Digital Developments:
AI, Data, Cybersecurity and Compliance
This page provides a concise overview of the key digital developments between 2026 and 2027 and shows how artificial intelligence, cybersecurity, health data and modern software assurance are reshaping regulatory practice across MedTech, Pharma and Life Sciences.
Four digital focus areas are reshaping compliance and product development
Between August 2026 and the end of 2027, artificial intelligence, cybersecurity, health data and digital validation will become increasingly important from a regulatory perspective. For MedTech, Pharma and Life Sciences companies, implementing individual new requirements in isolation is no longer sufficient. Digital systems increasingly need to be managed through governance, risk management, data quality and regulatory controls across their entire lifecycle.
With the AI Act becoming generally applicable from August 2026, the regulatory classification of AI systems becomes an operational responsibility. Companies need to determine which role they assume for each system, which transparency requirements apply and whether an application qualifies as high-risk AI. Additional transitional and application deadlines for general-purpose AI and certain high-risk systems will follow through the end of 2027 and beyond.
The Cyber Resilience Act is transforming cybersecurity from a predominantly technical discipline into a regulatory lifecycle responsibility that must be documented and controlled. Certain vulnerability and incident reporting obligations will already apply from September 2026. From December 2027, the core requirements for products with digital elements will become applicable. For regulated products, it remains essential to assess which sector-specific provisions and exemptions apply.
With the European Health Data Space, the regulatory governance of health data is becoming increasingly important. The general application date in March 2027 marks only the beginning of a phased implementation process. For companies, this creates new interfaces between data access, interoperability, secondary use, data protection and existing regulatory documentation.
Computerised system validation is increasingly moving towards risk-based assurance. GAMP 5 remains the fundamental framework, while AI-specific guidance, FDA Computer Software Assurance and modern approaches for cloud, SaaS and process control systems continue to expand the methodology. At the same time, the draft revisions of Annex 11 and Annex 22 indicate that AI in critical GxP applications is expected to become more closely integrated into governance and lifecycle controls.
AI governance, cybersecurity, data governance and validation are becoming increasingly interconnected. For regulated companies, it is therefore essential not to manage digital systems in isolation, but to bring the relevant processes together within a shared governance model.
Which digital requirements will become relevant by the end of 2027
Regulatory requirements for artificial intelligence, cybersecurity, software and health data will take effect in several stages between August 2026 and the end of 2027. It is essential to distinguish between general application dates, specific transitional deadlines and sector-specific requirements, rather than reducing digital compliance to a single deadline.
Digital regulation takes effect step by step
The AI Act, Cyber Resilience Act and EHDS have different application dates and addressees. For AI in particular, it is therefore essential to distinguish between general obligations, GPAI, high-risk systems and AI integrated into regulated products.
AI Act and first CRA obligations
The AI Act becomes generally applicable. Companies need to determine the regulatory scope of their AI systems, assign relevant roles and assess applicable transparency and governance requirements. Certain high-risk systems, however, are subject to later application dates.
Member States are generally required to make at least one AI regulatory sandbox operational. This does not create a general submission deadline for companies, but provides a supervised framework for testing innovative AI systems.
Certain reporting obligations for actively exploited vulnerabilities and severe incidents become applicable. Incident and vulnerability processes, reporting channels and internal responsibilities must be prepared accordingly.
Digital product liability and health data
The new EU Product Liability Directive must be transposed into national law. The rules explicitly cover software and digital elements. As a result, software updates, cybersecurity, technical documentation and preservation of evidence become increasingly important.
The EHDS Regulation generally applies from 26 March 2027. At the same time, the Commission must adopt key implementing acts for further implementation. Major operational requirements, including those relating to priority categories of electronic health data, EHR systems and secondary use, will however apply in stages from 2029 onwards.
General-Purpose AI and AI Governance
Providers of General-Purpose AI models that were already on the market before 2 August 2025 must comply with the relevant GPAI obligations. Depending on their role, these include documentation, copyright and transparency requirements.
FDA and EMA approaches increasingly emphasise context of use, data representativeness, performance drift, change control, human oversight and, for AI-enabled medical devices, Predetermined Change Control Plans.
High-Risk AI and full CRA requirements
The postponed requirements for high-risk AI under Article 6(2) and Annex III become applicable. These include risk management, data governance, technical documentation, logging, human oversight and post-market monitoring.
The central cybersecurity and lifecycle requirements for products with digital elements become applicable. Secure development, vulnerability handling, update support, technical documentation and market monitoring must be implemented systematically.
Four digital milestones shape implementation
The key mistake would be to reduce digital regulation to a single AI Act deadline. Operational preparation extends from August 2026 to December 2027 across AI governance, cybersecurity, data and digital product lifecycles.
Review AI inventories, system roles, transparency and governance on a system-specific basis.
Operationalise reporting and escalation processes for vulnerabilities and severe incidents.
Complete QMS, risk management, data governance, documentation and human oversight for relevant systems.
Ensure secure development and cybersecurity throughout the complete digital product lifecycle.
Not every AI application becomes subject to the same obligations at the same time. The general application of the AI Act, GPAI transitional periods and high-risk AI under Annex III are subject to different timelines. For high-risk AI integrated into products under Article 6(1), the relevant application date is generally 2 August 2028. The Cyber Resilience Act likewise requires product-specific assessment of sectoral exemptions and overlaps with existing product legislation.
How AI, software and data are reshaping regulatory practice
Digital compliance increasingly extends beyond individual IT systems. Artificial intelligence, risk-based software assurance, cybersecurity and health data are transforming development, quality and lifecycle processes at the same time. It is therefore essential to manage digital systems in a transparent and regulatory-compliant manner from initial classification through to ongoing monitoring.
Classify and control AI systems from a regulatory perspective
The AI Act turns the regulatory classification of AI into an ongoing governance responsibility. What matters is not only whether a company uses artificial intelligence, but also which role it assumes for the relevant system, which risk pathway applies and which obligations arise as a result. For high-risk AI in particular, governance, risk management, data quality, technical documentation and human oversight need to be systematically integrated.
From traditional CSV to risk-based software assurance
GAMP 5 remains a key framework for the validation of computerised systems, while implementation is increasingly shifting towards critical thinking, intended use and risk-based assurance. FDA Computer Software Assurance, new GAMP guidance and developments around Annex 11 and Annex 22 show that modern cloud, SaaS and AI systems should not be controlled through maximum documentation, but through appropriate, transparent and risk-based controls.
Cybersecurity becomes a continuous lifecycle responsibility
With the Cyber Resilience Act and increasing requirements for software-based products, a one-time security assessment before market placement is no longer sufficient. Vulnerability management, incident reporting, security updates and post-market monitoring need to be organised throughout the entire product lifecycle. At the same time, robust supplier interfaces are becoming increasingly important, as digital components and external services can significantly influence a product's security profile.
Data quality and interoperability become core regulatory processes
The European Health Data Space and the growing use of data-driven systems are shifting the focus from simply storing data to active data governance. Health data need to be managed transparently in terms of provenance, quality, access rights, use and interoperability. At the same time, new interfaces are emerging between primary use, secondary use, data protection, regulatory documentation and the use of data for AI models.
Digital compliance must be managed as an integrated lifecycle
AI governance, software assurance, cybersecurity and data governance do not evolve independently. AI systems require controlled data, software needs to remain secure throughout its lifecycle, and changes can simultaneously affect validation, cybersecurity and regulatory classification. Companies therefore need an integrated governance model that brings together Regulatory Affairs, Quality, IT, Development and relevant business functions.
Turning digital requirements into robust processes and governance
The AI Act, cybersecurity, data governance and modern software assurance affect different parts of an organisation. Effective implementation therefore starts with transparency across systems, roles and regulatory scope, continues with the assessment of existing governance and lifecycle processes, and results in controlled, documented and sustainable measures.
Three levels of implementation for Digital Compliance
AI, software and data systems may simultaneously need to meet requirements arising from product regulation, quality management, cybersecurity, data protection and GxP. Implementation therefore follows a common logic: first establish transparency across systems and roles, then assess risks and gaps, and finally embed governance, controls and evidence permanently into the lifecycle.
Clarify systems and regulatory relevance
The first step is to establish which digital systems, products and roles are actually regulatory-relevant.
Implementation starts with a reliable digital system inventory
Companies should first record AI, software, cloud and data-processing systems according to their purpose, product relevance, criticality and regulatory role. For AI in particular, it is important to determine whether the company acts as a provider, deployer or in another role, and whether a high-risk pathway applies. Sector-specific requirements under MDR, IVDR, GxP or other existing regulatory frameworks must also be taken into account.
Assess governance and risks
Existing processes need to be aligned with new requirements for AI, data, software and cybersecurity.
Digital risks extend beyond traditional organisational boundaries
An AI system can simultaneously trigger requirements relating to risk management, data quality, validation, human oversight and cybersecurity. Software changes may affect performance, validation status and regulatory classification. Regulatory, technical and quality-related risks should therefore not be assessed separately, but within a shared governance model.
Secure the lifecycle and supporting evidence
Digital compliance must remain effective through changes, updates and ongoing operation.
Digital systems require continuous control, not one-time approval
Modern software and AI systems evolve through updates, new data, model versions and external services. Validation or assurance, change control, performance monitoring, vulnerability management and post-market processes therefore need to work together throughout the entire lifecycle. Completing implementation is not the end of compliance, but the beginning of controlled operation and ongoing monitoring.
What needs to be addressed for each digital focus area
The topics are closely interconnected, but require different assessment priorities and evidence. The key is to establish shared governance without losing sight of the specific requirements of individual systems.
System roles, risk classification, data quality, human oversight, technical documentation and monitoring.
A transparent AI governance model with clear responsibilities, a system inventory and lifecycle controls.
Secure development, vulnerability management, incident reporting, updates and supplier interfaces.
A robust cybersecurity lifecycle with defined reporting channels, responsibilities and security evidence.
Data provenance, quality, access rights, interoperability, primary and secondary use.
Transparent data flows and clearly defined governance for regulatory-relevant health and training data.
Intended use, risk-based assurance, cloud and SaaS controls, model lifecycle and data integrity.
Appropriate and traceable assurance supported by robust evidence instead of purely document-driven validation.
Digital compliance should be prioritised based on risk
Systems with a direct impact on patient safety, product quality or regulatory decisions should be addressed first. These are followed by systems with high rates of change or complex external interfaces.
Classify and secure high-risk AI, GxP-critical systems and safety-relevant software first.
Establish roles, data flows, supplier controls and cross-functional governance processes in a structured manner.
Maintain change control, performance monitoring, vulnerability management and effectiveness reviews on an ongoing basis.
Which digital requirements specifically affect your systems and processes?
We support you in the regulatory classification of AI, software and data systems, in conducting gap analyses and in establishing robust governance, validation and lifecycle processes. For a specific challenge, you can contact us directly or use our complimentary initial expert assessment through Express Consulting.
Your Direct Contact
I am happy to assist you personally.