Digital omnibus on AI regulation – Considerations for Life Sciences companies

On 19 November 2025, the European Commission published its Digital Omnibus on AI Regulation Proposal, a legislative proposal introducing targeted measures intended to facilitate the practical implementation of the EU Artificial Intelligence Act (“AI Act”).

A central feature of the proposal is a conditional mechanism allowing the application of high-risk AI obligations to be postponed until relevant harmonised standards, common specifications and Commission guidance are available. Under this mechanism, obligations for Annex III high-risk AI systems would apply six months after a Commission decision confirming the availability of standards or guidance, while obligations for Annex I systems, including those regulated under the MDR and IVDR, would apply 12 months after that decision. If no such decision is adopted, the long-stop dates are set at 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.

Impact on MDR/IVDR-regulated AI systems

The proposal has direct implications for AI-enabled medical devices and IVDs. As MDR- and IVDR-covered AI systems fall under Annex I of the AI Act, manufacturers would benefit from the twelve-month post-decision application window, with a maximum extension to August 2028. This gives companies more time to align AI Act compliance with MDR/IVDR processes, particularly while relevant standards are still under development.

The proposal also clarifies that the “grace period” under Article 111(2) AI Act applies where at least one unit of a device model has been placed on the market before the AI Act obligations take effect, allowing additional units of the same model to continue to be placed on the market provided the design has not undergone any significant change.

Primary role of MDR/IVDR conformity assessment

The proposal confirms that MDR/IVDR conformity assessment remains the main pathway for demonstrating compliance with high-risk AI requirements. It also allows conformity assessment bodies to submit one application and undergo one assessment to obtain designation under both the AI Act and the MDR or IVDR, reducing duplication and administrative burden.

Use of special categories of personal data for bias detection and correction

The Digital Omnibus introduces a legal basis allowing the processing of special categories of personal data, including health data, when strictly necessary to detect and correct bias in high-risk AI systems. This processing must follow strict safeguards such as security measures, access controls, timely deletion of data and documentation of necessity.

Expanded opportunities for real-world testing

The proposal significantly broadens the scope for conducting real-world testing (“RWT”) of high-risk AI systems outside AI regulatory sandboxes. Under the amended Article 60, providers or prospective providers may test high-risk AI systems listed in Annex III or covered by Union harmonisation legislation listed in Section A of Annex I (such as AI components of MDR and IVDR-regulated medical devices and IVDs) at any time before the placing on the market or the putting into service of the AI system, either independently or together with deployers.

Lighter obligations for SMEs and small mid-caps

The proposal expands the simplification measures available to smaller companies by extending several obligations and supports to SMEs and small mid-caps. It proposes to allow SMEs, including start-ups, to provide the elements of the technical documentation required under Annex IV in a simplified manner. To this end, the Commission will establish a simplified technical-documentation form targeted at the needs of SMEs and small mid-caps. The proposal specifies that notified bodies shall accept the form for the purposes of the conformity assessment. Small mid-caps do not benefit from the simplified QMS regime but do benefit from the proportionate QMS requirements and may use the simplified technical documentation form. The proposal also extends the simplified quality-management-system provisions previously limited to microenterprises so that they apply to all SMEs (including start-ups). Although the incident-reporting framework remains unchanged, these amendments collectively reduce documentation and system-management burdens.

Forthcoming guidance from the Commission

The Commission will issue additional guidance to support implementation of the AI Act. Expected topics include high-risk classification, transparency, serious-incident reporting, substantial modification and simplified QMS obligations for smaller companies. The guidance package will also cover the practical application of the AI Act's research exemptions under Article 2(6) and (8), including how these exemptions apply in sector-specific contexts such as pre-clinical research and product development in the field of medicinal products and medical devices.

Next steps

This proposal will now move through what is expected to be a challenging legislative process, involving extensive policy and political discussions with both the European Parliament and the Council.

Please contact our team if you have any questions about this new proposal. 

Authored by Hélène Boland and Fabien Roy.