The EU Biotech Act Puts Medical AI Safeguards at a Crossroads

The EU Biotech Act aims to speed up trials and revive Europe’s biotech sector. But its sister proposal for medical devices carries a hidden cost.

It would keep AI-enabled devices labelled “high-risk” while removing most of the safeguards behind that label, and some argue the cuts land in the wrong place.

Image

Inside the EU Health Package and Europe’s Regulatory Ambitions

As part of Europe’s wider Life Sciences Strategy, the EU Biotech Act promises faster clinical trials, stronger investment, and a more competitive European biotechnology sector.

Yet a parallel reform of medical device legislation raises the difficult question whether Europe can accelerate health innovation without weakening the safeguards that make it trustworthy.

The potential consequences of changing how AI-enabled medical devices are regulated could be enormous and together, these policy developments expose a strategic choice for pharmaceutical leaders, technology developers, and regulators.

On 16 December 2025, the European Commission introduced a package of health policy proposals intended to strengthen Europe’s position in biotechnology, improve the efficiency of medical device regulation, and address cardiovascular disease.

The package brought together three distinct initiatives of the proposed European Biotech Act, a targeted revision of the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), and the Safe Hearts Plan.

The initiatives address different problems, but they share a common political objective. Europe wants to translate more of its scientific capability into commercially viable products, reduce unnecessary administrative burdens, and improve access to innovation.

The Commission also wants to reinforce the region’s capacity to manufacture strategically important health products and compete with other major biotechnology markets.

For the industry, this is more than a regulatory housekeeping exercise. The proposals touch clinical development, advanced therapies, diagnostic technologies, digital health, manufacturing investment, and the use of artificial intelligence (AI).

They could influence where companies establish operations, how they structure clinical programmes, and which technologies they prioritise for development.

The European Commission’s official Biotech Act proposal sets out a broad strategy for strengthening health biotechnology.

It aims to connect research, investment, development, and manufacturing more effectively.

Measures include faster clinical trial authorisation, improved access to capital, support for strategic projects, regulatory sandboxes, and greater use of digital technologies.

These objectives respond to a genuine competitiveness problem. Strong academic research does not automatically produce successful medicines, scalable manufacturing, or commercially sustainable biotechnology businesses.

Companies must navigate funding constraints, regulatory requirements, fragmented ecosystems, and the practical challenge of moving discoveries from laboratories into clinical development and routine healthcare.

The proposed reforms seek to address these barriers. However, the medical device component raises a separate question about how simplification should work when AI introduces risks that existing product regulations may not fully address.

Those examining this tension have a central concern that the reforms could retain a high-risk classification while removing many of the obligations that give that classification practical meaning.

The significance lies in the wider policy context. Europe is pursuing faster innovation across healthcare while reconsidering the safeguards governing technologies that increasingly support clinical decisions. Those two ambitions need to work together.

What Does the EU Biotech Act Mean for Pharmaceutical Development?

The European Biotech Act is a proposed regulation designed to strengthen the EU’s biotechnology and biomanufacturing sectors, particularly in health.

Published by the Commission on 16 December 2025, it seeks to improve the conditions in which companies discover, develop, manufacture, and commercialise biotechnology products.

The proposal also reflects a broader concern about Europe’s ability to turn scientific excellence into industrial leadership.

Biotechnology depends on more than research funding. It requires reliable development pathways, specialist manufacturing capacity, access to investment, suitable infrastructure, and predictable rules for bringing new products to market.

The Commission’s approach therefore combines regulatory reform with measures intended to improve the wider business environment.

Faster clinical trials and more coordinated authorisation

Clinical development is one of the most consequential areas of the proposal.

Multinational trials must satisfy common requirements while interacting with national authorities, ethics processes, clinical sites, and local healthcare systems. Coordination can become particularly challenging when a study spans several Member States.

The proposed reforms seek to shorten authorisation timelines and give the reporting Member State a stronger coordinating role.

Under the Commission’s plan, the overall authorisation process for multinational trials would become faster, while the assessment conducted by the reporting Member State would carry greater weight across participating countries.

The proposal also addresses changes to trials after authorisation. It envisages more flexible handling of substantial modifications, a new category for low-intervention trials, and arrangements that could allow investigational medicinal products to reach patients directly in appropriate circumstances.

These measures matter to companies developing complex therapies, including products that require specialised clinical infrastructure or involve small patient populations. Better coordination could make it easier to operate multinational studies and reduce delays between regulatory submission and trial initiation.

Enacted in January 2026, the FAST-EU pilot is a 23-Member State fast-track initiative for clinical trial authorisations and it provides the first real-world stress test of the Proposal’s ambition to reduce authorisation timelines.

However, shorter timelines do not automatically translate into better development outcomes.

Companies will still need robust protocols, suitable investigators, reliable data, and appropriate patient recruitment. The value of acceleration depends on whether the system removes avoidable administrative friction without compromising scientific review or patient protection.

Image

Investment, manufacturing, and strategic projects

The proposal also seeks to improve access to finance, particularly for start-ups and small and medium-sized enterprises.

Biotechnology companies can require substantial capital long before a product generates revenue.

Advanced therapies and other complex biological products may also require specialist facilities, demanding quality systems, and significant investment in process development.

The Commission has proposed a health biotechnology investment pilot with the European Investment Bank, intended to mobilise up to €10 billion during 2026 and 2027.

The Act also introduces a strategic project concept intended to support high-impact initiatives through measures such as faster permitting and improved access to funding opportunities.

If implemented effectively, these provisions could help address bottlenecks that prevent promising technologies from reaching commercial scale.

The important question is whether support reaches the parts of the development chain where Europe faces its greatest limitations.

Early-stage discovery funding alone will not secure industrial competitiveness if companies still struggle to finance clinical development, build manufacturing capacity, or establish commercially viable production.

The same principle applies to regulatory reform. A faster authorisation process is valuable, but its effect will remain limited if companies encounter other delays during development, certification, scale-up, or market access.

Digital tools and AI become part of the development agenda

The EU Biotech Act also supports greater use of AI, digital tools, and health data in biotechnology and clinical development.

These technologies could help researchers identify promising candidates, improve trial planning, support patient recruitment, and analyse complex datasets.

Their contribution will depend on the quality of the underlying data, the suitability of the models, and the way organisations integrate them into regulated workflows. A predictive tool that performs well in development may not behave equally well across different patient populations, clinical settings, or healthcare systems.

This distinction matters because the EU’s digital health agenda intersects with its medical device framework.

Some AI applications support research or administrative tasks. Others influence diagnosis, treatment decisions, patient monitoring, or the interpretation of clinical evidence. These uses do not carry identical risks.

The policy challenge is therefore not simply to encourage more AI but to establish conditions in which companies can deploy useful technologies while maintaining appropriate oversight, accountability, and evidence standards.

That challenge connects the Biotech Act to the proposed revisions of the MDR and IVDR. The first initiative seeks to strengthen biotechnology development. The second could change the obligations that apply to certain AI-enabled medical technologies used in healthcare.

The two reforms should be assessed as parts of the same innovation environment, rather than as isolated legislative projects.

Read Maximise Pharma Innovation With Quality-by-Design

Maximise Pharma Innovation With Quality-by-Design

Find out how Quality-by-Design improves reliability and compliance in pharma and how you can maximise innovation through quality-based pharma development systems.

Why Does the EU Medical Device Reform Change the EU AI Act’s Practical Effect?

The MDR and IVDR govern medical devices and in vitro diagnostic medical devices placed on the EU market.

They establish requirements covering safety, performance, clinical evidence, conformity assessment, and post-market responsibilities.

The regulations also affect software that meets the relevant definition of a medical device. This includes certain AI-enabled products used to support diagnosis, interpret clinical information, or guide healthcare decisions.

The Commission’s proposed device reforms aim to address concerns about cost, complexity, certification capacity, and regulatory delays.

The proposals include changes to selected risk classifications, adjustments to certification and reporting requirements, greater use of digital procedures, and measures intended to make conformity assessment more predictable.

For smaller developers, the cost and time required to obtain certification can be material barriers to market entry. For established manufacturers, uncertainty about timelines and evidence requirements can complicate product planning and investment decisions.

The case for improving the system is therefore credible. The question is whether the proposed changes target the causes of delay without removing protections needed to manage risks specific to AI.

How the AI Act currently fits alongside device law

The EU AI Act, adopted in 2024, introduced a horizontal framework for AI-related risks across multiple sectors.

It includes provisions for AI systems used as safety components of products regulated under specified EU harmonisation legislation, including medical devices and in vitro diagnostics.

Under the framework relevant AI systems fall within Annex I, Section A, and are subject to the AI Act’s high-risk requirements where the applicable conditions are met.

Manufacturers must also comply with the relevant sector-specific legislation.

These are connected obligations, but they do not necessarily require two separate product approval procedures. The AI Act provides for its requirements to be addressed through the applicable conformity assessment process under the sectoral legislation.

It also contains provisions intended to avoid duplicating technical documentation.

That’s important because regulatory burden arises from different sources. Some requirements may overlap in documentation or process, while others address risks that device legislation does not cover in the same way.

The EU AI Act’s high-risk framework includes requirements relating to risk management, data and data governance, technical documentation, transparency, human oversight, and post-market monitoring.

These provisions reflect characteristics of AI systems that can make their behaviour difficult to assess through a conventional product safety model alone.

For example, an algorithm may perform differently across demographic groups because the data used to develop or test it do not adequately represent the intended population. A system may also produce different results when deployed in a hospital with different workflows, equipment, or patient characteristics.

Some risks only become visible after implementation. A model’s performance may deteriorate as clinical practice changes, the patient population shifts, or the data supplied to the system diverge from the conditions under which it was evaluated.

These challenges mean that regulators need tools to assess both product performance and the circumstances in which a product is used.

Image

The proposed classification change

A lot of concerns centre on a proposed change that would move AI-enabled medical devices from Section A to Section B of Annex I to the AI Act.

The significance lies in the legal consequences of that classification systems placed in Section B would fall outside the high-risk regime in Chapter III, leaving only a narrower set of provisions applicable to them.

As a result, several substantive AI-specific obligations could cease to apply to the affected devices.

These include requirements concerning data governance, risk management, transparency, human oversight, and post-market monitoring.

The proposal could also remove corresponding EU-level duties for healthcare organisations and other deployers, including aspects of staff training, monitoring, and record-keeping.

The devices could still be described as high-risk in the relevant regulatory context, yet no longer face many of the obligations normally associated with that designation under the AI Act.

A classification is useful only when its practical consequences are clear. If a category retains its high-risk label but loses most of the duties intended to manage high-risk AI, the framework becomes harder to interpret.

There is also an important distinction between product safety and broader concerns about the effects of AI in healthcare.

The MDR and IVDR focus on the safety and performance of medical products.

The AI Act adds a wider perspective, including risks relating to discrimination, fundamental rights, and the conditions under which people interact with AI systems.

Removing AI-specific duties would therefore raise more than a technical question about regulatory overlap. It would affect how the EU allocates responsibility for managing AI risks across manufacturers, healthcare organisations, and other actors.

The proposal remains subject to the EU legislative process. Nevertheless, the changes warrant close attention from pharmaceutical companies that develop, purchase, integrate, or depend on AI-enabled medical technologies.

The central issue is whether Europe can make compliance more efficient without creating gaps between the risks that regulators identify and the safeguards that companies must provide.

Read The Looming Threat of Geopolitical Risk in Clinical Supply Chains

The Looming Threat of Geopolitical Risk in Clinical Supply Chains

Geopolitical risk is reshaping how clinical supply chains are managed, demanding resilience and foresight. Learn why building supply chain resilience is the key for clinical trial success.

Image

What Is at Stake for Pharma, Patients, and Health Equity

Pharmaceutical companies increasingly rely on digital diagnostics, AI-supported clinical workflows, real-world data, and software that helps clinicians interpret complex information.

They may develop these technologies directly, acquire them, license them, or depend on them through partnerships with diagnostic and digital health companies.

Changes to the regulatory framework could affect product development, procurement, clinical evidence, liability, and the confidence of healthcare organisations adopting these technologies.

Three issues deserve particular attention.

Patient safety and unequal performance

AI performance is not determined by technical accuracy alone. It also depends on the population represented in the development data, the intended use, the clinical environment, and the decisions people make using the output.

A model trained predominantly on data from one population may perform less reliably in another. Differences in disease prevalence, clinical practice, equipment, and patient characteristics can influence results. Even when a system performs well overall, it may produce poorer outcomes for specific groups.

These problems can be difficult to identify through pre-market testing alone. A diagnostic tool might demonstrate acceptable performance in a controlled evaluation but deliver less consistent results after deployment across hospitals with different patient populations.

The consequences could be significant. An unreliable diagnostic output may delay treatment, prompt unnecessary investigations, or lead clinicians to overlook a patient's condition.

Where an AI system supports treatment selection, inconsistent performance could also affect the quality of clinical decisions.

The MDR and IVDR address important aspects of device safety and performance.

However, many argue that they do not fully address every risk associated with AI use in real clinical settings. In particular, there is concern about contextual bias and the importance of monitoring how systems perform after deployment.

There is an important distinction between technical and contextual performance. A model may operate as designed while still producing inequitable outcomes because of the environment in which people use it. A hospital might also lack the staff, training, or infrastructure needed to identify and respond to poor performance.

The AI Act’s deployer-related obligations are relevant here. Training, monitoring, and record-keeping can help healthcare organisations identify problems that manufacturers may not see from product-level testing alone.

If those obligations disappear at EU level, responsibility could become more dependent on national law and local practice. Some healthcare systems may maintain strong monitoring arrangements. Others may have fewer resources or less specific guidance.

The risk is not simply that an AI product might fail but that the failures affecting particular patients could remain undetected for longer.

Post-market monitoring should therefore be considered a core element of trustworthy clinical AI. Companies need to understand how products perform in routine use, not only how they perform under controlled development conditions.

This is especially relevant when AI supports companion diagnostics, patient stratification, clinical trial eligibility, or treatment decisions. In these settings, inconsistent performance can affect both individual care and the quality of evidence generated across a development programme.

Regulatory uncertainty and accountability

The second concern is legal predictability. Companies need to know which obligations apply to their products, which evidence they must generate, and who is responsible when something goes wrong.

A simpler framework could help businesses plan development and allocate resources. A framework that removes obligations without establishing an equally clear alternative could have the opposite effect.

There is a possibility that a shift towards sector-specific regulation could create uneven requirements across different product categories.

If the AI Act no longer provides a consistent baseline for affected medical devices, companies may have to navigate different combinations of requirements depending on the product and the applicable national rules.

This could complicate decisions about product architecture, market entry, partnerships, and post-market support. It may also make it harder for healthcare organisations to compare products when the underlying responsibilities and monitoring arrangements differ.

Accountability presents another challenge. AI-enabled healthcare products involve several actors, including developers, manufacturers, distributors, healthcare providers, and clinicians. Each may control different parts of the system's performance.

Manufacturers influence design, training data, testing, documentation, and updates. Healthcare organisations determine how systems are introduced into clinical workflows and whether staff receive suitable training. Clinicians interpret outputs in the context of individual patients.

Effective oversight needs to recognise these different roles. A manufacturer cannot control every local condition, while a hospital cannot independently verify every technical characteristic of a complex AI model.

The regulatory framework should establish responsibilities that match each actor’s influence over the risks.

Removing deployer obligations without providing an effective alternative could leave important gaps in monitoring and accountability.

The wider legal environment also remains complex.

The EU has not established a dedicated, comprehensive AI liability regime that resolves every question about harm caused by AI systems.

General product liability, national liability rules, professional duties, and sector-specific legislation may all be relevant, depending on the circumstances.

Lighter regulatory obligations do not mean lower legal or commercial risk. If formal requirements become less clear, companies may face greater uncertainty when negotiating contracts, allocating liability, or responding to incidents.

For businesses developing or purchasing clinical AI, maintaining strong internal governance may offer greater practical value than relying on the minimum obligations expected under a changing legislative framework.

Competitiveness depends on trust as well as speed

The EU Commission’s competitiveness agenda addresses a legitimate concern. Excessive administrative burdens can discourage investment, delay access to useful technologies, and place smaller developers at a disadvantage.

However, regulatory competitiveness depends on whether healthcare organisations trust the products entering the market, whether investors can assess the risks, and whether companies can operate across jurisdictions without encountering contradictory expectations.

Trust influences adoption. Hospitals must be confident that AI tools are suitable for their patients, that staff understand their limitations, and that problems can be identified and addressed.

Pharmaceutical companies need confidence in the diagnostic and digital systems that support their development programmes and clinical decisions.

Weakening the perceived reliability of oversight could therefore undermine the commercial objectives of simplification.

A product may reach the market faster but encounter resistance from purchasers, clinicians, or health systems if its performance and accountability arrangements remain unclear.

This concern is particularly relevant to companion diagnostics and other AI-enabled tools connected to precision medicine.

Development increasingly depends on identifying appropriate patients, interpreting complex biological information, and matching interventions to individual characteristics.

Diagnostic technologies can influence which patients enter trials and how treatment decisions are made.

Where those technologies produce unreliable or uneven results, the consequences may extend beyond the device itself. They can affect patient selection, clinical evidence, and confidence in the wider treatment pathway.

Any competitiveness strategy should therefore consider the full pathway from innovation to adoption. Speed creates value only when the resulting technology can be used safely, consistently, and with confidence.

Simplify the Process Without Weakening AI Safeguards

There are legitimately recognised difficulties created by device regulation and the need to improve efficiency. But the concern is that removing substantive AI safeguards may not address the main sources of administrative burden.

For policymakers they need to understand that delays arise from limited notified body capacity, fragmented documentation, unclear guidance, or repetitive procedures; reforms should target those problems directly.

Removing risk-management or monitoring obligations changes what companies and healthcare organisations must do to manage the technology, rather than simply making compliance more efficient.

A more coherent approach could combine several measures:

• Increase conformity assessment capacity. Additional expertise and better-resourced notified bodies could help address delays without lowering the quality of review.
• Align documentation and guidance. Clearer coordination between AI and medical device requirements could reduce duplication and uncertainty about the evidence companies must provide.
• Digitalise regulatory processes. Standardised electronic submissions and reporting could make information easier to prepare, review, and maintain.
• Strengthen lifecycle oversight. Consistent monitoring, incident reporting, and mechanisms for identifying changes in performance could help regulators and manufacturers detect problems earlier.
• Clarify responsibilities. Manufacturers, healthcare organisations, and other deployers need clear expectations that reflect their respective roles in managing risk.

These measures would not remove every cost. They would, however, target process inefficiencies while retaining protections that address the distinctive characteristics of AI.

Three legislative considerations for decision-makers

There are several possible routes for maintaining a coherent approach to AI-enabled medical devices.

The preferred initiative is to preserve the relevant devices within Section A of Annex I to the AI Act and allow targeted adjustments through sectoral legislation where equivalent or stronger protection can be demonstrated.

An alternative would be to place certain categories of AI systems within Annex III through implementing measures. This could provide a route for more tailored treatment of particular AI systems, depending on the applicable legal criteria.

A fallback would be to embed equivalent AI-specific safeguards directly into the MDR and IVDR if the horizontal approach were abandoned.

The concerns arise about whether product-focused legislation could adequately accommodate all the responsibilities and fundamental-rights considerations covered by the AI Act.

Each route presents different implementation questions. The essential principle is that any reduction in obligations should follow a transparent assessment of whether the remaining framework provides equivalent protection.

The legislative context also matters.

The Digital Omnibus negotiations offer a useful comparison. The compromise reached on 8 July 2026 retained AI-enabled medical devices within Section A, while allowing scope for specific obligations to be limited through delegated acts where sectoral legislation provides equal or stronger protection.

That outcome illustrates that simplification and the preservation of AI-specific safeguards are not necessarily incompatible. However, the separate Health Innovation Package remains subject to the EU legislative process, and its eventual provisions may differ.

The final regulatory position will depend on the negotiations and the legal text ultimately adopted.

What pharma leaders should do now

Pharmaceutical and biotechnology organisations can take several practical steps.

AI-enabled medical devices, and in vitro diagnostics they help develop or rely on, can include products used in clinical trials, patient stratification, diagnostic workflows, and treatment decisions. This can be practically mapped.

All existing governance arrangements should address data quality, bias, human oversight, post-market monitoring, and incident management.

These controls should reflect the risks of the product and its intended use, rather than merely the minimum obligations expected under a particular legislative scenario.

Contractual responsibilities span across partnerships. Agreements with technology vendors and diagnostic companies should clarify responsibilities for updates, performance monitoring, incident reporting, data access, and corrective action.

Developments across the Biotech Act, the MDR and IVDR revisions, and the AI Act will continue.

Regulatory teams should assess how changes interact instead of managing each file in isolation. This is particularly important for organisations whose development strategies depend on AI-enabled diagnostics or digital technologies.

Lastly, while the proposals remain under discussion, policymakers and industry bodies can be engaged with.

Pharmaceutical companies have a legitimate interest in reducing unnecessary administrative costs. They also have an interest in ensuring that the rules governing clinical technologies remain clear, credible, and proportionate to risk.

Pharmatica discusses how the U.S. Operation TrialBlazer and the FDA’s modernised drug manufacturing registration rule shows that regulatory efficiency depends on better processes, clearer expectations, and effective use of evidence. Digitalisation can support those aims, but it does not eliminate the need for appropriate oversight.

Image

Europe’s Innovation Agenda Must Protect the Conditions for Trust

The EU Biotech Act presents an important opportunity to strengthen Europe’s biotechnology ecosystem.

Faster trial authorisation, better access to investment, support for strategic projects, and more effective development pathways could help companies translate scientific discoveries into therapies and commercial manufacturing.

The accompanying medical device reforms deserve equally close scrutiny.

There is a fundamental question about whether Europe can retain the benefits of a risk-based AI framework if it removes many of the obligations associated with the high-risk classification of AI-enabled medical devices.

The answer will shape more than compliance costs. It could influence patient safety, health equity, clinical evidence, procurement decisions, investment confidence, and the adoption of AI across healthcare.

The industry perspective is that Europe should simplify regulatory processes before it reduces substantive safeguards.

Clearer guidance, better-resourced conformity assessment, aligned documentation, and more efficient digital procedures offer a credible route to reducing friction.

Any decision to remove an AI-specific obligation should demonstrate that the remaining framework manages the same risks to an equivalent standard.

Organisations that understand their technology dependencies, preserve effective monitoring, and clarify responsibilities across partnerships will be better positioned to manage uncertainty.

Europe does not have to choose between innovation and trust. It must ensure that its competitiveness agenda supports both.

The success of the Biotech Act and the wider health reform package will depend not only on how quickly new technologies reach the market, but also on whether patients, clinicians, investors, and industry can rely on the systems that bring them there.

Follow Pharmatica for Regulatory Insights that connect policy developments with the decisions facing decision makers.

Pharmatica: Insight. Connection. Impact.