Life Sciences News in Italy: May 2025

Regulatory

EMA updates guidance on the implementation of Policy 0070 on clinical data publication

On 14 May 2025, the European Medicines Agency (EMA) released an updated version of its external guidance on the implementation of Policy 0070, concerning the publication of clinical data for medicines for human use. The revised document offers practical direction on submitting clinical reports, anonymizing patient information, and redacting commercially confidential content. Policy 0070, in force since 2015, applies to clinical data, composed of clinical reports and individual patient data, submitted under the centralized marketing authorization procedure.

EMA updates Q&A on ESMP

On 13 May 2025, the European Medicines Agency (EMA) published an updated version of its Q&A on the European Shortages Monitoring Platform (ESMP). The document compiles stakeholder questions from multiple sources to clarify common issues and provide practical guidance. Relevant updates address the relationship between the EU list of critical medicines and ESMP reporting requirements, the types of reports that will be generated from submitted data, and who will have access to these reports.

European Commission launches public consultation on JCAs of medical devices

On 28 May 2025, the European Commission launched an online public consultation on joint clinical assessments (JCAs) of medical devices and in vitro diagnostic medical devices under Regulation (EU) 2021/2282 (HTA Regulation). The consultation, which remains open until 25 June 2025, focuses on the final implementing act to be adopted under the HTA Regulation. It sets out the implementing rules to ensure timely EU-level assessments and the appropriate involvement or consultation of relevant experts.

EFPIA publishes report identifying root causes of delays and medicine unavailability

On 7 May 2025, the European Federation of Pharmaceutical Industries Associations (EFPIA) published a report highlighting the main reasons behind delays and limited availability of innovative medicines. These include slow regulatory procedures, late market access assessments, duplicative data requirements, reimbursement delays, and fragmented local decisions. The report calls for collaboration between member states, the European Commission, and stakeholders to address these challenges. The industry supports the Critical Medicines Act and proposes concrete solutions, including filing pricing and reimbursement applications in all EU countries within two years and launching a portal to track application progress across the countries.

AIFA publishes its 2024 report on pharmaceutical advertising in Italy

On 12 May 2025, the Italian Medicines Agency (AIFA) published its report on the advertising of medicinal products in Italy. The report offers a detailed overview of pharmaceutical advertising targeting healthcare professionals in 2024. It examines the volume and nature of the advertised medicines, the characteristics of the submitted promotional materials, and the procedures followed for their submission. It also outlines the findings of AIFA’s inspections and compliance assessments, conducted in accordance with Legislative Decree 219/2006.

 

WCC/Compliance

New predicate offences for corporate criminal liability for animal protection

On 29 May 2025, a bill overhauling criminal provisions on animal protection was definitively approved. In addition to introducing harsher penalties and new aggravating circumstances for crimes against animals, the bill includes the offences provided for by Arts. 544-bis, 544-ter, 544-quater, 544-quinquies and 638 of the Italian Criminal Code among the predicate offences for corporate criminal liability under Legislative Decree 231/2001. Legal entities charged with these new predicate offences may face a base pecuniary sanction of up to EUR774,500 and disqualifying sanctions for up to two years. The bill also extends immunity from prosecution to legal entities in cases provided by special laws concerning scientific experimentation on animals, provided that – as clarified by consistent case law – such activities are carried out in compliance with the relevant regulations. The new legislation will enter into force after 15 days following the publication on the Official Gazette. Legal entities have to assess the impact of the reform and evaluate whether to update their Model of Organisation, Management and Control adopted pursuant to Legislative Decree 231/2001.

CNDEC publishes a paper on the role of the 231 Model in preventing criminal infiltration

On 21 May 2025, the Italian National Council of Certified Accountants (Consiglio Nazionale dei Dottori Commercialisti ed Esperti Contabili, CNDEC) issued a paper highlighting how the Model of Organisation, Management and Control adopted pursuant to Legislative Decree 231/2001 (231 Model) can support companies – especially those operating in high-risk environments – in safeguarding reputation and fostering institutional collaboration. The paper focuses on: the 231 Model's pivotal role in avoiding the imposition of preventive measures or, if such measures are already in place, enabling a subsequent "self-cleaning" process to eliminate the underlying causes of criminal contamination; and the effective and concrete implementation of the 231 Model by means of, for example, embedding controls into daily operations and granting the Supervisory Body genuine independence and resources.

New State-Region Conference Agreement on H&S training enters into force

On 24 May 2025, the Italian State-Regions Conference Agreement approved under Art. 37, par. 2, of Legislative Decree 81/2008 was published in the Official Gazette and entered into force the following day. The Agreement, which regulates duration, minimum content and delivery methods of mandatory Health and Safety training for workers in Italian companies, entails a transitional application of courses compliant with the previous rules for up to 12 months from the entering into force of the Agreement itself (further information on this topic is available in our April newsletter).

 

Data, privacy and Cybersecurity

EDPB and EDPS adopt letter to EU Commission on simplification of record-keeping obligation

On 8 May 2025, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) published a joint letter responding to the European Commission regarding the upcoming proposal to simplify record-keeping obligations under the GDPR. The proposal aims to amend Art. 30, par. 5, of the GDPR by extending the existing exemption from record-keeping requirements to small mid-cap companies (SMCs) and nonprofits with fewer than 500 employees. The EDPB and EDPS expressed preliminary support for the initiative, emphasizing that it shouldn't affect the broader obligations of controllers and processors under the GDPR. However, they urged the Commission to more thoroughly assess the potential impact on affected organisations and to ensure the proposal strikes a fair and proportionate balance between data protection and the interests of smaller entities. A formal consultation will follow once the draft legislative amendment is published.

EMA and HMA publish the joint workplan "Data and AI in medicines regulation to 2028"

On 7 May 2025, the European Medicines Agency (EMA) and the Heads of Medicines Agencies (HMA) published a joint workplan "Data and AI in medicines regulation to 2028." The workplan sets out how the European medicines regulatory network plans to leverage large volumes of regulatory and health data and new tools to encourage research, innovation, and to support regulatory decision making for better medicines that reach patients faster. The workplan lays out a roadmap for managing, analyzing, and sharing data across the network, while adhering to high security and ethical standards. It also provides a framework for coordination to address new legislative initiatives in the EU, notably the pharmaceutical legislation, the European Health Data Space (EHDS), the Interoperable Europe Act and the AI Act.

Italian DPA expresses favourable opinion on draft Decree introducing updates to the National Register of facilities authorized to perform medically assisted procreation techniques

On 8 May 2025, the Italian Data Protection Authority (Italian DPA) published its favourable opinion on the draft Decree of the Italian Ministry of Health (MoH) amending the Decree of the MoH of 7 October 2005 establishing the National Register of facilities authorized to apply medically assisted reproduction techniques to embryos formed and children born as a result of the application of such techniques (Registro nazionale delle strutture autorizzate all'applicazione delle tecniche di procreazione medicalmente assistita, degli embrioni formati e dei nati a seguito dell'applicazione delle tecniche medesime). It introduces significant updates to the register. According to the draft Decree of the MoH, the register will also include data relating to individual treatment cycles undergone by couples, with the aim of achieving high standards of epidemiological quality and data completeness, in line with practices adopted in major European countries. The Italian DPA's observations were primarily focused on the necessity and proportionality of data processing activities, the correct identification of the nature of the data processed (whether pseudonymized or anonymized), and the specification of applicable data retention periods.

Italian DPA fines Italian region for breaching email metadata processing in the workplace environment

On 30 May 2025, the Italian Data Protection Authority (Italian DPA) published a resolution in which it issued a fine of EUR50,000 for unlawfully retaining employee email and web browsing metadata, violating the Guidelines on "Computer programs and IT services for managing email in the workplace and metadata processing" (further information on this topic is available in our June Newsletter). Following an inspection, the Italian DPA found that a regional authority had retained email metadata for up to 90 days, web browsing logs for 12 months, and helpdesk log data, including employee identifiers and ticket histories, for nearly 10 years. The DPA concluded that these practices breached several GDPR provisions, including the principles of data minimization and storage limitation, and the requirement for a valid legal basis for processing.

Italian DPA fines company for monitoring employee's activity while working remotely

On 8 May 2025, the Italian Data Protection Authority (Italian DPA) published a resolution in which it issued a fine of EUR50,000 for unlawfully tracking the geographical location of employees working remotely. The company was found to have monitored employees to verify whether their physical location matched the address declared in their individual remote work agreements. The Italian DPA identified several violations of the GDPR and the Italian Privacy Code, including the absence of a valid legal basis, lack of transparency, and undue interference in employees’ private lives. The Italian DPA emphasized that while employers may need to verify compliance with work duties in remote settings, such monitoring cannot rely on rigid, intrusive technologies that directly track employee activity breaching data protection and labour laws.

 

Public Procurement

Payback: Administrative Court of Rome rejects appeals filed by some medical device companies

On 7 May 2025, the Regional Administrative Court of Rome published its first “pilot” rulings on payback. The court rejected the appeals and declared the additional grounds inadmissible due to lack of jurisdiction of the administrative Judge. The main points of the rulings are:

• On the retroactive nature of the rule and the setting of spending caps, the court argued that the payback was already known to companies in the sector;
• According to the court, the applicant company, like other companies in the sector, should have been considered already aware, ex ante, of the contractual risks inherent in the supply of medical devices, precisely on the basis of the rules already in force;
• There is no violation of European legislation on public tenders because the payback remains unrelated to the award procedures and the content of the individual contracts entered into with the administrations. According to the court, the payback does not alter the outcome of public tenders;
• The court declares that it has no jurisdiction in relation to the additional grounds, arguing that the regions, in carrying out the calculations, had performed purely operational and technical activities that did not involve the exercise of any authoritative power. For this reason, the ordinary Civil Court would have jurisdiction.

 

Antitrust

ICA investigates potential antitrust issues in UNICO-CEF merger

On 13 May 2025, the Italian Competition Authority (ICA) opened an investigation into the proposed merger between UNICO La Farmacia dei Farmacisti S.p.A. (UNICO) and Cooperativa Esercenti Farmacia S.c.r.l. (CEF) as it preliminary concluded that the merger could significantly impede effective competition on the local markets for wholesale distribution by full-line wholesalers of medicines and parapharmaceutical products, especially in areas around 11 warehouses of CEF and UNICO where significant horizontal overlaps between the parties' businesses were detected.

 

Tax

Italian Revenue Agency rules on reduced VAT rate on Healthcare Protective Clothing

On 23 May 2025, the Italian Revenue Agency published ruling no. 141/2025, which confirms that the reduced 5% VAT rate set forth in No. 1-ter.1, Part II-bis of Table A annexed to Presidential Decree 633/1972 remains applicable even after the end of the COVID-19 emergency. The categories of goods that can benefit from the reduced VAT rate include protective clothing items (eg gloves, protective suits, shoe covers), which may qualify as either personal protective equipment or medical devices, provided that their Combined Nomenclature (CN) code is included in the list set out in Circular No. 5/D of 2023 issued by the Italian Customs Authority. In such cases, the reduced VAT rate applies on an objective basis – regardless of the identity of the seller or purchaser and throughout all stages of the supply chain – as long as the goods are intended for preventive health purposes. The purpose is presumed unless clear and unambiguous evidence to the contrary is provided.