Medical devices, diagnostics and pharma win concessions in EU Digital Omnibus proposal

The European Commission's recently published Digital Omnibus on artificial intelligence (AI) proposal introduces amendments to the EU AI Act that may reshape compliance planning for medical device manufacturers, in vitro diagnostic businesses and pharmaceutical companies. Released on 19 November, this targeted simplification package responds to a number of industry concerns about implementation readiness while attempting to preserve the fundamental protections that characterise the EU's approach to trustworthy AI.

Response to implementation challenges

The Digital Omnibus on AI emerges from extensive stakeholder consultations conducted throughout 2025, which revealed persistent difficulties in preparing for the AI Act's high-risk requirements originally scheduled to apply from 2 August 2026. 

The Commission notes that work on harmonised standards for high‑risk AI has fallen behind schedule and that national governance and conformity assessment structures are not yet fully operational, which is already driving compliance burdens above the level originally envisaged

For medical device and diagnostics businesses, this assessment carries particular weight. The legislation classifies as high risk all AI systems that qualify as, or serve as safety components of, products covered by the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR), which are currently being reassessed at European level. These systems were set to face stringent requirements from August 2026, yet the harmonised standards necessary to demonstrate compliance have not materialised on schedule.

The broader healthcare sector faces analogous pressures where AI systems are deployed in clinical contexts covered by annex III use-cases, such as remote biometric identification systems or AI systems intended to be used for biometric categorisation. 

Modified timelines 

Perhaps the most consequential change proposed by the Digital Omnibus concerns when high-risk AI requirements will actually apply. The Commission introduces a mechanism that links entry into application to the availability of compliance support measures, including harmonised standards, common specifications and Commission guidelines.

Under this revised framework, the high-risk obligations in chapter III of the AI Act would apply from six months after the Commission adopts a decision confirming that adequate compliance support measures are available, rather than from a fixed calendar date. For AI systems classified as high-risk under article 6(2) and annex III, this flexibility extends until a backstop deadline of 2 December 2027. For AI systems classified as high-risk under article 6(1) and annex I, which includes AI in medical devices and IVDs, the transition period following a Commission decision is extended to 12 months, with an ultimate deadline of 2 August 2028.

This distinction between annexes I and III systems recognises the particular complexity facing the medtech industry. AI components within medical devices must satisfy both the AI Act's requirements and the existing conformity assessment procedures under the MDR or IVDR, creating a dual compliance pathway that demands coordination.

For pharmaceutical and biotech companies deploying AI systems in clinical trial management, pharmacovigilance or drug discovery, the relevant timeline depends on whether those systems fall within Annex III use-cases or operate as (components of) regulated products. 

Conformity assessment and notified bodies

The Digital Omnibus addresses a practical bottleneck that has concerned the medtech industry: the limited availability of notified bodies competent to assess AI systems under both the AI Act and sectoral regulations. The proposal introduces a streamlined designation procedure enabling conformity assessment bodies to submit a single application and undergo a single assessment process for designation under both the AI Act and the MDR or IVDR.

A new provision would require notifying authorities to ensure that conformity assessment bodies applying for designation under both frameworks can benefit from this consolidated procedure in situations where the applicable EU harmonisation legislation allows for a unified application and assessment route.

For existing notified bodies already designated under the MDR or IVDR, the proposal establishes that they should apply for designation as notified bodies under the AI Act within 18 months from the entry into application of the Digital Omnibus. This transitional arrangement acknowledges that building AI assessment competence takes time and that forcing a rigid timeline could create gaps in notified body availability precisely when manufacturers need certification services most.​

The proposal also introduces a new annex XIV establishing a classification system for notified body designations, using codes that distinguish between various AI systems types. The multi-dimensional typology ensures that designated notified bodies possess the specific competencies required for the AI systems they assess.​

Real-world testing and regulatory sandboxes

The Digital Omnibus expands opportunities for testing AI systems before market placement in ways that may benefit innovation in the life sciences sector. The proposal extends real-world testing provisions in article 60, previously applicable only to annex III high-risk systems, to cover AI systems within products regulated under the harmonisation legislation in section A of annex I, including medical devices and IVDs.

The proposal also strengthens the AI regulatory sandbox framework, requiring the AI Office to establish an EU-level sandbox by 2028 for AI systems within its supervisory competence and mandating enhanced cross-border cooperation among national sandboxes. Pharmaceutical and medical device companies developing AI-enabled products may find these sandboxes useful environments for navigating the complex interplay between AI Act requirements and existing sectoral regulations.

Notably, the staff working document accompanying the legislative proposal identifies a commitment to prioritise clearer guidance on how the AI Act’s research exemptions in articles 2(6) and 8 should work in practice, including their use in sector‑specific settings such as pre‑clinical research and product development for medicinal products and medical devices. Following the European Federation of Pharmaceutical Industries and Associations' 2024 statement on the use of AI in the medicinal product lifecycle, this forthcoming guidance should prove valuable for pharmaceutical companies using AI in drug discovery and development activities.​

Reduced administrative burden

Several provisions in the Digital Omnibus aim to lighten the compliance load for businesses. The proposal extends regulatory simplifications previously available only to small and medium-sized enterprises (SMEs) to small mid-cap enterprises (SMCs), including simplified technical documentation requirements and proportionate consideration in penalty calculations. Many innovative medtech and biotech companies fall into this category as they scale beyond traditional SME thresholds.

The obligation for providers and deployers to ensure AI literacy among their staff transforms from a binding requirement to an encouragement by Member States and the Commission. This change responds to stakeholder feedback that a uniform, "one-size-fits-all" approach to AI literacy is not well‑suited to the very different profiles of providers and deployers.

The Commission also removes the obligation to register AI systems in the EU database where providers have concluded that their systems are not high-risk under article 6(3) because they perform only narrow procedural or preparatory tasks. This administrative simplification should benefit companies deploying AI for ancillary functions that do not materially influence, for example, clinical decision-making or patient outcomes.

The EHDS dimension

While the Digital Omnibus does not directly amend the European Health Data Space Regulation, which entered into force on 26 March 2025, stakeholder feedback documented in the staff working document highlights ongoing concerns about the alignment between the AI Act, General Data Protection Regulation and European Health Data Space (EHDS) frameworks. The consultation responses called for clearer explanations of how the various digital instruments interact in practice, with the AI Act being the instrument most commonly mentioned by respondents as needing clarification, alongside better coordination with the Data Governance Act, the Cyber Resilience Act and the EHDS frameworks.

For pharmaceutical and medtech companies preparing to access health data under the EHDS for AI development or regulatory purposes, the Digital Omnibus is set to provide incremental clarity on the AI-specific requirements. However, it does not resolve the broader question of how these frameworks interact. The EHDS's secondary use provisions, which will phase in from 2029 onward, explicitly support AI development as a permitted purpose, but the conditions under which this access may be granted remain subject to implementation at national level through the so-called "health data access bodies".

Osborne Clarke comment

The Digital Omnibus on AI represents a pragmatic acknowledgment that regulatory ambition must align with implementation reality. For medical device manufacturers, diagnostics companies and pharmaceutical businesses developing or deploying AI, the proposal offers breathing room without abandoning the fundamental protections that differentiate Europe's approach to AI governance.

The modified timelines, with their flexibility mechanism tied to standards availability rather than fixed calendar dates, may allow companies to plan more confidently while avoiding the prospect of formal non-compliance before the tools for demonstrating conformity exist. The extended ultimate deadline of August 2028 for AI systems in medical devices and IVDs recognises the particular complexity of the dual conformity assessment pathway these products face.

The streamlined notified body designation procedure could help address capacity constraints that have concerned the industry, though the practical impact will depend on how national notifying authorities implement the consolidated assessment process. Companies with AI products requiring third-party conformity assessment may wish to monitor which notified bodies pursue dual designation and engage early to secure assessment slots.

The forthcoming guidance on AI Act research exemptions in the context of medicinal product and other health technology development merits close attention from pharmaceutical companies, particularly those using AI in pre-clinical research and clinical trial design. Such guidance could clarify which activities benefit from the research exemption and which trigger provider or deployer obligations.

The Digital Omnibus must still navigate the ordinary legislative procedure through the European Parliament and Council. While policymakers reportedly aim to conclude negotiations before August 2026, amendments during this process cannot be excluded. Organisations are encouraged to monitor developments while avoiding premature compliance investments based solely on the proposal's current text.