise value. Buyers must evaluate replicability: whether a well-funded competitor could rebuild the core functionality within months using publicly available foundation models. In many cases, the true value lies in proprietary data assets—such as patient interaction logs, labeled clinical datasets, and curated health knowledge bases—provided that clear chain of title and compliant collection practices can be demonstrated.

The most challenging phase of the review follows: identifying risks that could create material post-closing liability when comprehensive audits reach their limits. In health care AI, privacy, data security, and regulatory compliance are especially critical given sector-specific regimes such as the Health Insurance Portability and Accountability Act ("HIPAA"). However, conducting a complete audit of AI training data is not feasible given normal transaction timelines and resource constraints. A fundamental diligence principle must be understood: mere access to HIPAA-protected records, wearable sensor streams, or electronic health record ("EHR") APIs through health system partnerships does not grant the commercial right to train models on that data. Partnerships that authorize clinical use or research access frequently do not extend to commercial AI development, and buyers must meticulously trace the provenance of every material training dataset.

These models may have trained on datasets from hundreds or thousands of sources, including copyrighted content potentially ingested without authorization, personal data processed without valid legal basis under applicable privacy regimes, and contractually restricted data subject to use limitations or confidentiality obligations. Using unauthorized or improperly de-identified clinical data creates a "fruit of the poisonous tree" scenario: even if the resulting algorithm performs well, the tainted data provenance can give rise to massive infringement claims, regulatory disgorgement actions, and—in the most severe cases—the forced destruction of the algorithm itself. Because complete auditing is not achievable, buyers must embrace a paradigm shift from issue elimination to risk quantification. The goal is not to certify an AI asset as perfectly "clean," but to develop a sufficiently informed assessment of the risk magnitude, probability of materialization, and potential liability exposure, then allocate those risks through tailored contractual mechanisms including bespoke AI representations, warranties, and indemnities.

Discovering material issues during due diligence does not have to kill a digital health transaction. Unlike traditional software, where affected code may require a total rewrite, machine learning systems can often be remediated in a more technically and economically feasible manner than initial discovery might suggest because models are designed for iterative improvement. For example, if a medical AI is trained on legally problematic data, it can be retrained using clean datasets; algorithmic bias can be mitigated through targeted fine-tuning; and open-source issues in certain model components may be isolable and replaceable. Acquirers have several practical options to save the transaction and protect their investment. For example, ring-fencing can exclude problematic assets from the initial transfer, with options for post-closing acquisition once retraining is completed and validated. Additionally, post-closing retraining covenants can obligate the seller to undertake defined remediation within specified periods, with performance benchmarks, testing procedures, and milestone-based escrow releases providing accountability.

AI is permanently altering transactions, and digital health buyers must evolve their strategies. After closing, buyers must be prepared to integrate the acquired AI assets into their existing compliance and governance infrastructure. This requires coordination between outside counsel, in-house counsel, and technical, compliance, and business stakeholders from the earliest diligence stages. Buyers must plan for regulatory requirements—including ongoing monitoring, testing, and validation procedures consistent with applicable AI governance frameworks—and identify any required regulatory filings or approvals to deploy AI in regulated health care business lines. Ultimately, perfection is unrealistic in AI diligence, but informed, structured pragmatism can produce outcomes that address each party's interests. By deconstructing the AI asset, deploying tailored contractual protections, treating remediation as integral to deal design, and planning for post-closing regulatory compliance, buyers can navigate the uncertainty. This allows them to unmask AI washing and acquire truly valuable digital health assets without sacrificing deal momentum or commercial viability.

United States Developments

FEDERAL 

FDA Further Clarifies the Regulatory Landscape for Rapidly Evolving Digital Health Technologies   

Building on several recent initiatives to integrate new technologies and real-world evidence into regulatory frameworks, the U.S. Food and Drug Administration ("FDA") issued several guidance documents in early 2026 that further clarify the agency's regulatory approach to rapidly evolving digital health technologies:

• On January 6, 2026, FDA issued updated final guidance entitled "General Wellness: Policy for Low Risk Devices," which clarifies FDA's approach to "general wellness products" and describes which software functions are exempt from the "device" definition and which low-risk devices are subject to FDA enforcement discretion. Our previous Alert discussing this guidance is available here. 
• On January 29, 2026, FDA issued updated final guidance entitled "Clinical Decision Support Software," further clarifying the scope of its oversight of clinical decision support ("CDS") software intended for health care professionals and the criteria that software functions must satisfy to be excluded from the "device" Among the most significant changes, FDA removed most language automatically excluding CDS intended for use in "time-critical decision-making" from Criterion 3—which would subject it to regulation as a "device"—and included it as a Criterion 4 factor instead, providing more flexibility while still treating time-critical use as a factor signaling higher risk. Our previous Alert discussing this guidance is available here. 
• On January 14, 2026, the European Medicines Agency ("EMA") and FDA published a joint set of Guiding Principles of Good AI Practice in Drug Development (the "Principles"), setting forth a shared regulatory vision for the use of AI across the drug development life cycle. As highlighted in a previous Alert, the Principles are intended to inform future regulatory policies and guidance across jurisdictions and promote international cooperation on the use of AI in drug development. 

FDA Draft Guidance on New Approach Methodologies in Drug Development 

On March 18, 2026, FDA issued draft guidance entitled "General Considerations for the Use of New Approach Methodologies in Drug Development." The draft guidance provides drug developers with a validation framework for New Approach Methodologies ("NAMs")—innovative, human-centric testing methods (such as organoids, organs-on-chips, and in silico computational modeling, among others) designed to reduce or replace traditional animal studies in nonclinical drug development and better predict safety and efficacy outcomes in patients. The draft guidance builds on Congress's passage of the FDA Modernization Act 2.0, which clarified that NAMs can support new drug applications in lieu of animal studies. 

In the draft guidance, FDA identifies four key validation principles for NAMs: (1) Context of Use, addressing the intended use and regulatory purpose of the NAM; (2) Human Biological Relevance, describing the relationship between the information generated by the NAM and the assessment of the drug's safety and effectiveness; (3) Technical Characterization, establishing scientific confidence in the NAM; and (4) Fit-for-Purpose, demonstrating that a NAM can assist FDA with regulatory decision-making. 

FDA Warning Letter to At-Home Testing Kit Manufacturer Reignites Questions of FDA Oversight Over the LDT Ecosystem 

On March 17, 2026, FDA issued a warning letter to an at-home testing kit manufacturer for allegedly offering an HIV serological diagnostic dried blood spot card self-collection kit without FDA marketing authorization. According to the agency, the kit—which is shipped to individuals for at-home collection of blood spot samples that are then sent to laboratories for HIV testing—is both adulterated and misbranded under the Federal Food, Drug, and Cosmetic Act because it has not received FDA marketing authorization. FDA rejected the manufacturer's argument that it does not sell the kit because it merely "facilitates access to professional medical services" in which health care professionals order tests and oversee the entire process, and the "service" it offers is "not intended to diagnose, treat, or cure any disease on its own," because health care professionals must interpret and confirm the results. 

The warning letter is particularly significant in the wake of the March 2025 vacatur of FDA's laboratory developed test ("LDT") rule, which would have brought LDTs within the ambit of FDA medical device regulation, and FDA's decision to formally revert to the former text of the regulation. In light of these developments, the warning letter raises several questions regarding the scrutiny that FDA intends to exercise over component parts of LDTs and the strategies it may pursue to maintain some degree of oversight over the LDT ecosystem. 

FDA Advances Real-Time Clinical Trials Initiative

On April 28, 2026, FDA announced two major steps toward implementing real-time and AI-enabled clinical trials, including the initiation of two proof-of-concept "real-time clinical trials" ("RTCTs") designed to report endpoints and data signals to the agency in real time and the release of a request for information ("RFI") on a proposed pilot program expected to launch this summer. The pilot involves the recruitment of sponsors that are currently pursuing, or will be pursuing, early-phase clinical trials to participate in a pilot program that will allow FDA to assess in real time the feasibility of integrating AI into early-stage clinical trials. The RFI was issued to obtain initial information on how AI-enabled technologies can improve efficiency, speed, and quality of decision-making in the early-phase clinical trials pilot program. The RFI and the proof-of-concept RTCTs both reflect FDA's broader interest in moving toward more seamless clinical development by reducing the hiatus that often occurs between discrete trial phases, enhancing safety monitoring, and enabling continuous trials. Comments on the RFI were due on June 29, 2026.

Recent DOJ Enforcement Actions Involving Telemedicine

The Department of Justice ("DOJ") continues to focus its health care enforcement efforts on telemedicine schemes, including claims for genetic testing and durable medical equipment ("DME"), as evidenced by a number of actions over the past months:

• On February 26, 2026, the owner of two telemedicine companies was sentenced to seven years in prison and ordered to pay $27.9 million in restitution for his role in a $56 million scheme to fraudulently bill Medicare for unnecessary DME. According to court documents, between 2017 and 2019, the defendant and others paid illegal kickbacks to medical providers to sign orders for orthotic braces for Medicare beneficiaries who did not need the braces and then sold the signed orders to marketing companies that resold them to brace companies, which in turn submitted false claims to Medicare. The defendant and his co-conspirators pressured beneficiaries into accepting as many braces as possible, with providers signing orders for four or more orthotics each for over 3,000 beneficiaries. The defendant also attempted to conceal his crimes by creating a new telemedicine company and convincing a member of his church that it was an investment opportunity in order to open bank accounts in her name.

• On March 25, 2026, a Texas man was sentenced to 150 months in prison and two years of supervised release for organizing and leading a $61.5 million health care fraud and wire fraud conspiracy. According to court documents and evidence presented at trial, the defendant owned and operated seven DME supply companies and a marketing company that he used to conduct deceptive telemarketing campaigns targeting Medicare beneficiaries for medically unnecessary orthotic braces, foot baths, and genetic tests. The defendant obtained doctors' orders by paying kickbacks and bribes to illegitimate telemedicine companies, sold those orders to other medical suppliers, and eventually began using "fake" doctors' orders containing forged physician signatures.

• On March 27, 2026, the owner of a telemedicine company pleaded guilty to conspiracy to commit health care fraud and wire fraud in connection with a $46.2 million Medicare fraud conspiracy lasting more than six years. According to court documents, the defendant and his co-conspirators targeted Medicare patients through aggressive telemarketing campaigns, inducing them to accept orthotic braces and genetic tests they did not need, and paid doctors to approve orders without real medical relationships or meaningful interaction with the patients. The defendant then sold the signed doctors' orders to DME supply companies, laboratories, and marketers, and also operated multiple DME supply companies that he used to bill Medicare millions of dollars for unnecessary orthotic braces. In total, at least $46.2 million in false and fraudulent claims were submitted to Medicare, which paid $17.9 million based on the claims, and the defendant agreed to pay $17.9 million in restitution.

• On May 13, 2026, a federal jury convicted the founder and owner of a telemarketing company in connection with a scheme to defraud Medicare and other federal health care benefit programs of more than $1 billion. This verdict follows the late 2025 sentencing of a co-conspirator, who received 15 years in prison and was ordered to pay more than $452 million in restitution for his role in the scheme. According to evidence presented at trial, the defendants and their co-conspirators operated an internet-based platform that generated false and fraudulent doctors' orders for medically unnecessary orthotic braces, pain creams, and other items, targeting hundreds of thousands of Medicare beneficiaries through misleading mailers, television advertisements, and calls from offshore call centers. Through this platform, the defendants connected pharmacies, DME suppliers, and marketers with telemedicine companies that accepted illegal kickbacks and bribes in exchange for signed doctors' orders. The defendants and their co-conspirators concealed the scheme through sham contracts and by removing certain words from doctors' orders that might cause Medicare to audit the DME suppliers.

• On May 19, 2026, another member of an international criminal organization was sentenced to 10 years in prison for his participation in an approximately $2 billion telemedicine fraud conspiracy. According to court filings, between 2017 and 2022, the criminal organization operated an international scheme to defraud private insurers by using call centers in Utah and Russia to generate fraudulent prescriptions under recruited physicians' names and National Provider Identifier numbers—without legitimate telemedicine visits or beneficiary consent. These prescriptions, which were largely never delivered to beneficiaries, were submitted through acquired U.S. pharmacies staffed by Moscow-based billers. To conceal the scheme, the defendants used multiple aliases, funneled hundreds of millions of dollars through shell companies and straw owners, employed encrypted communications, and moved operations overseas. They further obscured control by purchasing and operating dozens of brick-and-mortar pharmacies through straw owners across the United States. 

HHS-OIG Issues Unfavorable Advisory Opinion Regarding HHA Payments to Access Referral Software 

On June 25, 2026, the Department of Health and Human Services Office of Inspector General ("HHS-OIG") issued Advisory Opinion 26-15, an unfavorable opinion addressing subscription fees paid by a home health agency ("HHA") to a vendor for the use of software that facilitates access to hospital referral requests. HHS-OIG determined that, if undertaken with the requisite intent, the arrangement would generate prohibited remuneration under the Federal Anti-Kickback Statute. 

As described in the advisory opinion, the software lets hospitals identify and select HHAs for post-acute referrals, and HHAs pay a subscription fee to access, receive, and accept referrals through the software. The vendor set subscription fees based on several factors, including HHA geographic location and the number of jointly owned HHAs subscribing. Non-subscribed HHAs were left to receive the same referrals by electronic facsimile, email, phone, or hand-delivery, and to accept them by calling the hospital. 

HHS-OIG found the arrangement failed to qualify for the Referral Services Safe Harbor, 42 CFR 1001.952(f), because subscription fees were neither uniform across subscribers nor based solely on the cost of operating the software. It also found the fraud and abuse risk too high for a favorable opinion, citing two principal concerns. First, according to HHS-OIG, the arrangement could enable inappropriate steering and unfair competition, since subscribing HHAs would gain a significant edge over non-subscribers who had no access to electronic referrals. Second, the arrangement posed a risk of overutilization or inappropriate utilization, as the subscription fees could incentivize HHAs to bill for medically unnecessary services to recoup their subscription costs. 

HHS Office for Civil Rights Launches First-Ever Civil Enforcement Program for Substance Use Disorder Patient Record Confidentiality  

In February 2026, the United States Department of Health and Human Services ("HHS") Office for Civil Rights ("OCR") announced the launch of a first-of-its-kind civil enforcement program protecting the confidentiality of covered substance use disorder ("SUD") patient records under 42 CFR Part 2 ("Part 2"), as required by the CARES Act. As of February 16, 2026, persons and entities subject to Part 2 must comply with applicable requirements, and OCR began accepting complaints alleging violations of Part 2 and notifications of breaches involving SUD patient records. Penalties for noncompliance will align with the penalties available under the HIPAA Privacy, Security, and Breach Notification Rules, and investigations may be resolved through resolution agreements, corrective action plans, monetary settlements, or civil money penalties.

HHS Seeks Stakeholder Input to Shape AI Integration in Clinical Care

In December 2025, HHS issued a request for information ("RFI") soliciting stakeholder feedback on how to accelerate the adoption of AI in clinical care, focusing on regulatory frameworks, reimbursement models, and research and development priorities intended to promote access, affordability, and public trust. The RFI expressly sought input from those building, purchasing, evaluating, using, or seeking to use clinical AI tools, with feedback intended to inform HHS-wide policy across regulation, reimbursement, and research and development. On June 25, 2026, HHS and the Office of the National Coordinator for Health Information Technology hosted a webinar discussing HHS's approach to accelerating clinical AI adoption following the RFI. At the event, HHS described a coordinated "OneHHS" approach centered on regulation, reimbursement, and research and development, while emphasizing department-wide coordination, adoption support (including implementation and governance), and AI evaluation and benchmarking as key priorities for building trust and accelerating the responsible adoption of clinical AI. 

Senators Introduce Health Care Cybersecurity and Resiliency Act of 2026

In December 2025, Senators Cassidy, Hassan, Cornyn, and Warner introduced the Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315) (the "Act"). If passed, the Act would direct HHS and the Cybersecurity and Infrastructure Security Agency to strengthen cybersecurity across the health care sector by establishing minimum cybersecurity standards for covered entities, creating incident response and capability plans, providing grants and workforce development programs, and issuing tailored guidance for rural providers. As currently drafted, the cybersecurity standards for covered entities may include measures such as multifactor authentication, encryption, monitoring and testing of information systems, and other safeguards aligned with nationally recognized cybersecurity frameworks, including those of the National Institute of Standards and Technology. The Act would also amend Section 13402(f) of the HITECH Act to require including the number of individuals impacted in breach notices.

Health Care Tops List of Costliest Industries for Data Breaches in 2025

According to IBM's Cost of a Data Breach Report 2025, health care was the most expensive industry for data breaches in 2025, recording the highest average breach cost among industries for the 12th consecutive year at $7.42 million. Pharmaceuticals (including life sciences) recorded the sixth-highest average breach cost at $4.61 million. The report explained that threat actors remain focused on health care entities because patient personally identifiable information is highly valuable and can be used for identity theft, insurance fraud, and other financial crimes.

STATE

NY Legislature Takes Another Shot at Health Information Privacy Law   

In February 2026, the New York Legislature introduced the "New York Health Information Privacy Act" (S. 9269/A. 10357), a renewed effort to regulate the collection, processing, and sale of certain health-related consumer information. The proposal follows a prior version of the bill, S. 929, which passed the New York Senate and Assembly in January 2025 but was vetoed by Governor Kathy Hochul in December 2025. Like its predecessor, the revised bill would extend to health information outside traditional HIPAA-covered settings, including data collected or inferred by consumer-facing businesses. The bill targets covered health data by prohibiting its sale, requiring affirmative consent except for limited necessary uses, giving individuals access and deletion rights, and imposing data security requirements. As of June 2026, the bill had passed both chambers of the New York Legislature and remained subject to final legislative action following amendments.

Seventh Circuit Rules Illinois' Biometric Privacy Law Amendment Applies Retroactively, Limiting Recovery  

In April 2026, in Clay v. Union Pacific Railroad Co., the Seventh Circuit held that Illinois' 2024 amendment to Section 20 of the Biometric Information Privacy Act ("BIPA") applies retroactively to cases that were pending when the amendment took effect. BIPA regulates how private entities collect, retain, and disclose biometric identifiers and biometric information, and the amendment limits recovery for repeated collections or disclosures of the same biometric data from the same person using the same method. The court reasoned that the amendment was remedial rather than substantive because it changed the damages available under Section 20 without altering BIPA's substantive liability standards under Section 15. As a result, plaintiffs alleging repeated scans or disclosures may be limited to "at most, one recovery," significantly reducing potential exposure in pending BIPA litigation that previously could have been valued on a per-scan basis.

Global Developments

EUROPE

European Union

European Commission Publishes New Guidance on High-Risk AI Systems  

The EU Artificial Intelligence Act (the "AI Act"), adopted in 2024, creates a risk-based framework for AI systems in the European Union. The most demanding obligations apply to systems treated as "high risk." On May 19, 2026, the European Commission (the "Commission") published Draft Guidelines on the Classification of High-Risk AI Systems explaining how companies should decide whether an AI system falls into that high-risk category. The guidance is not legally binding, but it reflects the Commission's interpretation and is expected to influence how regulators assess AI systems.

The AI Act creates two main paths into the high-risk category. The first covers AI that is a regulated product (i.e., a product that already needs regulatory clearance or approval under European product-safety rules before it can be marketed, such as medical devices including diagnostics) or a safety part of one, where the product must be reviewed by an independent assessment body before it can be sold in the European Union. This is the case for Class II and III devices or Class B, C, and D diagnostics. The second path covers "sensitive uses" of unregulated products. In the health sector, examples are systems that infer health status from physical or biological signals, assess access to health care, price or assess risk for health or life insurance, prioritize emergency care, or assess health risks at the border.

The AI Act does not replace the European Union's medical device and diagnostic device legislation. It adds AI-specific requirements, including requirements for data governance, technical documentation, risk management, human oversight, and quality management. Companies already subject to sector-specific rules should build the AI requirements into existing compliance systems rather than creating a separate AI compliance structure.

One important category of products classified as high risk comprises those that allow biometric or physiological analysis. For example, the Commission's draft guidance describes a system that captures a patient's gait, infers health information, and assigns the patient to a disease-stage category. This matters for gait analysis, rehabilitation monitoring, neurological screening, and similar tools that infer health status from physical or biological signals.

Other key categories include health care eligibility, health and life insurance, emergency health care, and border-related health screening. A system that decides whether someone can access public health care benefits, prices individual health or life insurance, prioritizes emergency care, or flags a person for additional border health checks may be high risk. By contrast, ordinary appointment scheduling, patient identification, and transcription tools may fall outside these categories, depending on their function.

Health companies should assess each AI system on both a product-by-product basis and by function. The first step is to determine whether the system is a medical device, an in vitro diagnostic product, a safety component of one of those products, or a standalone service. The second step is to identify whether the system affects a sensitive health-related use, such as biometric health analysis, health care eligibility, health or life insurance pricing, emergency triage, or public health screening. Companies should also be precise when describing the system's intended purpose. A tool that detects fatigue, pain, or another physical state may raise different issues from a tool that claims to infer emotions. Similarly, a tool that supports a human decision-maker may be treated differently from a tool that materially influences the outcome for a patient, insured person, or emergency caller.

European Union Amends the AI Act Via Digital Omnibus

On June 29, 2026, the European Union adopted a new law aiming to streamline and simplify certain rules regarding AI. This new law, often called the "Digital Omnibus," is part of the European Union's broader simplification agenda, which encompasses a series of legislative packages intended to simplify existing EU rules to ease regulatory burdens for businesses across areas including digital regulation and AI. Among other things, the new law delayed the application of high-risk rules from August 2, 2026, to December 2, 2027, for standalone high-risk AI systems and to August 2, 2028, for high-risk AI systems embedded in products. Furthermore, with regard to the interplay of AI rules with sectoral legislation in sectors such as medical devices, the law provides a mechanism to resolve situations in which sectoral law has similar AI-specific requirements that are similar to those in the AI Act, by limiting the latter's application in those specific cases through implementing acts. The law also requires the Commission to provide guidance to assist economic operators of high-risk AI systems covered by sectoral harmonization legislation in complying with the high-risk requirements of the AI Act in a manner that minimizes the compliance burden.

The new law must be published in the EU Official Journal before it can enter into force.

European Commission Publishes Analysis Underpinning Proposed Biotech Act

On May 26, 2026, the Commission published its analysis underpinning the Proposal for a European Biotech Act. The Biotech Act was proposed on December 16, 2025, and aims to strengthen the European Union's biotechnology and biomanufacturing sectors, particularly in the area of health. The Biotech Act amends key legislation, including the EU Clinical Trials Regulation. Read more in Jones Day's Newsletter, "The Proposed European Biotech Act, 100 Days On."

European Commission Publishes New Guidance on Breakthrough Medical Devices

In December 2025, the European Commission Medical Device Coordination Group ("MDCG") published MDCG 2025-9, Guidance introducing the Breakthrough Devices framework under the Medical Devices Regulation (EU) 2017/745 ("MDR") and the In Vitro Diagnostic Regulation (EU) 2017/746 ("IVDR"). A medical device or in vitro diagnostic ("IVD") can be designated as a "breakthrough device" ("BtX") if it meets two criteria: first, it must introduce a high degree of novelty in its technology, clinical procedure, or application; and second, it must be reasonably expected to deliver a significant positive clinical impact for patients suffering from life-threatening or irreversibly debilitating diseases or conditions, either by outperforming available alternatives or by addressing an unmet medical need. Designation happens through a formal expert panel assessment.

A positive BtX designation unlocks a suite of practical benefits, including priority access to early scientific and regulatory advice from expert panels, structured and prioritized engagement with notified bodies, and the potential for accelerated conformity assessment timelines. In addition, where pre-market clinical evidence is sufficient but incomplete, notified bodies may issue certificates with specific conditions, such as defined post-market clinical follow-up or post-market performance follow-up obligations, linked to robust post-market evidence generation plans. The guidance also gives a high-level overview of available funding instruments to support innovation (e.g., EU4Health and the European Innovation Council Accelerator).

EMA Publishes Draft Guidance on the Conduct of Clinical Trials During Public Health Emergencies in the European Union and Public Consultation

On March 5, 2026, the EMA published the draft "Guidance on the conduct of clinical trials during public health emergencies" at the EU level ("Draft Guidance"). The Commission may declare a public health emergency at the EU level, including in pandemic situations, under Regulation (EU) 2022/2371 on serious cross-border threats to health.

The Draft Guidance, intended for sponsors and all parties involved in the design and conduct of clinical trials in the European Union, applies to both (i) the initiation of trials in response to a public health emergency ("PHE") and (ii) ongoing or planned clinical development activities that may continue during a PHE. It recommends a harmonized approach to ensure that clinical trials can be initiated, adapted, and continued efficiently and safely when PHEs arise. 

Of particular interest to digital health stakeholders, the Draft Guidance explicitly endorses decentralized clinical trial elements during emergencies. Sponsors are encouraged to consider whether site visits can be reduced or decentralized with technology, and the guidance adopts a risk-proportionate approach supporting expedited assessments, platform trial designs, and decentralized investigational product distribution. Cross-border transfer of trial participants and remote GCP inspections (both dependent on digital infrastructure) are also addressed. 

Drawing on COVID-19 lessons, in which isolated trials and compassionate use programs failed to produce robust data, the Draft Guidance prioritizes well-designed clinical trials over off-label use—strengthening the case for digitally enabled, scalable trial infrastructure. The Draft Guidance effectively codifies digital trial adaptations from COVID-19 as recognized regulatory options during PHEs, signaling regulatory validation of telemedicine, remote monitoring, and decentralized data collection. It also creates a preparedness incentive: sponsors are encouraged to engage proactively with the EMA's Emergency Task Force for trial design advice, suggesting that companies with digital-ready platforms will be better positioned when a PHE is declared.

A public consultation on the Draft Guidance closed on April 30, 2026. Once adopted, the Guidance will be kept up to date in line with future EU legislation or guidance related to PHEs and will be revised once the EU Clinical Trials Regulation amendments under the currently proposed European Biotech Act are adopted. Read more at Jones Day's EU Geopolitical Risk Update No. 125.

EU Parliament Reaches Political Agreement on the EU Pharmaceutical Package

On December 11, 2025, the European Parliament and Council reached a provisional political agreement on the most sweeping reform of pharmaceutical legislation in over 20 years (the "Pharma Package" or "Reform"). The goal of the Reform is twofold: (i) help ensure fair access to safe, effective, and affordable medicines across the European Union; and (ii) boost the competitiveness of the pharmaceutical industry. To do so, the Pharma Package proposes a number of reforms, including the revision of the regulatory, market and orphan protection, supply and shortage prevention obligations, the introduction of a transferable voucher for antimicrobial resistance incentives, revised marketing authorization timelines, and a clarification of the famous Bolar exemption. In addition, the Pharma Package introduces a number of significant digital health changes that collectively aim to future-proof the EU pharmaceutical regulatory framework for the digital age.

• Electronic Product Information ("ePI"). Perhaps the most visible digital health reform is the shift toward electronic product information. The new legislation provides a legal basis for ePI—the authorized, statutory product information for medicines (including the summary of product characteristics, package leaflet, and labelling) adapted for handling in electronic format and dissemination via the web and e-platforms. Under the new rules, Member States may decide that the package leaflet must be made available in paper format, electronically, or both. Crucially, ePI is designed to be interoperable with other electronic health care systems, including e-prescribing and HER systems, addressing longstanding limitations of paper-only leaflets. EMA published a draft implementation roadmap in March 2026 to ensure timely and coordinated delivery of ePI across the EU regulatory network.

• Real-World Data and Real-World Evidence. The Pharma Package expressly permits EMA to leverage personal health data from clinical trials "and other sources including real world data" to inform regulatory decision-making. The recitals indicate that such "other sources" could include data generated by computational and AI modeling, as well as data from the Data Analysis and Real World Interrogation Network and the European Health Data Space ("EHDS"). This represents a significant step in embedding real-world evidence into the regulatory life cycle and positions the Pharma Package as complementary to the EHDS Regulation, which entered into force on March 26, 2025.

• Regulatory Sandboxes for Innovative Medicines. For the first time in EU pharmaceutical law, the new regulation introduces regulatory "sandboxes" as a formal legislative tool. Under these provisions, the Commission may set up regulatory sandboxes under the direct supervision of competent authorities to allow the development and testing of new and innovative therapies that cannot be developed under current rules. EMA will be able to request that the Commission establish a sandbox to test requirements for innovative medicines. These sandboxes are particularly relevant for medicinal products that incorporate AI, machine learning, or digital health tools, where full compliance with the ordinary regulatory framework may not be achievable due to the inherent scientific or technical characteristics of the product. Notably, companies developing products at the intersection of medicines, devices, and digital health will need to navigate two parallel sandbox regimes: the Pharma Package sandbox and the AI Act sandbox.

The new framework is expected to become fully operational around 2028. For a general description of the EU Pharmaceutical Package, read our Commentary, The EU Pharma Package Is a Done Deal: A Holiday Gift, or Not?.

European Database on Medical Devices Modules Become Mandatory

The European Database on Medical Devices ("EUDAMED") is the European IT system established by European legislation on in vitro diagnostic medical devices (MDR and IVDR). EUDAMED aims to provide a living picture of the life cycle of medical devices that are made available in the European Union. It integrates different electronic systems to collate and process information about medical devices. Once fully operational, EUDAMED will consist of six modules, namely: (i) actor registration; (ii) UDI/device registration; (iii) notified bodies and certificates; (iv) market surveillance; (v) clinical investigations and performance studies; and (vi) vigilance and post-market surveillance.

As of May 28, 2026, use of the first four modules, summarized below, is mandatory:

• Actor registration. This module specifies that all economic operators (manufacturers, authorized representatives, sponsors of clinical investigations and performance studies, importers, and system and procedure pack producers) must register in the actor module and obtain a Single Registration Number, or SRN.

• UDI/device registration. This module covers the requirement that every medical device and IVD placed on the EU market must have a Unique Device Identifier ("UDI") and be registered in EUDAMED.

• Notified bodies and certificates. This module centralizes information about CE certificates issued under the MDR and IVDR. Certificates issued after the module becomes mandatory must be registered immediately upon issuance, and updates or decisions relating to pre-mandatory certificates must also be registered once issued after mandatory use begins. Notified bodies must complete the upload of relevant legacy certificate information by May 28, 2027.

• Market surveillance. This module supports national competent authorities and the European Commission in coordinating market surveillance activities using EUDAMED data. With this module now active, authorities will increasingly conduct surveillance activities within EUDAMED, and manufacturers should ensure their post-market surveillance and vigilance processes are aligned accordingly.

The remaining two modules, (i) clinical investigations and performance studies and (ii) vigilance and post-market surveillance, remain under development and are expected to become mandatory in 2027, although final dates depend on the Commission's official notice.

European Commission Publishes Frequently Asked Questions on the EHDS  

On March 26, 2026, marking the first anniversary of the entry into force of the EHDS Regulation, the Commission published a set of frequently asked questions ("FAQs") on the EHDS. The EHDS establishes a common framework for the use and exchange of electronic health data across the European Union. It operates across three pillars: primary use of health data for patient care, EHR system requirements for manufacturers, and secondary use of health data for research, innovation, and policymaking. Described as a "living document," the FAQs sets out the Commission's preliminary views on key implementation questions. 

With regard to primary use, the FAQs confirms that patients will benefit from additional rights, beyond those provided under the General Data Protection Regulation ("GDPR"), to access, control, and share "priority categories" of personal electronic health data (such as patient summaries, e-prescriptions, e-dispensations, medical imaging, test results, and discharge reports) through secure and free-of-charge health data access services. As to secondary use, the EHDS requires health data holders—a broad concept—to make in-scope electronic health data (such as EHR data, data generated by medical devices, and clinical trial data) available to authorized health data users for a closed list of permitted secondary uses, including scientific research. In this context, the FAQs confirm that the concept of "research" is "wide-ranging" and may cover activities carried out by both public and private organizations, including the training of AI algorithms intended for use in health care. On the requirements for EHR manufacturers, the FAQs clarify that EHR systems placed on the EU market must incorporate two harmonized software components—an interoperability component (enabling easy import and export of "priority category" data) and a logging component (generating access logs for transparency)—and that manufacturers must test these components in a European digital testing environment, draw up technical documentation, issue an EU declaration of conformity, affix the CE marking, and register their systems in a Commission-managed database.

Digital health stakeholders should closely monitor further developments as the Commission advances its work on the implementing acts that are expected to be adopted by March 2027, ahead of the first substantive obligations becoming applicable from March 2029. The FAQs offer a practical starting point for navigating the complexity of the EHDS and—as a living document—are expected to be updated as the implementation landscape takes shape. 

Belgium

Belgian Draft Law Would Amend Clinical Trial Legislation

On January 26, 2026, the Belgian Council of Ministers approved a draft law amending several national laws in the health sector. Among other things, the draft law proposes to amend the national law on clinical trials to provide for the remote distribution of investigational medicinal products. The draft law is currently being considered by the Council of State before it can be approved by Parliament. 

Belgium Announces Rare Diseases Plan  

On February 26, 2026, the Belgian Minister of Health, Frank Vandenbroucke, presented the Rare Diseases Plan 2026-2030 (the "Plan"), outlining Belgium's strategic approach to rare diseases for the coming years. Among other things, the Plan seeks to expand the Belgian Central Rare Diseases Registry, which currently covers only around 3.5% of rare disease patients, and align it with European initiatives, such as the European Reference Networks and the EHDS. A "mapping" (or translation) between the Belgian and international coding systems will be developed to further support standardized diagnosis registration and data sharing. 

Belgian Clinical Trials Dashboard Launches

On March 19, 2026, the Belgian Federal Agency for Medicines and Health Products ("FAGG/AFMPS") launched the "Dashboard Clinical Trials," an interactive dashboard providing up-to-date figures and statistics on clinical trials conducted in Belgium.

Drawing on data from the EU Clinical Trial Information System, the dashboard compiles all initial clinical trial applications that have received a decision since the EU Clinical Trials Regulation entered into force. It provides a comprehensive overview of the clinical research landscape in Belgium, including the evolution of trial activity, the different phases of trials, the therapeutic areas under investigation, and the timelines from submission to decision. The initiative reflects the agency's broader effort to promote transparency and strengthen Belgium's position as a hub for clinical research.

JAMS 2.0: Joint Inspection Campaign Reveals Universal Non-Conformities Among EU Medical Device Manufacturers

On January 20, 2026, the FAGG/AFMPS published the results of the JAMS 2.0 (Joint Action on Reinforced Market Surveillance of Medical Devices and In Vitro Medical Devices) inspection campaign, which it coordinated at the EU level. Between March 2024 and July 2025, 30 joint inspections of medical device (including in vitro devices) manufacturers were conducted across 14 European countries, with 21 Member State competent authorities participating. While no critical non-conformities were identified, every inspection revealed at least one non-conformity, underscoring the continued need for on-site scrutiny and for the industry to improve its compliance efforts. The main areas of non-compliance related to quality management systems, technical documentation, labeling, instructions for use, and post-market surveillance, and manufacturers were required to submit corrective action plans within a reasonable timeframe. The accompanying report sets out targeted guidelines for manufacturers, notified bodies, and competent authorities, and the campaign is regarded as a major step toward more consistent and effective market surveillance of medical devices across Europe. 

France 

French Authorities Publish Guidance on the Use of AI in Health Care  

On March 5, 2026, the French Health Authority and the French Data Protection Authority published draft guidance on the use of AI systems in health care settings. The guidance is aimed at health care professionals and institutions deploying AI systems that affect patient care, including tools used for diagnosis, treatment, care coordination, report drafting, triage and patient-flow management. The proposed guidance sets out a structured framework for responsible AI system deployment across the product's usage life cycle, covering internal governance, procurement and contractual arrangements, local validation, professional training, organization of care, use-phase controls, patient information and consent, automated decision-making and human oversight, traceability, vigilance, maintenance, performance monitoring, updates, quality management, end-of-life management, and generative AI-specific risks. In particular, deployers in the health care sector are expected to put in place adapted governance, maintain GDPR records of processing activities, carry out a data protection impact assessment where required, conduct a fundamental rights impact assessment where applicable under the EU AI Act, and notify supervisory authorities in the event of incidents or malfunctions. The guidance further emphasizes that AI systems used in health care may qualify as "high-risk AI systems" under the EU AI Act, requiring deployers of such systems to undertake the relevant practical compliance measures.

Ireland  

Ireland Launches National AI in Health and Social Care Strategy

On March 11, 2026, the Irish Minister for Health and the Irish public health and social care service, Health Service Executive ("HSE") launched "AI for Care—The Artificial Intelligence (AI) Strategy for Healthcare in Ireland 2026–2030." This is Ireland's first national strategy dedicated to the safe, responsible, and effective application of AI in health and social care. The strategy is accompanied by a dedicated AI Implementation Framework providing governance structures, EU AI Act compliance processes, and project-level guidance for deploying AI across the Irish health service. 

The strategy organizes AI deployment opportunities across four pillars, namely: 

• AI for Clinical Care, which focuses on enhancing diagnostics (radiology, cardiology, dermatology, endoscopy), clinical decision support, ambient clinical documentation, and patient self-management tools. Notably, many clinical AI solutions will be classified as "AI-as-a-medical-device" under the MDR and treated as high risk under the EU AI Act, requiring fundamental rights impact assessments and registration on AI registries.
• AI for Operations, which focuses on demand and capacity forecasting, HSE's contact center automation, supply chain optimization, and acceleration of Ireland's national EHR rollout.
• AI for Research & Innovation, which focuses on streamlining research governance, ethics approvals, clinical trial recruitment and management, and large-scale health data analysis. Of particular relevance to pharma and medtech companies, AI is expected to accelerate patient matching for clinical trials, improve data integrity, and support real-time safety monitoring.
• AI for Public Health, which focuses on population health risk prediction, population-based screening (including BreastCheck, CervicalCheck, BowelScreen, and Diabetic RetinaScreen), evidence synthesis, and data-driven policy creation.

The strategy maps these pillars onto a five-year deployment roadmap (2026–2030), prioritizing AI opportunities across three horizons: "Now" (Year 1), "Next" (Years 2–3), and "Future" (Years 4–5), with each opportunity progressing through proof of concept, pilot, and national scaling. 

Compliance with the EU AI Act is a central theme throughout the strategy, and the Irish government's forthcoming national legislation will provide for full implementation and enforcement at the domestic level. In parallel, the Health Information and Quality Authority is developing National Guidance for the Responsible and Safe Use of AI in Health and Social Care, designed to complement the strategy and support compliance with the EU AI Act and other relevant regulations. 

The Netherlands

Dutch Data Protection Authority Publishes Guidance "Health Data in the Cloud"

On March 23, 2026, the Dutch Data Protection Authority published an updated practical guide entitled "Health Data in the Cloud," replacing its earlier 2017 guide, which focused solely on patient data within the treatment relationship. The new guide has a significantly broader scope, covering health data in the widest sense (including medical records, occupational health data, test results, and data from digital health applications) and addressing the roles and responsibilities of all parties involved in the processing chain, such as health care providers, occupational health services, IT vendors, and other partners. The guide covers topics including the responsibilities of data controllers, the role of processors and sub-processors, risk assessments, data sovereignty, international data transfers, and the interplay between the GDPR and the forthcoming Dutch Cybersecurity Act (NIS2 transposition).

United Kingdom

United Kingdom Amends Clinical Trials Regulations 

On April 28, 2026, amendments to the Medicines for Human Use (Clinical Trials) Regulations 2004, together with the implementation of ICH E6(R2) Good Clinical Practice ("GCP"), came into force across England, Wales, Scotland, and Northern Ireland. Key measures include: (i) embedding the combined review process (coordinated Medicines and Healthcare products Regulatory Agency ("MHRA") and Research Ethics Committee approval within 30 calendar days) as the standard route, with a new 14-day notification scheme for lower-risk trials using authorized medicines within licensed indications; (ii) introducing mandatory clinical trial registration on a public registry, publication of results within 12 months of completion, and provision of lay summaries to participants; (iii) converting previous policy expectations into enforceable legal obligations; (iv) simplifying safety reporting by removing duplicative SUSAR and annual safety reporting to both the MHRA and RECs (now MHRA only); and (v) embedding quality-by-design and risk-proportional monitoring principles through the updated ICH-GCP E6(R3) guidelines. Trials submitted before April 28, 2026, will generally continue under existing regulations for certain purposes, although most GCP conduct changes will apply to all CTIMPs from that date. The MHRA and HRA have published comprehensive guidance to support the transition, and sponsors, investigators, and trial teams should review and update internal policies, processes, and systems ahead of the implementation date. 

Cyber Security and Resilience Bill Continues Through Legislative Process  

The United Kingdom's Cyber Security and Resilience (Network and Information Systems) Bill (the "Bill") received its second reading in the House of Commons in January 2026 and has now moved to the committee review stage. The Bill proposes to strengthen UK cyber defenses for essential public services, including health care. Key measures include: (i) bringing managed service providers (such as companies providing IT management, help desk support, and cyber security services to the National Health Service ("NHS")) into regulatory scope for the first time; (ii) empowering regulators to designate certain suppliers as "critical suppliers" where their goods or services are judged to be so critical that an incident could cause significant disruption; (iii) requiring organizations in scope to report significant cyber incidents to their regulator and the National Cyber Security Centre within 24 hours, with a full report within 72 hours; and (iv) introducing turnover-based penalties for serious breaches. NHS England and Department of Health and Social Care ("DHSC") have been moving to operationalize supply chain cyber resilience: a voluntary Cyber Security Supply Chain Charter was issued in May 2025, with suppliers beginning to sign up from November 2025. From January 2026, NHS England and contracting authorities began directly contacting suppliers to discuss key cyber security controls, request supporting evidence where services are critical to patient care, and agree proportionate remediation activity. Digital health companies supplying products or services to the NHS are encouraged to prepare by reviewing the Charter expectations, maintaining Data Security and Protection Toolkit compliance, applying multifactor authentication, and ensuring tested recovery plans are in place.

United Kingdom and United States Announce Regulatory Cooperation on Medical Devices 

On April 2, 2026, the MHRA and the FDA announced strengthened cooperation on medical device regulation, as part of a broader U.S.–UK pharmaceutical partnership that removes tariffs on UK medicines exports and encourages earlier UK launches of new treatments. The two regulators will work together on options to improve and align medical device regulations, including exploring future mutual recognition mechanisms to reduce duplication for manufacturers and streamline approval processes, while maintaining independent decision-making and strict safety standards. Technical work between the MHRA and FDA is expected to continue over the coming months to assess opportunities for closer alignment. The announcement signals the United Kingdom's ambition to position itself as a preferred global launch market for health-tech innovation and may have practical implications for companies navigating parallel U.S. and UK regulatory pathways for medical devices.

MHRA Consults on Indefinite Recognition of CE-Marked Medical Devices 

On February 16, 2026, the MHRA opened a targeted consultation on proposals to indefinitely recognize medical devices complying with the EU MDR and EU IVDR in Great Britain, as well as extending transitional arrangements for devices compliant with the Medical Device Directive ("MDD") to align with EU transition timelines. The consultation also seeks views on a proposed international reliance route for devices classified higher in Great Britain than in the European Union. The consultation closes on April 10, 2026. It forms part of a broader package of medical device regulatory reforms announced by the MHRA in July 2025, including a pre-market statutory instrument ("SI") that will introduce a new framework for international reliance (enabling swifter access for devices approved by comparable regulators in Australia, Canada, and the United States), requirements for unique device identification ("UDI"), strengthened technical documentation requirements, and closer alignment of essential requirements with those of the European Union. It is understood that the MHRA intended to notify the pre-market SI to the World Trade Organization, with parliamentary laying and implementation anticipated in late 2026, though the full details of the changes remain to be confirmed. 

MHRA National Commission Calls for Information on the Regulation of AI in Health Care 

Established in September 2025 by the MHRA, the National Commission is an independent advisory body tasked with recommending a new regulatory framework for AI in health care. A Call for Evidence ran from December 2025 to February 2026, seeking views on the sufficiency of the current regulatory framework, approaches to post-market safety, and how responsibility and liability should be managed across the AI medical device life cycle. At its February 2026 meeting, the Commission explored a theoretical "earned autonomy" model, under which developers with strong post-market surveillance track records could benefit from a more streamlined pre-market process. Commissioners noted that regulating AI-driven devices is unlikely to be achieved through incremental changes to the current system and confirmed that the Commission will consider approaches to agentic AI at its April 2026 meeting. Final recommendations are expected in summer 2026. 

NHS Moves Toward Launch of Innovator Passports 

In July 2025, the DHSC and NHS England announced the introduction of "innovator passports," designed to eliminate duplicative compliance assessments across the NHS by allowing a technology that has been robustly assessed by one NHS organization to be adopted by others without repeated local review. The initiative aims to accelerate adoption of proven health technologies across the NHS, reduce administrative burden on both suppliers and trusts, and support the United Kingdom's positioning as a global launch market for medical technology. The system is expected to be piloted through 2026, with full implementation expected in 2027. 

MHRA Expands AI Airlock Regulatory Sandbox Program 

On April 8, 2026, the MHRA announced a £3.6 million funding commitment from the DHSC over the next three years to expand its AI Airlock program, the United Kingdom's first regulatory sandbox for AI as a Medical Device ("AIaMD"). Launched in 2024, the program brings together the MHRA, DHSC, the NHS, UK Approved Bodies, and other regulators to identify and address novel regulatory challenges for AIaMD through real-world product testing. The pilot phase was completed April 2025. Phase two ran until March 2026, with reporting expected in summer 2026. Insights from the AI Airlock are feeding directly into the National Commission's work on AI regulation (see above). Details of phase three design and a call for applications are expected later in 2026. 

NHS Shares Details on NHS Online Launch 

Announced in September 2025 by the NHS, NHS Online will be a fully virtual hospital connecting patients to specialist clinicians across England through the NHS App, with first patients expected from 2027. NHS Online represents a significant shift from locality-based to national, digitally enabled specialist care, with potential implications for health-tech procurement, clinical workforce models, and the regulatory environment for digital health tools deployed at scale. In January 2026, the NHS confirmed nine priority treatment areas for launch, including glaucoma, cataracts, inflammatory bowel disease, prostate conditions, and menopause and menstrual issues. The service is expected to deliver up to 8.5 million virtual appointments in its first three years. A dedicated NHS Online website is expected to launch in summer 2026. 

Lawyer Spotlight 

Amanda Fitzsimmons (San Diego, Cybersecurity, Privacy & Data Protection) is a technology litigator who represents companies in high-stakes disputes and investigations involving digital platforms, data practices, and emerging technologies. She handles complex litigation and regulatory matters covering issues that increasingly affect digital health companies, such as privacy, cybersecurity, and consumer protection risks. Amanda has experience defending clients in class actions, FTC and state regulatory investigations, and incident-driven disputes. She also advises companies responding to cybersecurity incidents and data breaches, helping them navigate parallel litigation, regulatory scrutiny, and business risk. Amanda has in-house experience as head of commercial litigation and head of counsel. 

Carl Kukkonen (San Diego, Intellectual Property, Technology) is a leading authority on intellectual property and a trusted advisor to companies at the forefront of digital health, AI-based surgical systems, medication delivery systems, and connected medical devices. Drawing on more than 25 years of experience, Carl helps clients build litigation-ready patent portfolios, delivers mission-critical IP and AI due diligence in M&A and financing transactions, and counsels on proprietary model protection and the evolving IP ownership landscape of AI-assisted innovation. His deep technical fluency enables him to bridge the gap between complex hardware and digital health software, securing robust global protection for connected ecosystems, sensor integration, wireless health care, and advanced patient monitoring technologies.

Recent and Upcoming Speaking Engagements

Laura Koman, AHLA Annual Meeting (June 2026), "Navigating the Women's Health Triumvirate: Access, Research, and Investment in a Volatile Regulatory Era." 

Gerry Griffith, AHLA Health Care Transactions Conference (April 2026), "Welcome to Lake Wobegon—Dealing with High-End Physician Compensation." 

Jessica Sarkis, Informa Connect Speaker Programs Summit 2026 (March 2026), "DOJ Enforcement Forecasting." 

Jessica Sarkis, Federal Bar Association Qui Tam Conference (February 2026), "False Claims Act Liability for Anti-Kickback Statute Violations."

In Case You Missed It

ACCESS Granted: Outcome and Value-Based CMS Model for Digital Health Management

Doctolib Acquires Medicus Health

MGI Tech Sells Complete Genomics to Swiss Rockets

The UK's MHRA Opens Public Consultation on Indefinite CE Mark Recognition of Medical Devices and IVDs

HHS Signals Policy Direction to Accelerate Adoption of AI in Clinical Care

Innovative Insights: Legal Updates in the Life Sciences – Second Quarter 2026

Trump Administration Updates for the Life Sciences Industry Q1 2026

White House Unveils National AI Legislative Framework

A Relaxing 2026? FDA Updates General Wellness and Clinical Decision Support Software Guidance

EMA and FDA Align on Good AI Practice in Drug Development

EU Geopolitical Risk Update—Key Policy & Regulatory Developments No. 125

The EU Pharma Package Is a Done Deal: A Holiday Gift, or Not?