Virtual & Digital Health Digest

This digest covers key virtual and digital health regulatory and public policy developments during June and early July 2026 from the United States, United Kingdom, and European Union.

In this issue, you will find the following:

U.S. News

• Health Care Fraud and Abuse Updates
• Privacy and Artificial Intelligence (AI) Updates
• Policy Updates
• FDA Updates
• Provider Reimbursement

U.S. Featured Content

This month’s edition highlights a sweeping range of developments across health care fraud enforcement, artificial intelligence (AI) regulation, and federal health policy. On the enforcement front, the U.S. Department of Justice’s (DOJ) 2026 National Health Care Fraud Takedown charged 455 defendants in connection with over $6.5 billion in alleged fraud, with several cases spotlighting the growing role of telemedicine and digitally enabled schemes in Medicare abuse. A licensed nurse practitioner and telemedicine company owner was also sentenced to 10 years in prison for her role in a $136 million Medicare fraud scheme. In the regulatory space, the Federal Trade Commission (FTC) released a proposed policy statement expressing concern that AI developers may be training models to suppress accuracy, with a public comment period open through July 31, 2026. On Capitol Hill, bipartisan legislation was introduced to accelerate AI-driven solutions for pediatric cancer, while the House Appropriations Committee advanced its Fiscal Year (FY) 2027 spending bill, which notably includes a prohibition on Centers for Medicare & Medicaid Services (CMS) funding for the AI-powered WISeR prior authorization model. Meanwhile, CMS established a new Office of Health Technology and Products to lead AI strategy across its programs, and the FDA issued a warning letter over unauthorized software changes to a patient monitoring device, sought public input on non-device software functions, and announced a public meeting on medical device user fee reauthorization with a focus on strengthening digital health oversight. CMS also released two Medicare payment proposed rules that would set 2027 rates for physicians and hospital outpatient departments and address several virtual and digital health policies. 

EU and UK News

• Regulatory Updates
• Pricing and Reimbursement Updates
• Privacy Updates

EU/UK Featured Content

AI continues to be at the top of the agenda for regulators in Europe. The European Commission (EC) has been focused on preparing for the majority of the provisions in the AI Act to come into force this August. Among those provisions are the transparency requirements, and to assist organizations with compliance, the EC has published a voluntary Code of Practice on the marking and labeling of AI-generated content. Further, a Scientific Panel and an Advisory Forum have been appointed to advise the EC’s AI Office and national competent authorities on implementation and enforcement of the AI Act.

In the UK, we are seeing a continued commitment to regulating AI through guidance and codes of practice, as well as the provision of regulatory support through sandbox programs. The Information Commissioner’s Office (ICO), the data protection regulator, has published its plan for upcoming work in relation to AI, which sets out various plans for guidance and codes of practice. The Medicines and Healthcare products Regulatory Agency (MHRA) continues its focus on regulatory sandboxes and recently reported the outcome of the second phase of the AI Airlock. It has also announced further AI sandboxes in order to accelerate the development of medicines and to allow innovators to test AI tools that have the potential to predict how medicines behave in the body, and another, which will be London-focused.

The key legislative development this month is that the EU Council has adopted its position on the first part of the Biotech Act, which, together with the European Commission’s draft, will form the basis of the trilogue discussions between the European Union (EU) institutions, hopefully leading to agreement on a finalized text. 

U.S. News

Health Care Fraud And Abuse Updates

National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection With Over $6.5 Billion in Alleged Fraud.On June 23, 2026, the DOJ announced its 2026 National Health Care Fraud Takedown, charging 455 defendants, including 90 physicians and other licensed medical professionals, in connection with more than $6.5 billion in alleged false claims across 56 federal districts and 45 states and territories. Several of the matters involved telemedicine and digitally enabled schemes.

The DOJ highlighted the arrest of Herb Kimble in connection with a previously charged $1.2 billion telemedicine and durable medical equipment (DME) scheme. 

Additionally, the takedown included charges against Anthony Tursi for conspiracy to commit health care fraud and conspiracy to pay and receive health care kickbacks in connection with a $62 million scheme to bill Medicare for medically unnecessary genetic testing. Tursi allegedly owned a call center that ran deceptive telemarketing campaigns to persuade Medicare beneficiaries to agree to genetic tests and then sent faxes containing false and misleading representations to the beneficiaries’ physicians to induce them into signing orders for the tests.

On June 23, 2026, as part of the takedown, Bhamin Chhatrapati of Massachusetts was charged with conspiracy to commit health care fraud in connection with more than $5.1 million fraudulently billed to Medicare for DME. From approximately February 2023 through September 2024, Chhatrapati and his co-conspirators allegedly worked with telemarketers and call centers to obtain Medicare beneficiaries’ information and used it to generate documentation making it appear that practitioners had legitimately prescribed medically necessary DME. The defendants allegedly paid the telemarketers per-brace order approved by Medicare, which paid over $2.6 million on the fraudulent claims.

Also on June 23, 2026, as part of the takedown, the U.S. Attorney’s Office for the Northern District of New York announced that Aptihealth Inc. and Aptihealth Medical, PLLC, a telehealth behavioral health provider, agreed to pay $300,000 to resolve civil allegations under the False Claims Act. The government alleged that Aptihealth billed Medicare and Medicaid for services that were not rendered or not supported by adequate documentation, improperly billed administrative tasks as reimbursable medical services, offered gift cards to induce recipients to receive services, and failed to maintain an effective compliance program as required by New York law. 

The takedown resulted in the CMS suspending 1,079 providers and revoking billing privileges for 1,403 providers. 

Telemedicine Company Owner and Author of Health Care Compliance Books Sentenced for $136 Million Medicare Fraud Scheme. On June 30, 2026, Jean Wilson, a licensed nurse practitioner who owned and operated two telemedicine companies, was sentenced to 120 months in prison and ordered to pay $66 million in restitution for her role in a scheme to bill Medicare for medically unnecessary DME and prescription drugs.

According to court documents, between 2017 and 2019, Wilson and others allegedly paid illegal kickbacks to providers to sign orders for orthotic braces and drug prescriptions for Medicare beneficiaries who did not need them and then sold the signed orders and prescriptions to purported marketing companies. Those marketers allegedly resold the orders to brace suppliers and pharmacies that billed the program. Wilson allegedly used shell accounts and nominee owners to conceal the conduct. In total, the scheme submitted over $136 million in false claims, of which Medicare paid more than $66 million. 

Privacy and AI Updates

Federal Trade Commission Solicits Comments on Proposed Policy Statement on AI Accuracy. On July 1, 2026, the FTC released a proposed Policy Statement regarding its concerns that AI developers may be training their products to “suppress accuracy” such as “by training a model surreptitiously to produce ideologically motivated distortions in a response to a factual question.” The proposed statement emphasizes that consumers have come to rely on AI to assist them in making important decisions, including health-related choices, and notes that the FTC recently invoked its authority to address an AI company’s allegedly misleading claims that its AI tool could effectively replace human customer service representatives. The proposed policy statement will be published in the Federal Register. The public will have until July 31, 2026 to submit comments on the policy statement.

New Federal Bill Would Support AI Use in Pediatric Health Care. On July 9, 2026, House members Michael McCaul (R-TX), together with Ami Bera (D-CA) and Mike Kelly (R-PA), all of whom are Co-Chairs of the Congressional Childhood Cancer Caucus, introduced the Accelerating Innovation for Kids with Cancer Act (HR 9632) as a means to encourage the use of AI for the development of cures for pediatric cancer. If enacted, the bill would require the president to appoint an individual or organization as a federal Coordinator of AI innovation, with the charge of identifying opportunities to accelerate the advancement of AI-driven solutions at the National Institutes of Health’s Cancer Institute’s Childhood Cancer Data Initiative (CCDI). The bill refers to several specific potential AI-driven measures for this purpose, including improving clinical trial design and access; making data platforms and AI tools available as part of the CCDI data ecosystem; and improving data infrastructure by consolidating data from multiple sources for AI-ready analysis and using AI to help select clinical trial subjects. The bill would require the U.S. Department of Health and Human Services (HHS) to establish interoperability standards for processing patient data with AI that provide for “safe and privacy-compliant” exchanges of data. The bill has been referred to the House Energy and Commerce Committee for further action. 

Policy Updates

House Appropriations Committee Approves FY27 Labor, Health and Human Services, Education, and Related Agencies Appropriations Bill. On June 9, 2026, the House Appropriations Committee held a Full Committee Markup of the FY27 Labor, Health and Human Services, Education, and Related Agencies (L-HHS) bill. The committee favorably reported the FY27 L-HHS appropriations bill to the House by a party-line vote of 34-28. The committee recommends $110.8 billion in discretionary budget authority for HHS, which would be a reduction of $4 billion from the FY26-enacted level.

Notably, the committee adopted a Manager’s Amendment, which includes language that would prohibit CMS from using funds to implement the Wasteful and Inappropriate Service Reduction (WISeR) Model, which applies AI to Medicare prior authorization for certain services, and would require oversight of the WISeR model’s impact on patients and providers. The Manager’s Amendment was adopted by a voice vote.

House Appropriations Committee Releases Its FY27 Labor, Health and Human Services Appropriations Report. On June 8, 2026, the House Appropriations Committee released its accompanying FY27 L-HHS report. Appropriations bill reports clarify funding levels, signal congressional intent and policy priorities to HHS agencies, provide oversight and accountability, and provide instructions on various reporting requirements.

The report includes $45.5 million for the Office for the Advancement of Telehealth (OAT) to promote the effective use of technologies to improve access to health services for people who are isolated from health care services and to provide distance education for health professionals.

The report also encourages CMS to leverage relevant feedback and consider policies in the upcoming proposed Medicare payment rules to provide targeted criteria to Medicare providers and medical technology innovators regarding the reimbursement pathway for FDA-authorized AI/machine learning (ML)-enabled medical devices, including algorithm-based health care services (ABHS) technologies.

Additionally, in the report, the committee urges the withdrawal and rescinding of the Notice of Proposed Rulemaking at the Office of Management and Budget (OMB) titled, “[Health Insurance Portability and Accountability Act] HIPAA Privacy Rule: Changes to Support the Use of Telecommunications Relay Services and Improve Information Sharing for Uniformed Services Personnel.” The committee expresses concern that the proposal may unintentionally impact patient privacy protections in relation to entities that operate outside the scope of HIPAA. 

FDA Announces Public Meeting to Discuss Proposed Recommendations for Reauthorizing the MDUFA for Fiscal Years 2028 Through 2032. The Food and Drug Administration (FDA) has announced a public meeting, “Medical Device User Fee Amendments,” scheduled for August 5, 2026. The meeting will focus on proposed recommendations for the reauthorization of the Medical Device User Fee Amendments (MDUFA) for fiscal years 2028-2032. Current statutory authority for MDUFA is set to expire on September 30, 2027.

Of note, one of FDA’s recommendations for MDUFA VI includes strengthening digital health expertise and aligning review processes with software lifecycles through expanded technical capacity, enhanced reviewer training, and stakeholder engagement on emerging technologies.

CMS Establishes the Office of Health Technology and Products. On June 10, 2026, CMS established the Office of Health Technology and Products (OHTP). The new office will focus on “technology modernization, digital products, and transforming of platforms and services supporting Medicare, Medicaid, the Children’s Health Insurance Program (CHIP), and other CMS-administered programs.” OHTP will lead strategy and implementation of AI across CMS’ digital products and platforms, as well as advise CMS leadership on AI opportunities, risk, and governance.

UpDoc Announces That the FDA Has Cleared the First Large Language Model-Based Software as a Medical Device. On June 25, 2026, UpDoc, a clinical AI company that offers a provider-integrated agentic AI platform, announced that it received FDA clearance for the first Software as a Medical Device (SaMD) that uses large language models. The AI agent can be integrated into a provider’s electronic health records for support across clinical workflows. UpDoc states that the agent is “designed to support doctors, not replace them.” The platform was originally tested in a clinical trial at Stanford Medicine and will undergo initial deployment at Cleveland Clinic, Allegheny Health Network, and UCSF Health.

FDA Updates

FDA Warning Letter Regarding Modified Patient-Monitoring Software. On June 12, 2026, FDA issued a warning letter to Nihon Kohden Digital Health Solutions, LLC concerning the company’s Next Generation NetKonnect (NGNK) software, a 510(k)-cleared patient-monitoring device. FDA concluded that the device was adulterated and misbranded because the company made significant software and intended-use changes without submitting a new 510(k).

FDA disagreed with the company’s determination that the addition of a “Silence Alarms” function would not significantly affect the device’s safety or effectiveness. The agency characterized the feature as a change to the device’s control mechanism because it alters how users control alarms and could cause alarms for life-threatening conditions to be missed, potentially resulting in serious injury or death. FDA therefore determined that the change required a new 510(k).

FDA also found that the company was marketing the NGNK software as having “device-agnostic compatibility,” including the ability to receive data from devices manufactured by third parties. The cleared device, however, was limited to inputs from other Nihon Kohden devices. FDA concluded that expanding compatibility to unvalidated third-party devices constituted a major change in intended use and could create interoperability risks, including incorrect vital-sign measurements, loss of monitoring, delayed diagnosis, or misdiagnosis. 

FDA Requests Input on Certain Non-Device Software Functions and Impacts to Patient Safety. On July 14, 2026, FDA announced that it is seeking public input to inform its forthcoming 2026 report on the risks and benefits of certain software functions that are excluded from the statutory definition of a medical device under the 21st Century Cures Act. FDA is specifically requesting information regarding patient-safety impacts and best practices for promoting safety, education, and user competency. Comments are due August 13, 2026. The request covers five categories of non-device software functions: software intended to support health care facility administration; encourage a healthy lifestyle; serve as an electronic patient record; transfer, store, convert, or display medical data; and provide certain limited clinical decision support. Although these functions generally fall outside FDA’s device regulatory authority, the agency is required to report every two years on their health-related risks and benefits and their effects on patient safety.

Provider Reimbursement

Calendar Year Physician Fee Schedule Proposed Rule. On July 16, 2026, CMS published the calendar year (CY) 2027 Medicare Physician Fee Schedule proposed rule. The proposed rule includes several notable policies concerning remote physiologic monitoring (RPM), remote therapeutic monitoring (RTM), telehealth services, and technology-enabled primary care.

Remote Monitoring. In response to growing program-integrity concerns — including an HHS Office of Inspector General report identifying the need for additional oversight of RPM services — CMS proposes several changes intended to strengthen billing requirements and address program-integrity concerns involving RPM and RTM services. CMS proposes to:

• Require RTM services to be furnished only to established patients, consistent with the existing requirement for RPM services, reasoning that an established patient relationship allows the practitioner to confirm that remote monitoring is medically necessary and to develop a treatment plan based on a prior evaluation of the patient.
• Require practitioners billing RPM or RTM services to furnish a separately reportable initiating visit in association with the onset of the remote monitoring services. The initiating visit would be required even when the patient has recently received another service from the practitioner, unless that service independently qualifies as the initiating visit. 
• Pay for RPM and RTM treatment-management services only when the clinical staff furnishing the services are employed by the billing practitioner’s practice. CMS expresses concern that arrangements involving third-party vendors may result in the billing practitioner exercising insufficient supervision or involvement in the patient’s care.

CMS also proposes to revise the valuation of certain RPM and RTM services based on its understanding that remote monitoring devices may now be available at lower costs than CMS originally estimated. CMS also seeks comments on whether it should replace the existing RPM and RTM CPT code families with four bundled HCPCS G-codes. 

Medicare Telehealth Services List. CMS proposes to add five new HCPCS G-codes to the Medicare Telehealth Services List for CY27: (1) advance care planning furnished by clinical staff under the direction of a treating practitioner (HCPCS codes GACP1 and GACP2); (2) voluntary shared medical appointments involving groups of two to 10 patients with common medical conditions (HCPCS code GSMAS); (3) individual speech, language, voice, communication, or auditory-processing treatment furnished to pediatric patients (HCPCS code GSLPP); and (4) an add-on code for evaluation and management services involving the diagnosis and treatment of vaccine adverse effects (HCPCS code GADV1).

Telehealth Flexibilities and Modifiers. As discussed in our February 2026 digest, Congress extended COVID-19-era Medicare telehealth flexibilities through December 31, 2027, as part of the Consolidated Appropriations Act (CAA), 2026. CMS proposes updates to its telehealth regulations to reflect the additional extension. As required by the CAA, 2026, CMS also proposes to establish new claims modifiers for telehealth services furnished through certain third-party virtual platforms and for telehealth services furnished incident to a physician’s or practitioner’s professional services.

Technology-Enabled Primary Care. CMS seeks comments on potential changes to the valuation and payment of primary care services, including how Medicare should account for technology used in primary care. Among other issues, CMS requests feedback on whether technology should be incorporated into primary care payment through existing service-level payments, prospective payments, or other payment arrangements. CMS also seeks comments on establishing prospective primary care payments through the Medicare Shared Savings Program and potentially more broadly in Original Medicare.

Comments on the proposed rule are due September 14, 2026.

CY27 Medicare Hospital Outpatient Prospective Payment System (OPPS) Proposed Rule. On July 7, 2026, CMS published the CY27 Medicare Hospital OPPS proposed rule. As it has in the past, the agency addresses artificial intelligence-enabled clinical software in its ongoing attempts to further develop OPPS payment policy for these technologies.

Software as a Medical Service. CMS proposes establishing a new payment framework for certain software-based medical technologies that use algorithms, including artificial intelligence, to perform diagnostic or other clinical functions. CMS would replace the term “Software as a Service” with “Software as a Medical Service” (SaMS) to distinguish these technologies from general cloud-based software and to recognize their role in furnishing medical services. CMS explains that existing Medicare payment methodologies may not adequately account for proprietary algorithms, licensing arrangements, and other non-material costs associated with these technologies.

For CY27, CMS proposes to designate 36 HCPCS codes as SaMS services and generally assign separately payable codes to New Technology Ambulatory Payment Classifications. CMS also proposes a new OPPS status indicator, “O1,” for separately payable SaMS services. Services assigned status indicator O1 would receive a separate APC payment and would not be discounted when furnished with another procedure. CMS is seeking comment, however, on whether SaMS services should instead be subject to multiple-procedure payment reductions when more than one software-based analysis is performed during the same encounter.

CMS also proposes moving certain stand-alone algorithmic analyses of laboratory data from the Clinical Laboratory Fee Schedule to the OPPS. Under the proposal, these services would be treated as “other diagnostic tests” and paid through New Technology APCs. 

The proposal represents an important step toward creating a distinct Medicare payment pathway for AI- and algorithm-based clinical services. Although CMS characterizes the framework as interim, the SaMS designation could shape future coding, payment, packaging, and program-integrity policies for digital health technologies. CMS also seeks comments on longer-term payment methodologies, including whether payment should be tied more closely to clinical outcomes and whether multiple-procedure payment reductions should apply. 

Comments on the proposed rule are due August 31, 2026.

EU and UK News

Regulatory Updates

Council of the European Union (Council) Adopts Position on the EU Biotech Act I. The Council of the European Union has adopted its general approach on the European Commission’s proposed Biotech Act Part I (For more details on the European Commission proposal, read our January 2026 Digest). This general approach will serve as its negotiating mandate for trilogue discussions with the European Parliament, should they take place. Among the key amendments, the Council has clarified that, in the context of the processing of personal data, it may be considered to be carried out in the public interest where necessary to ensure patient safety, maintain high health care standards, or support cross-border analysis of transplant outcomes.

European Federation of Pharmaceutical Industries and Associations (EFPIA) Publishes Its Position on the EC-Proposed EU Biotech Act Part I. The position welcomes key measures proposed by the EC, including a harmonized General Data Protection Regulation (EU) 2016/679 (GDPR) legal basis for clinical trial data processing, clearer and harmonized responsibilities regarding controllership of data under the GDPR, and the possibility for further use of clinical trial data for research purposes under certain conditions. At the same time, EFPIA calls for risk-based guidance from the European Medicines Agency and the European Medicines Regulatory Network on the use of AI models and systems.

European Commission Publishes Code of Practice on Marking and Labeling AI-Generated Content. The code is voluntary, but it sets out practical steps to help providers and deployers of generative AI systems meet the AI Act transparency obligations that will apply from August 2, 2026. The AI Act will require clear labeling, particularly for deepfakes and AI-generated or AI-manipulated text published on matters of public interest. The European Commission has also created a set of icons that deployers may use to label their AI-generated content. Providers and deployers of generative AI systems may sign up to the code using the signatory form.

European Commission’s Medical Device Coordination Group (MDCG) Publishes Position Paper on Manufacturer Responsibility to Upload Summary of Safety and Clinical Performance (SSCP) and Summary of Safety and Performance (SSP) Documents in EUDAMED. The position paper clarifies the future responsibilities for uploading the SSCP and SSP to EUDAMED, the EU centralized database for medical devices and in vitro diagnostics. Under the current process, the SSCP and SSP documents are uploaded by the Notified Body when registering certificate information. The MDCG guidance MDCG 2019-9 Rev. 1 is being revised such that the manufacturer will have responsibility for uploading the SSCPs and SSPs in EUDAMED. It will also be the responsibility of the manufacturer to ensure the uploaded SSCP or SSP is the one validated by the Notified Body. The MDCG foresees a transition period whereby Notified Bodies will continue uploading the validated master SSCPs and SSPs until the new functionality is available in October 2026.

MedTech Europe Reaction to Provisional Agreement on the AI Digital Omnibus. MedTech Europe has reacted to the Digital Omnibus package that was presented by the European Commission in November 2025, aiming to streamline rules on AI, cybersecurity, and data. MedTech Europe advocates for a sectoral approach for medical devices to avoid overlapping obligations. However, the provisional agreement does not include a sectoral approach for medical technologies, which remain subject to parallel requirements under both the AI Act and the Medical Devices Regulation 2017/745 (MDR)/In Vitro Diagnostic Regulation 2017/746 (IVDR). Some of MedTech Europe’s other recommendations have been implemented, such as the postponement of the application of AI Act requirements for high-risk AI systems embedded in products, including medical technologies, from August 2026 to August 2028.

European Commission Appoints a Scientific Panel and an Advisory Forum to Support AI Act Enforcement. The two bodies will advise the European Commission’s AI Office and national competent authorities on the implementation and enforcement of the AI Act. The Scientific Panel, comprising 60 independent experts, will provide advice on matters relating to, among others, general-purpose AI models and systems, systemic risks, model classification, evaluation methodologies, and cross-border market surveillance. The Advisory Forum, comprising representatives from academia, civil society, and industry, including small and medium-sized enterprises and startups, will provide advice on matters relating to, among others, standardization, AI literacy, and AI Act implementation.

UK MHRA Launches AI Sandboxes to Accelerate Medicines Development. The MHRA has launched an initiative to test how AI can accelerate medicines development and improve safety. The program will allow innovators to test AI tools that have the potential to predict how medicines behave in the body, including how they are absorbed, processed, and whether they may cause harm. The MHRA intends to use this work to understand how reliable these AI tools are and whether they can be used to support decisions about the safety of new medicines. Up to five AI-driven approaches will be tested in the first phase. The MHRA will begin working with industry and academic partners over the coming months to shape how the sandbox operates. In addition, the MHRA is launching a similar sandbox focused on London for up to 10 AI manufacturers, and will invite expressions of interest from AI medical device manufacturers in July 2026.

UK MHRA Publishes Report on AI Airlock Sandbox Phase 2. The MHRA has published its report of Phase 2 of the AI Airlock regulatory sandbox, alongside three simulation workshop summary reports. The program ran from April 2025 to March 2026 and worked with seven AI technologies across a range of clinical applications, including AI-powered clinical note-taking, advanced cancer diagnostics, rare eye disease detection, and obesity management systems. In a MedRegs blog post, the MHRA notes that pre-market evidence needs to be designed with deployment conditions in mind, and post-market monitoring is critical for these technologies. The MHRA also states that clinical relevance should underpin performance metrics, as a consistent finding across candidate cases was that statistical significance did not always equate to clinical importance. The insights from the AI Airlock pilot phase were reported in the November 2025 Digest.

UK MHRA Publishes Findings on National Commission’s Research Into the Use of AI in Healthcare. The MHRA has published two reports summarizing the findings from the research and engagement activities of the National Commission into the Regulation of AI in Healthcare, as well as the outcome of the associated Call for Evidence (which we initially reported on in the December 2025 Digest). In a press release, the MHRA says the overarching view from the engagement is a recognition of the potential benefits of AI in healthcare, provided that rules appropriately set standards for safety and efficacy. The MHRA also says there is a broad consensus that existing regulatory approaches need to be adapted to meet the rapid pace of change and development of AI technology. These reports will inform the AI commission’s recommendations, which are due to be published later this year to assist the MHRA in shaping rules that protect patients and support innovation. 

UK MHRA Publishes Blog Post on Use of AI in GxP Inspection Responses. The MHRA has published a blog post on its position on the use of AI in submissions made to its compliance teams following GxP inspections. The post acknowledges that AI tools can support better regulatory outcomes and improve patient safety, but the agency has encountered responses containing references to MHRA guidance that does not exist, citations of inappropriate regulatory frameworks, and responses to serious deficiencies that appear designed to mislead rather than address underlying problems. The MHRA sets out several clarifications, stressing that all submissions must be accurate and supported by evidence. It also offers organizations the opportunity to voluntarily disclose AI use in responses to compliance teams, to help the MHRA understand how the sector is evolving. The MHRA says inspectors will consider this disclosure positively when assessing organizational compliance.

Pricing and Reimbursement Updates

UK Government Publishes Guidance for NHS Buyers Assessing Medical Technology. The UK government has published guidance for National Health Service (NHS) buyers on “value based procurement” when buying medical technology. The guidance provides a standard set of questions and scoring criteria to help assess the wider value of the technology, not just its purchase price. These other value criteria include benefits for productivity and efficiency in hospitals, patient experience and outcomes, staff experience and safety, the environment, and supply chain resilience. The guidance is intended for use at the quality assessment stage of the procurement process.

Privacy Updates

UK ICO Sets Out AI Workplan Priorities in Response to Government Request. On May 29, 2026, the ICO published its response to a joint request from the Technology and Business Secretaries to set out a plan for enabling safe AI-powered innovation. The response builds on the ICO’s June 2025 AI and biometrics strategy and confirms that its 2026/2027 workplan will focus on: developing an AI and automated decision-making (ADM) statutory code of practice (informed by the ADM consultation which closed on May 29, 2026, with final guidance due Summer 2026); publishing dedicated guidance on agentic AI; and supporting consumers navigating an increasingly personalized AI landscape. This is relevant to life sciences companies deploying AI-enabled tools in clinical, diagnostic, or patient-facing contexts, an area the ICO has previously flagged as a priority.

UK ICO Publishes Final Guidance on Consumer IoT Products and Services. On June 11, 2026, the ICO published its finalized guidance on consumer Internet of Things (IoT) products and services, following a 12-week consultation held last year. The guidance covers smart speakers, connected televisions, fitness trackers, wearables, smart doorbells, and other consumer connected devices, and applies to manufacturers, app developers, operating system providers, and cloud providers in the IoT supply chain (it does not cover smart meters, connected/autonomous vehicles, or enterprise/industrial IoT). It sets out expectations that privacy be built in by default, that consent be specific and as easy to withdraw as to give, and that most IoT processing will require a Data Protection Impact Assessment, with an even higher bar where children are likely users. This is relevant for life sciences companies developing consumer-facing wearables or health-monitoring devices that sit outside the medical device regulatory perimeter. The ICO has confirmed it is now turning its attention to connected televisions.

Kuran Phull is employed as a trainee solicitor at Arnold & Porter’s London office. Amalia is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.