Regulatory Updates

Provisional Agreement Reached on the EU AI Act. On December 9, the European Parliament (EP) and European Council announced that it had reached a provisional agreement on the text of the EU AI Act that seeks to harmonize rules on AI (see our November 2022, January 2023, and June 2023 digests, as well as our July 2023 Advisory, for details of how the negotiations have progressed). As we have previously set out, all AI medical devices will be classified as high risk, meaning they will be assessed before being put on the market and also throughout their lifecycle. In addition, some compromises that could be relevant to digital health companies are:

  • All high-risk AI systems (which includes all health care applications) will be subject to a mandatory fundamental rights impact assessment prior to their use.
  • AI systems can be tested in real-world conditions subject to specific conditions and safeguards being fulfilled.

Now, the EP and European Council must formally adopt the text, with the act expected to become law early in 2024 and to apply two years after its entry into force, except for some specific provisions which will apply earlier. Furthermore, the commission has announced it will be launching an AI Pact to encourage AI developers to implement key obligations of the AI Act ahead of the legislative deadlines.

The HMA and EMA Publish Their Joint AI Workplan 2023-2028. On December 18, the joint Heads of Medicines Agencies and European Medicines Agency Big Data Steering Group (BDSG) published the 2023-2028 AI workplan, on behalf of the European medicines regulatory network (EMRN). The plan aims to utilize the benefits of AI in the regulation of medicines while managing the associated challenges and risks. The workplan is divided into four arms:

  1. Guidance, policy, and product support. The EMRN will consider feedback from the public consultation on the AI reflection paper (discussed in our August 2023 digest) and use that to provide continued support on the development and evaluation of AI in the medicines lifecycle, including releasing guidance on specific parts of the lifecycle (e.g., pharmacovigilance). The EMRN will also start preparation for implementation of the AI Act in mid-2024.
  2. Tools and technologies. The EMRN aims to develop and implement knowledge mining tools, start a phased roll-out of large language models, and publish an AI tools policy for open and collaborative AI development.
  3. Collaboration and change management. The EMRN will continue to collaborate with international partners to share knowledge and keep abreast of the evolving field of AI.
  4. Experimentation. The EMRN will conduct six monthly experimentation cycles and undertake "technical deep dives" to gain new insights from AI.

The BDSG states that the workplan will be regularly updated to reflect the evolving technologies and policies, and that key stakeholders will be involved in the implementation of the plan.

Privacy Updates

European Council and European Parliament Adopt Positions on the Regulation Creating a European Health Data Space. On December 6, the Council of the European Union adopted its position on the text of the regulation on creating a European Health Data Space, which was followed by the adoption of a position by the members of the European Parliament on December 13. The European Council and the EP must now reach a common provisional agreement on the regulation before it can be formally adopted.

On December 1, the European Federation of Pharmaceutical Industries and Associations (EFPIA) reacted to the position of the members of the European Parliament on the regulation creating a European Health Data Space (EHDS), showing a particular concern over the inclusion of opt-in and opt-out mechanisms. According to EFPIA, for certain categories of data such as data concerning rare disease patients, including such mechanisms would discourage the submission of data to the EHDS. Less data means less information, which would hinder the evolution of personalized treatments. In addition, EFPIA calls for clarification on how provisions on IP and trade secret data will coexist with the EHDS regulation, and on each of the types of data and their intended scope.

Product Liability Updates

Provisional Agreement Reached on the New EU Product Liability Directive. On December 14, a provisional political agreement was reached between the European Parliament and European Council on the commission's proposal for a revised Product Liability Directive (revised PLD) to replace the existing Product Liability Directive (85/374/EEC) and expand its scope to include AI systems and software. Both the EP and the European Council have previously set out their positions (see our November 2022, July 2023, and November 2023 digests) and now a compromise text has been announced. Key compromises include:

  • The definition of "product" will include digital manufacturing files and software, but the rules will not apply to free and open-source software developed or supplied outside of a commercial activity.
  • A company that makes substantial modifications to a product can be held liable as a manufacturer, as well as importers, authorized representatives, or fulfilment service providers if a manufacturer is established outside of the EU.
  • The burden of proof for claimants has been simplified such that defectiveness may be presumed in certain circumstances, for example where the claimant faces excessive difficulties in doing so due to technical or scientific complexities.
  • An extended liability period of 25 years will applyr in exceptional cases.

The revised PLD is set to enter into force once formally approved by the EP and the European Council, with the new rules applying to products on the market 24 months after entry into force. The AI Liability Directive is still being examined by the EP and the European Council.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.