Digital Omnibus and AI Act updates Key implications for MedTech

On 19 November 2025, the European Commission (EC) presented the Digital Omnibus on AI Regulation Proposal (AI Proposal). Adopted as part of the Digital Omnibus Package, the AI Proposal introduces targeted amendments to Regulation (EU) 2024/1689 (AI Act) aimed at facilitating its practical implementation and ensuring a successful roll-out across the European Union (EU).

The AI Proposal puts forward several legislative adjustments, some of which are particularly relevant for the medical device industry. These include:

• Postponing the applicability of provisions on high-risk systems;
• Enabling a broader use of AI regulatory sandboxes and real-world testing; and
• Further clarifying the interplay between the AI Act and Regulation (EU) 2017/745 on medical devices (MDR) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR).

 

I. The Digital Omnibus Package

The Digital Omnibus Package comprises a series of technical amendments to a wide body of EU digital legislation. Its objectives are to stimulate competitiveness, reduce administrative burdens, and simplify the legal landscape in line with the recommendations contained in the Draghi Report, which advocates for stronger productivity through innovation and improved regulatory efficiency.

Despite the breadth of the legislative initiatives concerned, the proposed amendments are largely technical in nature and do not alter the underlying policy goals of the existing framework.

More specifically, the Digital Omnibus Package consists of two legislative proposals:

• A first proposal introducing amendments to several pieces of legislation, including Regulation (EU) 2016/679 (GDPR) and Regulation (EU) 2023/2854 (Data Act), among others; and
• The AI Proposal, which amends the AI Act to support its smooth and effective application and to ensure its consistent implementation across the EU.

In parallel, the EC is also (i) working on its proposal for a European Business Wallets Regulation – intended to simplify regulatory compliance and reduce administrative burdens for businesses – and (ii) carrying out a Digital Fitness Check focused on assessing the cumulative impact of digital regulations on EU competitiveness.

 

II. Impact on the medical device industry

A. Importance of the AI Act for medical device manufacturers

The AI Act substantially reshaped the regulatory landscape for medical devices that are AI-systems or consist of AI-systems. Most medical devices incorporating AI classify as “high-risk” systems under the AI Act and must therefore comply with stringent requirements concerning data governance, robustness, transparency, human oversight, cybersecurity, conformity assessment, and post-market monitoring, among others.

The obligations stemming from the AI Act add a new regulatory layer on top of the MDR/IVDR, requiring medical device manufacturers to demonstrate compliance with both frameworks and significantly raising expectations in terms of safety, accountability, and patient protection.

The AI Act has been in force since 1 August 2024, but its most stringent obligations for high-risk AI systems, covering most AI-enabled medical devices, will not apply until 2 August 2027. Under the new proposal, this could be further postponed to 2028, giving manufacturers additional time to prepare.

B. The AI Proposal

Building on experience gained from the implementation of already applicable provisions and extensive stakeholder consultations, the EC identified several practical challenges that risk delaying or complicating the effective application of the AI Act. These include slow progress in the designation of national authorities and notified bodies for the AI Act, as well as the delayed development of harmonized standards, common specifications, and guidance needed to support compliance by providers and deployers.

To address these issues, the AI Proposal introduces several important amendments, including:

(i) Postponing the applicability of provisions on high-risk systems

The AI Proposal postpones the applicability of obligations for Annex I high-risk systems until the earlier of:

• 12 months after the adoption of an EC decision confirming the existence of specific standards and guidance for high-risk systems; or
• 2 August 2028.

Since medical devices incorporating AI fall under Annex I to the AI Act, this amendment to Article 113 would allow manufacturers to benefit from the extended transitional period and have more time to bring their products to compliance with the AI Act.

(ii) Enabling pre-market real-world testing of all high-risk systems

The AI Proposal amends Article 60 of the AI Act to allow real-world testing of Annex I high-risk systems outside AI regulatory sandboxes before the system is placed on the market or put into service.

This is particularly relevant for AI-driven medical device manufacturers, who will be able to generate pre-market evidence under real-world conditions, subject to appropriate safeguards.

(iii) Clarifying the conformity assessment pathway

The AI Proposal further clarifies Article 43 of the AI Act, confirming that, for medical devices that are AI-systems or consist of AI-systems, the conformity assessment required under the AI Act must follow the procedures set out in the applicable Union harmonization legislation listed in Annex I - namely the MDR and the IVDR.

In practice, this means that medical device manufacturers will be able to rely on the MDR/IVDR conformity assessment procedure to demonstrate compliance with both the MDR/IVDR and the AI Act.

The AI Proposal also introduces a new mechanism in Article 28 of the AI Act requiring EU member states to ensure that any conformity assessment body seeking designation under both the MDR/IVDR and the AI Act may submit a single application and undergo a single, coordinated assessment process.

(iv) Other amendments to the AI Act

Additional measures outlined in the AI Proposal include:

• AI literacy: transforming the obligation for providers and deployers under Article 4 of the AI Act to an obligation on the EC and EU member states to foster AI literacy;
• Simplifications for small mid-caps (SMCs): extending to SMCs regulatory simplifications granted to small and medium-sized enterprises (SMEs), including on technical documentation and quality management system; and
• Data Protection compliance: introducing a legal basis enabling providers and deployers to process special categories of personal data for the purpose of ensuring bias detection and correction.

 

III. Industry reaction and next steps

On 20 November 2025, MedTech Europe – the European trade association for the medical device industry – published its response to the Digital Omnibus Package. MedTech welcomed the EC’s intent to streamline digital legislation and expressed support for key elements of the AI Proposal, including the postponement of high-risk provisions and the expanded possibility to conduct pre-market real-world testing.

However, MedTech also highlighted persistent concerns regarding unclear, fragmented, and duplicative regulatory concepts – including on the definition of “substantial modification” – which, in its view, continue to hinder innovation and delay patient access to advanced AI-enabled technologies. Moreover, the association argued that further postponing the full application date of the AI Act for high-risk systems to 2 August 2029 would more accurately reflect the readiness of the regulatory ecosystem.

 

IV. Next Steps

The European Commission’s Digital Omnibus Package, including the AI Proposal, introduces targeted amendments to the AI Act and other digital regulations to ease implementation and foster competitiveness. For the medical device industry, key changes include: (i) extended timelines for high-risk AI systems, (ii) expanded real-world testing opportunities, and (iii) streamlined conformity assessment through MDR/IVDR pathways. In addition, GDPR simplifications aim to reduce administrative burdens and enable responsible AI development.

However, despite these proposals, significant questions and hurdles remain. For example:

• Revision and clarification of the MDR/IVDR are still needed: Because the Digital Omnibus Package does not directly address the MDR/IVDR, risk management and clinical validation challenges persist for devices incorporating third-party Large Language Models (LLMs). What residual risk is acceptable? How can validation be achieved when core AI components are hosted by external parties? How should risks from “continuously learning” AI and “weight updates” be addressed? These matters still require guidance from the Medical Device Coordination Group (MDCG) or resolution through the ongoing targeted MDR/IVDR revision.
• Omnibus under scrutiny: The Omnibus proposals have been subject to quite some criticism. Environmental and climate organizations have challenged Omnibus I, and privacy groups are raising concerns about the GDPR amendments outlined in the Digital Omnibus Package. Recently, the European Ombudsperson even found maladministration in the handling of Omnibus I, echoing critics’ concerns that the Commission adopted a broad interpretation of ‘urgency’ and failed to sufficiently justify this ‘urgency’. Time will tell which measures will eventually be adopted.

The European Parliament and the Council will now examine the AI Proposal, and amendments are expected as part of interinstitutional negotiations. Some commentators anticipate adoption in 2026, although the exact timeline remains subject to the ordinary legislative procedure and could be subject to delays.