EU-UK Spotlight: Renewables, trade, and the global supply chain
A. Life Science (Pharma and Medical Devices): EU Pharma Package’s final texts published; EU is advancing several initiatives to improve clinical trial processes; European Commission proposes shifting AI medical device oversight to MDR/IVDR to streamline compliance.
B. Corporate Governance & Corporate Social Responsibility: CSDDD and reporting rules in finally force; “EU Inc.” proposal to simplify cross border business.
C. Competition & Antitrust: Horizontal merger guidelines due by April 2026 with sharper focus on resilience and innovation.
D. Anticorruption & Bribery: Transparency International flags rising global corruption risks.
E. Intersection Of Life Science & Data Privacy: CJEU on excessive access requests; draft EU Biotech Act to harmonize clinical‑trial data rules.
The Q1 and Q3 Life Science and Health Care Law Update covers key trends in the EU only while the other reports (on Q2 and Q4) cover key trends in the EU as well as in the Big Five (Germany, France, Italy, Spain and UK) in life sciences regulatory, corporate, compliance, competition, and data & privacy law. To dive deeper into the latest trends, contact Joerg Schickert to subscribe to a more detailed quarterly report.

Final texts of the new directive and regulation published for the EU Pharma Package: As previously reported, the Package revises EU pharmaceutical law by replacing both, Regulation (EC) No 726/2004 and Directive 2001/83/EC. Key measures include inter alia: (i) a recalibrated regulatory framework ament to incentive innovation, but also fosters generics, (ii) shortened market exclusivity for certain Orphan Medicinal Products, and (iii) strengthened obligations for supply and shortage‑prevention. The European Commission published the final texts and EU institutions will conduct legal‑linguistic review and translations before formal adoption, currently expected in the second half of 2026. No further substantive changes are anticipated at this stage.
The EU is advancing several initiatives to improve clinical trial processes:
European Commission Proposal on MDR/IVDR Simplification: In Q4 2025, the European Commission proposed amendments to MDR and IVDR to simplify regulations, reduce administrative tasks, and improve certification while maintaining patient safety. The plan would make MDR the main framework for AI medical devices/IVDs under the AI Act. The amendment moves AI medical devices and AI IVDs to Annex I, Section B of the AI Act. As a consequence, the high-risk requirements of the AI Act (e.g., risk management, data governance, transparency, human oversight, robustness, cybersecurity) would no longer directly apply under the AI Act. However, these obligations may be transferred to the MDR/IVDR via delegated/implementing acts. Industry groups like MedTech Europe and BVMed support transferring AI medical devices/IVDs from Annex I Section A to Section B in the AI Act, citing reduced duplication and greater legal certainty. Conversely, critics such as TÜV-Verband are concerned that these changes could weaken patient safety and negate investments made in existing AI compliance. It has to be seen whether the proposal makes it into the law, though this seems likely.
New Medical Devices Coordination Group (MDCG) published new guidance:
Omnibus legislation proposing inter alia amendments to the Corporate Sustainability Due Diligence Directive (CSDDD) and sustainability reporting finally entered into force: As previously reported, the substantive Omnibus Directive (EU) 2026/470 was in the final stages of the legislative process. Such process has now been completed with the approval of the EU Council on 24 February 2026, publication in the EU Official Gazette on 26 February 2026, and entering into force on 18 March 2026. Agreed amendments, as already mentioned in our last update, now include, inter alia: (i) for the CSRD further limiting the scope for EU companies (at least 1,000 employees and net turnover EUR 450m), simplification and reduction of reporting requirements, prohibition to obtain information only for CSRD reporting from entities in the value chain with less than 1,000 employees other than information to be specified in the sustainability standards for voluntary use, and (ii) for the CSDDD further limiting the scope for EU companies (at least 5,000 employees and net turnover EUR 1.5bn), removal of requirements to adopt and implement a climate transition plan, change of diligence obligations to a risk-based approach, no EU harmonized civil law liability regime, and deferral of transposition deadline to 26 July 2028.
EU Commission presents proposal for an EU Inc. to make it easier to start and operate business across the EU: As part of the new broader 28th regime, the EU commission presented a proposal for an EU Inc., a new single set of corporate rules applying across the entire EU intended to make it easier to start, operate and grow a business across the EU. Main features shall include a faster and simpler registration process, fully digital operations throughout the lifecycle, simplified liquidation procedures, digital procedures for financing, simplified share transfers, and full access to the single market, while maintaining strong national safeguards against abuse. Due to the urgent need to enhance the EU's competitiveness, the Commission has requested the Parliament and the Council to reach an agreement on the EU Inc. proposal by the end of 2026.
Revision of horizontal merger guidelines: The European Commission is expected to publish revised horizontal merger guidelines at the end of April 2026, with a stronger focus on supply chain resilience and innovation, which prompted a discussion about the creation of “European champions” in strategic sectors. The update – drawing on experience under the EU Merger Regulation and Mario Draghi's 2024 competitiveness report – can impact life sciences companies in particular with regards to R&D collaboration, manufacturing capacity, and supply chain security.
Transparency International's Corruption Perceptions Index 2025 reveals increasing global corruption risks: Transparency International's 2025 Index covers 182 countries, showing a drop in the global average score to 42, with 122 countries scoring below 50—signalling widespread public-sector corruption. Only five nations now score above 80, down from 12 ten years ago; traditional democracies like the US, Canada, New Zealand, UK, France, and Sweden have seen their scores worsen. The 50 biggest declines often occur where civic space is restricted, and journalists killed investigating corruption are mostly in low-scoring countries, highlighting links between repression and corruption. Transparency International notes lasting progress relies on political will, strong oversight, and protecting democracy; centralized power and weak accountability lead to persistently low or falling scores.
The European Court of Justice (CJEU) on excessive access requests: The CJEU (C-526/24 of 19 March 2026) ruled that even a first request for access to personal data (i.e., a data subject access request made to a controller) may be refused as excessive under Article 12(5) (transparent information, communication, and modalities for exercising data subject rights) where it constitutes an abusive exercise of data subject rights. This may be the case where the request is driven by an abusive intention to merely create a claim for damages under Article 82 GDPR (general liability for GDPR violations). This judgment clarifies that the right of access is not without limits and that controllers may, in principle, reject abusive requests. At the same time, the CJEU emphasised that this exception must be interpreted restrictively and may apply only in exceptional circumstances, subject to strict criteria for classifying a request as excessive. In this regard, the controller bears the burden of proof, and must demonstrate the excessive nature of the request on the basis of a combination of the objective and subjective (i.e., that the data subject has an abusive intent) circumstances of the request. The CJEU further found in this judgment that the right to compensation under Article 82 GDPR is not limited to unlawful processing, but also extends to infringements of the right of access under Article 15 GDPR.
Draft EU Biotech Act seeks to harmonise data protection for clinical trials: Proposed in December 2025, the Biotech Act aims to standardize data protection rules for clinical trials by revising Article 93 of the Clinical Trials Regulation. It clarifies that Article 6(1)(c) of the GDPR, which permits the use of personal data when it is necessary to comply with a legal obligation, applies to required processing activities, while health and genetic data processing is justified under Article 9(2)(i) GDPR for public health reasons. Data collected under authorized protocols may be further processed for additional research or trials. The Act designates sponsors and investigators as “controllers” but does not specify their relationship: a point noted by European Data Protection Board and the European Data Protection Supervisor despite overall support. Continued negotiations could resolve inconsistencies across the EU and streamline clinical trial processes.
Coordinated enforcement action on transparency under the GDPR: European data protection authorities have launched the 2026 Coordinated Enforcement Framework to examine transparency and information obligations under the GDPR, specifically Articles 12, 13, and 14. Privacy notices will face increased scrutiny, so controllers should ensure compliance with these articles to avoid enforcement action.
For more in-depth information you can contact Joerg Schickert to subscribe to our detailed quarterly report.
Authored by Dr. Joerg Schickert, Caroline Schmalenbach, Thomas Weber, Dr. Falk Schöning, Dr. Stefan Schuppert.