Bianca Piachaud-Moustakis is lead writer at Pharmavision, Pharmavision.co.uk.

Bianca Piachaud-Moustakis

On 28 October 2021, the Parliament of the European Union (EU) adopted the revised Network and Information Security (NIS) Directive, commonly referred to as NIS-2, which builds on and repeals Directive (EU) 2016/1148 on Security of Network and Information Systems (NIS Directive) (1). The NIS Directive initially implemented in 2016 is the first piece of EU-wide legislation on cybersecurity aimed at providing legal measures to boost the overall level of cybersecurity in the EU and its specific aim was to achieve a high common level of cybersecurity across the member states.

Although the NIS Directive increased the cybersecurity capabilities of member states, its implementation has proved difficult, resulting in fragmentation at different levels across the internal market. As such, the new NIS-2 Directive is designed to update the previous version issued in 2016 by modernizing the existing legal cybersecurity framework to reflect the ongoing digital transformation of society. This transformation has been intensified by the COVID-19 pandemic, which has expanded the threat landscape by bringing about new challenges with potential cascading effects that can negatively impact the delivery of critical services across the whole of the internal market (2). The number of cyber-attacks continues to rise, with increasingly sophisticated attacks coming from a wide range of sources from both within and outside the EU.

The revised NIS-2 Directive has been assigned to the Committee on Industry, Research, and Energy (ITRE), within the European Parliament, and is intended to form one of the baselines for the European cybersecurity framework, as well as act as a central tool in advancing Europe’s strategic autonomy and the Digital Europe Programme (3).

 In response to the growing threats posed by digitalization and the surge in cyber-attacks, particularly during the COVID-19 pandemic, one of the key changes encapsulated in NIS-2 is the broadening of the scope of the original NIS legislation. NIS-2 significantly increases the number of entities covered by receiving greater clarity as to what constitutes “essential services”. This increased coverage, however, implies that cyber resilience measures will need to be taken at a much larger scale across the European continent due to growing interconnectedness across businesses, rapid digitization, and ubiquitous connectivity across multiple sectors (4). As a collective, more enterprises are becoming systemically important to defend from the risk of cyber-attack.

 The new NIS-2 directive has taken significant steps towards enhancing security governance by making senior managers accountable for cyber resilience. The hope is that this obligation will drive change in a ‘top-down’ approach within organizations. The intention is that cyber resilience must be considered a priority at board and senior management level rather than be confined to the remit of technical teams.

Fines and sanctions. NIS-2 also mandates a more comprehensive set of powers to be conferred on competent authorities in terms of imposing fines and sanctions. The new directive requires EU member states to impose administrative fines for cybersecurity risk management and to report obligations breaches that reach up to €10 million or 2% of total worldwide annual turnover for essential entities (whichever is higher) (5). It is hoped that regulatory fines at this scale that have occurred in other jurisdictions such as with Uber in the United States (US), which was fined US$148 million (€148 million) for a data breach cover up in 2018 (6), and with British Airways in the United Kingdom (UK), which was set a record £183 million (€212 million) fine for infringement of General Data Protection regulation (GDPR) rules for a breach of customer data, also in 2018, will act as a major lever for resilience (7).

 In a further measure, NIS-2 clarifies what constitutes a “significant impact” on a commercial entity. Under the new guidance, this will no longer constitute a defined metric (number of impacted users) but rather whether there was disruption to critical services, or if a firm incurred financial or material loss (4). In addition, the notification period has been reduced from 72 to 24 hours, with reporting obligations to users of services, and potentially the public, depending on the scale and nature of the attack.

Overall, the NIS-2 Directive seeks to strengthen security requirements, address the security of supply chains, streamline reporting obligations, promote encryption and vulnerability disclosure, introduce more stringent supervisory measures, as well as stricter enforcement requirements, including harmonized sanctions across the EU (8). It is hoped that such measures will promote greater transparency to all parties affected by a potential breach and encourage commercial entities to be more responsible in being cyber resilient, as building a more resilient digital ecosystem is now considered an absolute strategic necessity.

Research conducted by Deloitte has found that the pharmaceutical industry is among the most threatened areas for cybercrime globally, a phenomenon that has been further heightened during the COVID-19 pandemic (9). The pharmaceutical industry is built on innovation, comprising all of the characteristics that make it attractive to cyber-attacks, including extensive spend on R&D, highly sensitive intellectual property (IP), a near total reliance on the underpinning technology to efficiently run operations, high income generation as well as trade secrets that also make it a target for industrial espionage. It is estimated that IP can constitute more than 80% of a company’s value, while for smaller organizations this can be close to 100% (10). For the pharmaceutical sector, the consequences of a data breach go beyond just the financial implications of exposed data. It also affects the company’s reputation, diminishes patient and stakeholder trust, and results in operational disruption and potential regulatory fines.

The implications of NIS-2 for the pharmaceutical sector

One of the key changes in NIS-2 is the broadening of the scope of the existing legislation (

). In addition to the sectors covered by the existing directive, NIS-2 now includes public administration and manufacturing of certain critical products, such as medical devices. This significant broadening of the scope of the healthcare sector, by including medical device manufacturers, is indicative of the critical nature of healthcare to society and the economy, and the vulnerabilities the industry faces in the aftermath of the COVID-19 crisis. It also means that it is incumbent upon pharma companies to be more proactive in safeguarding their digital assets.

Sectors covered by the new NIS-2 Directive.

As with the 2016 NIS Directive, micro and small commercial entities are excluded from the scope of the new NIS-2 Directive.

The political agreement reached by the European Parliament and the Council is now subject to formal approval by the two co-legislators. Once published in the Official Journal, the new NIS-2 Directive will enter into force 20 days after publication, whereby member states will then need to transpose the new elements of the directive into national law (11). Assuming that the two‑year transposition period remains, the new organizations encapsulated in the broader scope of the legislation will have to be ready to comply with NIS-2 protocols by 2024.

Directive of the European Parliament and of the Council on Measures for a High Common Level of Cybersecurity Across the Union, Repealing Directive (EU) 2016/1148

Proposal for Directive on Measures for High Common Level of Cybersecurity Across the Union. Shaping Europe’s Digital Future

, Policy and Legislation, 16 Dec. 2020.
3. ECSO, “The European Parliament Adopts the NIS-2 Directive,” Press Release, 28 Oct. 2021.
4. W. Dixon, “What Does the EU’s NIS-2 Cyber Directive Cover?” 

, 1 June 2022.
5. C. O’Donoghue, “Cybersecurity 2.0: European Parliament Adopts New Draft Directive,” 

, Reed Smith LLP, 20 Jan. 2022.
6. H. Somerville, “Uber to Pay $148 million to Settle Data Breach Cover-up with U.S.,” 

, 26 Sep. 2018.
7. Pinsent Masons, “British Airways Faces £183 million GDPR Fine,” 

, 8 July 2019.
8. European Parliament Think Tank, “The NIS2 Directive: A High Common Level of Cybersecurity in the EU,” Briefing, 16 June 2022.
9. Deloitte, 

Deal Breaker: Cyber Risk in Life Sciences M&A

, Report (2018).
10. E. Mossburg, D. Fancher, and J. Gelinne, “The Hidden Costs of an IP Breach,” 

, Issue 19 (2016).
11. EC, “Commission Welcomes Political Agreement on New Rules on Cybersecurity of Network and Information Systems,” Press Release, 13 May 2022.

Bianca Piachaud-Moustakis is lead writer at Pharmavision, 


Vol. 34, No. 10
October 2022
Pages: 8–9

When referring to this article, please cite it as B. Piachaud-Moustakis, “Securing Europe’s Critical Entities from Cyber Attacks,” 

Articles

Under the revised NIS-2 Directive in Europe, pharma companies will need to be proactive in safeguarding their digital assets.

Securing Europe’s Critical Entities from Cyber Attacks

The current legislative code for medicines (Directive 2001/20/EC) was perceived to be in need of improvements pertaining to weaknesses in areas of research, production, and the distribution of medicines in Europe (failings which were exposed by the COVID-19 pandemic) (1). Accordingly, on 25 Nov. 2020, the European Commission (EC) announced the new Pharmaceutical Strategy for Europe, which is likely to result in significant changes to the European Union (EU) regulatory framework and will have a substantial impact on both the marketing of medicinal products and the strategic business planning of pharmaceutical companies (2).

Following this announcement, the EC issued a public consultation on the revision of the EU’s pharmaceutical legislation in September 2021, after which, the EC intends to implement certain ‘flagship actions’ including a revision of the general pharmaceutical regulatory regime envisaged for the end of 2022. All these actions form part of the EC’s future vision of building a European Health Union.

While the strategy aims to introduce new policies and ideas, it also highlights long-standing challenges that have been exacerbated by the coronavirus outbreak. To this end, the strategy puts forward numerous proposals for legislative reforms that are “likely to affect the regulation of the entire life cycle of a medicinal product” (2). The EC’s ‘Communication on the Pharmaceutical Strategy’ identifies the key priority areas for consideration and improvement (3). Summarized by Pinto et al. (2021), the priority areas are as follows:

The performance and adequacy of the current legislation

Unmet medical needs—with a definition or set of principles for “unmet medical needs” under discussion

Incentives for innovation, including the area of unmet needs and a reflexion on regulatory data and market exclusivity

Antimicrobial resistance that includes measures to support innovation of antibiotic development

Future-proofing the regulatory framework for novel products

Improved patient access to, and affordability of, medicines in the EU

Competitiveness of the European markets to ensure affordable medicines, including considering measures to support patients’ access to affordable medicines

Encouraging the repurposing of off patent medicines

Ensuring security of supply of medicinal products in the EU

Ensuring high-quality manufacture and distribution in the EU including consideration of the need to strengthen or adapt good manufacturing practice (GMP) to reflect new manufacturing methodologies

From amongst these priorities, the main elements of the strategy can be classified into three key areas that include the availability, accessibility, and affordability of medicinal products; streamlined innovation and enhanced competition; and securing supply and controlling shortages of medicines.

Availability, accessibility, and affordability of medicinal products

The section on ‘Prioritising unmet medical needs’ in the strategy reflects the belief within EU institutions that “current incentive models neither provide an adequate solution for unmet medical needs nor appropriately incentivise investments in innovation” (2). The consultation process initiated in September 2021 seeks views on potential changes to the current regulatory data and market exclusivities, which pharmaceutical manufacturers currently enjoy upon receiving regulatory approval for new speciality medicines. In addition, this section also highlights anti‑microbial resistance as a key unmet need, together with paediatric and rare diseases. Here, the consensus within the commission is that investments made by pharmaceutical companies are not necessarily supporting these vital areas where unmet needs are deemed to be the greatest.

One of the incentives being proposed in relation to antimicrobial resistance is the use of a ‘transferable exclusivity voucher’, which grants innovators additional periods of exclusivity upon receiving regulatory approval of a new antibiotic (and subject to certain conditions, could be used by the innovators to extend the protection of any other medicine in their own portfolio or transferred or sold to a third-party) (5).

As for affordability, the strategy focuses on the transparency of R&D costs linked to a review of ‘fair return’. Here, the strategy aims to foster price transparency in the hope that better pricing and reimbursement decisions can be made by individual member states. The strategy also considers how competition law enforcement can help address concerns about the affordability of medicines. To this end, the focus is on generic-drug and biosimilar competition, with the EC considering a review of the current incentives programme for orphan medicinal products.

One of the proposals the EC has put forward for supporting access to affordable medicines is the broadening of the ‘Bolar Exception’, which “exempts from patent infringement the conduct of certain studies and trials for the purpose of applying for marketing authorizations” (5). The EC is also considering the creation of a specific regulatory incentive, potentially an exclusivity period, for a limited number of biosimilars that come to the market first. The aim is to further strengthen the impact that generic-drug and biosimilar competition can have on prices.

Furthermore, the EC is also considering new measures to encourage pharmaceutical manufacturers that have been granted EU-wide marketing authorizations via the centralized procedure to market those products in every EU member state (5). This potential action reflects the long-standing concern of the EC that such decisions are not necessarily in line with the needs of patients.

Streamlined innovation and enhanced competition

The strategy refers to the EC’s policy initiatives on intellectual property and data governance and how those can support innovation and competition. Here, special emphasis is being placed on supplementary protection certificates (SPC) in the hope that the optimization of the SPC system will address duplication and inefficiencies that hamper competition. Other important initiatives that would streamline innovation and competition can be found in an advisory article by J. Mulryne 

Securing supply and controlling shortages of medicinal products

The COVID-19 pandemic has brought to light weaknesses in the existing regulatory framework and its inability to ensure the continuous supply of medicinal products while avoiding shortages. In response, EU institutions such as the European Parliament have highlighted the need to revise the current rules by considering both preventative and mitigating measures, which may result in new obligations for the pharmaceutical industry (2).

The commission is in the process of evaluating 

Directive 2001/83/EC on the Community Code Relating to Medicinal Products for Human Use

Regulation (EC) No 726/2004 Laying Down Community Procedures for the Authorization and Supervision of Medicinal Products for Human and Veterinary Use

. It is anticipated that a new regulation replacing these directives will be adopted in Q4 2022 (6). It seems likely that there may also be some revisions to the 

 to target incentives on areas of unmet medical need.

Directive 2001/20/EC of the European Parliament and of the Council

, Legislation, ec.europa.eu, 4 Apr. 2001.
2. J. Mulryne, A. Roussanov, and K. Farkas, “The European Commission’s New Pharmaceutical Strategy for Europe,” Arnold & Porter LLP, Advisory Article, 8 Dec. 2021.
3. EC, 

Communication from the Commission to the European Parliament, The Council, The European Economic and Social Committee, and The Committee of the Regions: Pharmaceutical Strategy for Europe

, 25 Nov. 2020.
4. C.M. Pinto and F. Roy, “Revision of the EU General Pharmaceuticals Legislation—Public Consultation is now Open,” Hogan Lovells, 29 Sept. 2021.
5. J. Fabre, “EU Considers Reform of General Pharma Law,” Pinsent Masons, Out-Law News, 11 Oct. 2021.
6. E. Zhuleku, T. Carmeliet, and R. Allos, “EC Consults on Revision to Pharmaceutical Legislation,” Allen & Overy, Life Sciences Blog, 1 Oct. 2021.

When referring to this article, please cite it as B. Piachaud-Moustakis, “The European Union’s New Pharmaceutical Strategy for Europe,” 

A new strategy aims to bring in legislative reforms that will impact medicinal product regulation within Europe. 

The European Union’s New Pharmaceutical Strategy for Europe

On 31 Jan. 2022, Regulation (EU) 2022/123 was published in the 

Official Journal of the European Union (EU)

 (1). This regulation sets out a stronger role for the European Medicines Agency (EMA) in managing public health crises and aims to formalize the 

 structures and processes that have been used by EMA during the COVID-19 pandemic, while at the same time entrusting several new tasks to the agency (2). The intention is that this ‘

’ process can now serve as a blueprint for creating a more harmonized EU response to future public health emergencies. The regulation became applicable as of 1 Mar. 2022, except for the provisions on shortages of critical medical devices, which will apply as of 2 Feb. 2023. The legislation forms part of the European Health Union package proposed by the European Commission (EC) in November 2020 and is in line with the priorities of the European medicines regulatory network (3).

The COVID-19 pandemic has highlighted the importance of coordination among European countries to protect people’s health, both during a crisis and in normal times. In its first proposal on a European Health Union, the Commission focused on a series of crisis preparedness and response measures that include strengthening coordination at EU-level when faced with cross-border health threats; and revising the mandates of the European Centre for Disease Prevention and Control (ECDC) and of the EMA to provide stronger surveillance, scientific analysis, and guidance before and during a crisis (4).

As part of its extended mandate, EMA will be entrusted with monitoring potential crisis situations, and as such, several new tasks have been assigned to the agency, including the following:

Preparing for, preventing, coordinating, and managing the impact of public health emergencies on medicinal products and on medical devices and the impact of major events on medicinal products and on medical devices

Monitoring, preventing, and reporting on shortages of medicinal products and medical devices

Providing advice on medicinal products that have the potential to address public health emergencies

Providing support for the expert panels provided for in the Medical Devices Regulation (MDR)

Co-ordinating studies to monitor the effectiveness and safety of vaccines

Shortages of medicines and medical devices

The proposal for the regulation noted that during the COVID-19 crisis, “

 solutions were needed to respond to the risk of shortages of medicines and medical devices such as ventilators, surgical masks, and COVID-19 test kits … causes of which were multifactorial with potential issues identified throughout the supply chain” (5). In response to these shortcomings, many of the new provisions contained in the regulation are designed to mitigate shortages of medicinal products in the event of future public health crises.

Under the regulation, EMA will set up and run a European Shortages Monitoring Platform (ESMP) by early 2025, which will act as the sole portal for collecting data and information from companies and member states on shortages, and the supply and demand of critical medicines (6). In addition, the regulation will also establish a Medicine Shortages Steering Group (MSSG), as well as a Medical Device Shortages Steering Group (MDSSG) comprising 12 EU expert panels to provide advice to member states and the EC on high-risk medical devices and in-vitro diagnostic medical devices. The purpose of these steering groups will be “to engage with key industry players to prevent and mitigate potential shortages of medicines and medical devices that can occur during a public health emergency” (5).

The regulation also sets out obligations on marketing authorization holders (MAHs) and medical devices manufacturers, authorized representatives, importers, distributors, and notified bodies duties to:

Provide information that will assist with the monitoring by the MSSG/MDSSG of shortages of medicinal products and devices contained in the critical medicines list and updating this when necessary

Provide a justification for any failure to provide the requested information by the established deadlines

Immediately provide any evidence of an actual or potential shortage of medicinal products or devices

Provide information to EMA by 2 Sep. 2022 that will enable the establishment of a Single Point of Contact (SPOC) network, and the industry Single Point of Contact (iSPOC) network, with mandates to updating this when necessary (7).

The aim of this aspect of the regulation is to ensure the smooth functioning of the internal market for medicinal products and medical devices in crisis situations, as well as to improve the quality, safety, and efficacy of medicinal products in the event of public healthcare emergencies.

In addition to the measures designed to address medicinal and medical device shortages, an Emergency Task Force (ETF) will also be established within EMA to provide scientific advice and review evidence on medicines that have the potential to address public health emergencies, offer scientific support to facilitate clinical trials, and support existing EMA committees with their authorization and safety monitoring of medicines (8). The ETF will build on the experiences gained by the COVID-19 EMA pandemic Task Force (COVID-ETF) set up by EMA during the COVID-19 pandemic.

In collaboration with the ECDC, EMA will also coordinate independent vaccine effectiveness and safety monitoring studies using relevant data held by public authorities. The agency will also invest in and leverage real-world evidence (RWE) to support crisis preparedness and response. This endeavour will include the establishment of a pan-European network of real-world data, known as ‘DARWIN EU’, which will provide EMA’s scientific committees with real-world evidence from healthcare databases across the EU, information pertaining to diseases, populations, and the uses and performance of medicines (9).

According to the document published by EMA on Crisis Preparedness and Management, the key benefits for EMA of having these responsibilities include:

Accelerated evaluation and access to safe and effective medicines which could treat or prevent a disease causing, or likely to cause, a public health emergency

Improved quality of data and the effective use of resources through increased support at EU level towards the conducting of clinical trials in preparation for, and during a public health emergency

Improved coordination and harmonization at EU level in preparation for and during a public health emergency (7).

Over the course of the COVID-19 pandemic, EMA’s engagement with industry trade associations has played a pivotal role in clarifying regulatory expectations and ensuring that adaptations to regulatory requirements in a pandemic context are feasible for industry. This relates to the need to deliver novel vaccines and therapeutics that meet strict regulatory standards in short timeframes, as well as issuing guidance on emerging scientific issues such as viral variants. It is therefore vital that the sustainability of the ETF framework is ensured, thus enabling EU wide preparedness and coordination for emerging future public health threats (10).

Taken within this context, the aim of the extended mandate is to clarify the respective roles and obligations of the different bodies concerned. To be truly effective, the framework established by this regulation should “build on the solutions defined and established during the COVID‑19 pandemic, but also benefit from lessons learned, best practices, and examples from third countries” (6).

Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 2022 on a Reinforced Role for the European Medicines Agency in Crisis Preparedness and Management for Medicinal Products and Medical Devices. Document 32022R0123

Public Health: Health Security and Infectious Diseases

 [Accessed 9 May 2022].
5. J. Mulryne, A. Roussanov, and S. Wilson, “New EU Regulation Reinforcing the Role of the EMA,” 

 [Accessed 9 May 2022].
8. Pharm Tech Editors, “

EMA Initiates DARWIN EU Coordination Centre

Data Analysis and Real World Interrogation Network (DARWIN EU)

 [Accessed 9 May 2022].
10. M. Cavaleri et al., 

When referring to this article, please cite it as B. Piachaud-Moustakis, “Enhanced Role of EMA in EU Crisis Response,” 

EMA has been assigned a formal role in preparing for and managing future public health crises within the EU through the formalization of ad-hoc structures and processes that were employed during the COVID-19 pandemic.

Enhanced Role of EMA in EU Crisis Response

On 22 Sep. 2021, the Secretary of State for Digital, Culture, Media, and Sport (DCMS) published the United Kingdom’s National Artificial Intelligence (AI) Strategy (the ‘Strategy’). In its published form, the Strategy sets out a 10-year plan to make the UK “a global AI superpower” building on R&D successes in the field, as well as previous AI Sector Deal investment, and the establishment of AI bodies and structures, such as the AI Council and Centre for Data Ethics and Innovation (CDEI) (1).

The Strategy follows a raft of related plans, strategies, and roadmaps, such as the National Data Strategy (December 2020) (2), the AI Council’s AI Roadmap (January 2021) (3), the Plan for Digital Regulation (July 2021) (4), and the UK Innovation Strategy (July 2021) (5). The publication of the UK National AI Strategy follows guidance issued by the European Commission (EC), which published its own comprehensive proposals for regulating AI technologies in April 2021, and which regards health as an important application area (6).

The UK remains first in Europe and ranks third globally, behind the United States and China, for private investment in AI technologies (7). For its part, the UK government has invested more than £2.3 billion into AI since 2014, and the Strategy outlines the government’s vision to build on this progress. The Strategy reflects not just the UK’s ambition to use AI for regional prosperity and across sectors, but also to play a key part in addressing global challenges such as achieving net zero, health resilience, and environmental sustainability (8).

The Strategy notes that no definition of AI is suitable for every scenario and therefore differentiates AI as “machines that perform tasks normally requiring human intelligence, especially when the machines learn from data how to do those tasks” (9). This definition helps differentiate AI from other technology or digital policy.

The agenda for the next 10 years is shaped by the three core pillars of the Strategy, under which three key goals have been set.

To experience significant growth in the number and type of AI systems discovered in the UK

To benefit from the highest amount of economic and productivity growth due to AI

To establish the most trusted and pro-innovation system for AI governance in the world (9).

Investing in the long-term needs of the AI ecosystem

Ensuring AI benefits all sectors and regions

Each pillar is divided into short-term (three months) and long-term (3–12 months) outputs, where the Strategy introduces numerous policies and commitments that will be implemented. A summary of the key points is contained in 

. The three pillars identify ‘people’, ‘data’, ‘computing power’, and ‘finance’ as being key drivers to progress, discovery, and to achieving strategic advantage in AI, with the acknowledgement that governance and regulation will need to keep pace with technological development. As such, the Strategy specifies particular courses of action that will be pursued.

A summary of the three core pillars of the National AI Strategy.

Strategy for AI in health and social care

In August 2019, the National Health Service (NHS) AI Lab was created to accelerate the development of safe, ethical, and effective AI-driven technologies to deal with challenges in health and social care. The NHS AI Lab operates under the auspice of NHSX, a UK government body charged with the responsibility for setting national policy and developing best practice for NHS technology, digital and data, including data sharing and transparency. The NHS AI Lab, under the guidance of NHSX, is also charged with the responsibility for formulating a new National Strategy for AI in Health and Social Care, contained in Pillar 2 of the National AI Strategy, which places a strong emphasis on ensuring that the transition to an AI-enabled economy transcends all sectors and regions in the UK. A draft National Strategy for AI in Health and Social Care is expected in early 2022, which will set the agenda for AI in the health and social care sector towards 2030.

For companies operating in the AI, data-driven health, and life sciences sectors, it is clear that the interplay between factors such as R&D, digital technologies, data security and privacy, infrastructure, and ethics will mean that organizations will need to keep a holistic eye on the spectrum of related developments (both within the UK and abroad), particularly as the UK looks to navigate its new position post-Brexit (1).

Comparison with other national strategies

The UK National AI Strategy’s focus on economic growth is consistent with the national AI strategies adopted by countries elsewhere. Nevertheless, there are some features of the Strategy that differentiate it from approaches adopted by other countries, such as its aim to develop the UK’s compute infrastructure of AI applications (4). Despite the significance of such infrastructure to support the advancement of AI, the only other country to address compute capacity in its national AI strategy is the US.

Another distinguishing feature of the Strategy is its focus on international technical standards as a mechanism for governing AI. In this instance, the UK (along with Australia) appears to be more focused on influencing technical standards for AI systems, such as requirements for documentation and reliability testing, rather than developing the legislation itself (8). This approach underscores the British government’s intention to establish the UK as a ‘safe harbour’ for the development of AI technologies and that less regulation will encourage innovation in the sector. However, this position is in stark contrast with the EC’s own position on AI regulation, where it proposes to strictly regulate certain types of ‘high risk’ AI technologies (6).

Furthermore, divergence from the EU on key points, such as those relating to data, may also make it harder for AI developers and companies using AI technologies in the UK to operate in the EU (and vice versa). More importantly, it could also risk the continuity of the 28 June Data Adequacy Decision (DAD) granted by the European Union (EU) when the UK left the EU, which was designed to avoid any conflict between British and European data protection legislation. The DAD ensures the continued and unimpeded transfer of data from the EU to the UK (10).

The UK’s National AI Strategy, which contrasts markedly with the EU’s own proposed AI rules, indicates that the country is keen to ensure it gains an economic boost, post-Brexit. To this end, the UK government is trying to strike a balance within the middle (11). At a national level, this will indeed be helpful to start-ups and smaller businesses, focused initially on the UK market. However, for international businesses and those looking to scale, there will be increased costs involved in ensuring compliance across borders, the greater the divergence between regulatory environments (12).

While the EC has also set out a plan to boost AI innovation, it will strictly regulate applications that could impinge on fundamental rights and product safety and includes bans for some ‘unacceptable’ uses of AI such as government-conducted social scoring (11). However, implementing this approach in healthcare will be more difficult as it will require the careful balancing of core values with a detailed consideration of nuances of health and AI technologies (13). To this end, the EC needs to consider AI’s ability to adapt to different users and contexts, as a ‘one-size-fits-all’ approach may not yield the necessary outcomes in the context of healthcare, a notion recognized by the US Food and Drug Administration (FDA) amongst others (14).

Ultimately, the timelines for AI regulation are also crucial. The EC’s AI proposal is currently undergoing legislative scrutiny in the European Parliament and Council. If the EU adopts its legislation before the UK formally adopts theirs, the EU will have first mover advantage, depriving the UK of the opportunity to act as a trendsetter for AI regulatory standards. Instead, the UK could find itself obliged to align with EU standards (15). Nevertheless, the formulation of the UK’s National AI Strategy, and within it the anticipated new National Strategy for AI in Health and Social Care, underpins the UK government’s long-term commitment and ambitions to supporting and enhancing the country’s digital ecosystem. It also signals the vital importance of the health and life sciences sectors as a pivotal contributor to meeting these aims.

1. E. Keeling, “The UK’s National AI Strategy: Setting a 10-year Agenda to make the UK a ‘Global AI Superpower’,” 

, Digital Hub Blogs, 24 Sep. 2021.
2. UK Gov., 

Digital Regulation: Driving Growth and Unlocking Innovation

UK Innovation Strategy: Leading the Future by Creating It

 (22 July 2021).
6. O. Yaros, A.H. Bruder, and O. Hajda, “The European Union Proposes New Legal Framework for Artificial Intelligence,” 

, 5 May 2021.
7. Business Wire, “The UK Leads Europe and Ranks Third Globally in Artificial Intelligence,” Press Release, 15 Dec. 2021.
8. CMS Law-Now, “‘National AI Strategy’: Step Change for the AI Economy in the UK,” Article, 11 Oct. 2021.
9. HM Government, 

, Policy Paper (September 2021).
10. T. Reilly, “Data Divergence: A Brexit Dividend?” 

, Inside Privacy Feature, 8 Sep. 2021.
11. M. Heikkila, “UK Charts Post-Brexit Path with AI Strategy,” 

, 22 Sep. 2021
12. C. Eastham, “UK AI Strategy Focussed on Economic Growth, Resilience and Ethics,” 

Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD)

, Discussion Paper and Request for Feedback, 

 (2020).
15. D. Cooper, et al., “The UK Government Publishes its AI Strategy,” 

When referring to this article, please cite it as B. Piachaud-Moustakis, “An Overview of the UK’s National AI Strategy,” 

The UK’s National AI Strategy underpins the government’s long-term commitment and ambitions to enhancing the country’s digital ecosystem, with the health and life sciences sectors seen as pivotal contributors to meeting these aims.

An Overview of the UK’s National AI Strategy

The shared goal of the European Commission (EC) Digital Markets Act (DMA) and Digital Services Act (DSA) is to transform how digital content is ranked, advertised, and removed with the aim of restricting the monopoly held by large multinationals in the digital space. Tech companies such as Google, Amazon, Facebook, and Apple (GAFA) operating in the European Union (EU) will have to follow a new set of rules that will apply to all digital services, including social media, online marketplaces, and other online platforms. For pharmaceutical companies and digital therapeutic manufacturers, this would affect how products are digitally marketed and advertised, and the management of personal data sourced from a core platform which falls under the remit of Article 5(a) which “prohibits combining personal data sourced from a core platform service with data from other services offered by the gatekeeper or from third-party services” (1).

The legislative proposal was submitted by the EC to the European Parliament and to the Council of the EU on 15 Dec. 2020. Together with the DSA, the DMA is part of the European Digital Strategy entitled “Shaping Europe’s Digital Future” (2). This proposal is not expected to be implemented until 2023, as it must be approved by the European Parliament and Council.

The DMA is a legislative proposal designed to place significant obligations on the largest tech companies operating in the EU. The aim of the legislation is to create a fairer business environment and to encourage competition by allowing new players to enter the market. The DMA covers eight different sectors that are referred to as ‘core platform services’ that include:

number-independent interpersonal communication services

advertising services offered by a provider of any of the other core platform services (3).

The EC views that these services are characterised by “extreme scale economies that result from nearly zero marginal costs to add users, a significant degree of user lock-in and dependency, and data driven advantages” (4). From the EC’s perspective, this has allowed a small number of large tech companies to wield considerable economic power, thereby assuming the role of ‘gatekeepers’ that determine how smaller companies engage with online consumers.

Under the proposed rules, business users must be granted access to any data they generate when using the gatekeeper’s platform; while companies advertising on the gatekeeper’s platform will have the legal right to access tools and information to conduct independent verification of their ads and will be allowed to manage contracts with customers outside of that platform (3). In addition, gatekeeper platforms will not be allowed to ‘self-preference’, which means ranking their own services more favourably than similar services offered by third parties. Furthermore, gatekeepers will also be prohibited from preventing customers from linking to other businesses outside of their platforms or prevent users from removing any pre-installed software or apps.

The DMA designates gatekeepers using qualitative criteria as well as quantitative criteria. Qualitative criteria are laid down in Article 3(1) of the DMA, while quantitative criteria are presented in Article 3(2). In terms of quantitative criteria, two broad tests are used to identify gatekeepers:

Size of undertaking test: This includes any company providing (a) core services in at least three EU member states; (b) has earned European revenues of more than €6.5 billion in the last three financial years, or which has an average market capitalisation of at least €65 billion; and

Core platform service test: the relevant core platform service has 45 million monthly active end users in the EU and more than 10,000 yearly active business users in the last three years (5).

Companies that meet any of the above criteria can be deemed a gatekeeper as it enjoys an “entrenched and durable market position, either at present or in the foreseeable future” (6). However, the EC may also designate as gatekeeper a company that does not meet all these quantitative thresholds but poses similar risks to the fairness of the market, based on a qualitative assessment. The intention of the DMA is that the regulation will apply to such gatekeepers, where the users of their services are established or located in the EU. According to de Streel, given the fast-paced nature of the internet economy, these obligations would apply ‘ex-ante’ instead of ‘ex-post’, which is usually the case with competition policy (7).

The DSA has a much broader scope than the DMA and is aimed at updating the EC’s e-Commerce Directive of 2000 by introducing new rules and enhanced responsibilities for online intermediaries and platforms regarding content, safety of users online, audit, reporting, traceability, and transparency requirements for all digital providers, as well as certain specific rules for very large online platforms (1). Under the terms of the DSA, the largest organizations (i.e., those that reach more than 10% of 450 million consumers in Europe) will be required to give regulators and external groups greater access to internal data. The DSA will “uphold exemptions from liability enshrined in the e-Commerce Directive, but will impose new due diligence obligations, transparency requirements and establish an EU-wide board for digital regulators” (4). While the DMA focuses on the competitive conduct of digital intermediaries, the DSA aims to regulate the way in which they interact with their customers, with obligations towards preventing the dissemination of harmful or illegal content.

On 23 Nov. 2021, the DMA legislative proposal was endorsed with an overwhelming majority by the European Parliament’s Committee on the Internal Market and Consumer Protection (IMCO), which was to be later voted on in the December plenary session. While the quantitative thresholds were increased slightly (rising to €8 billion in annual turnover in the European Economic Area [EEA] and a market capitalisation of €80 billion), the number of digital markets considered was kept to just one (8). The involvement of national competition authorities was also enhanced, as these legislative bodies are viewed as vital sources of advice to the EC, and which will contribute to future investigations. In addition, the list of digital markets was also extended to include connected TVs, virtual assistants, and web browsers.

The legislation was also amended to include additional rules on the use of data for targeted or micro-targeted advertising except in instances where there is a “clear, explicit, renewed, informed consent”, in line with the General Data Protection Regulation (GDPR) (8). Furthermore, the updated guidance prohibits the use of personal data of children from being processed for commercial purposes under any circumstances. This stipulation is also mirrored in the DMA’s sister legislation, the DSA. Other fundamental additions to the DMA were provisions against “killer acquisitions”, which would be employed in cases of systematic non-compliance. In such instances, the commission would temporarily block takeovers of relevant companies. The fines for systematic non-compliance have been made harsher, with the minimum set at 4% of a company’s annual turnover and the maximum doubled to 20% (9).

The approved text will become parliament’s mandate for negotiations with EU governments, planned to commence under the French presidency of the council in early 2022. The council of the EU has also confirmed its negotiating position on the DSA, a parallel proposal to the DMA intended to regulate illegal content and algorithms online.

The DMA heralds a shift by the EC to a more interventionist regulatory stance by allowing the commission to impose prescriptive rules regulating the conduct of the largest tech firms simply by virtue of their market position (

). More importantly, the DMA is also serving to create another important tool in the EU’s regulatory landscape, following in the example of the GDPR legislation that was formulated in 2018. Although the scope of the DMA at this stage is to some extent relatively narrow, as it is designed to capture only the largest players in the market, smaller businesses may expect to reap the benefits of some of the measures in favour of transparency and competition, as well as gain greater rights and bargaining power vis-a-vis gatekeeper firms (3). In the healthcare domain, companies that act as gatekeepers in the life sciences and digital therapeutics sectors will also be impacted. This is especially relevant in areas relating to Big Data, the creation of digital tools designed to support research and better patient care, and digital marketing.

 A ‘step-change’ in the European Union’s digital regulation.

1. Talking Tech, “EU Digital Services Act and Digital Markets Act: What are the Implications?” 

, Expert Briefing, 21 Jan. 2021.
2. EC, Shaping Europe’s Digital Future: The Digital Services Act Package (last updated on 21 Oct. 2021).
3. J. Peters, “The EU’s Proposed Digital Markets Act,” 

, Competition and Consumer Insight Blog, 23 July 2021.
4. L. Ardill, “Details of the Digital Services Act Revealed,” 

, Article, 15 Dec. 2020.
5. W. Leslie, L. Prompers, and A. Michailidou, “The European Commission’s Digital Markets Act Proposal: Regulating Systemically Important Digital Platforms,” 

, Article, 18 Dec. 2020.
6. A. Portuese, “The Digital Markets Act: European Precautionary Antitrust,” 

Information Technology & Innovation Foundation (ITIF)

, Report, 24 May 2021.
7. A. de Streel, et al., “The European Proposal for a Digital Markets Act: A First Assessment,” 

, Assessment Paper, 19 Jan. 2021.
8. Pinsent Masons LLP, “EU Parliament Prepares for Vote on Digital Markets Act,” Out-Law News, 26 Nov. 2021.
9. L. Bertuzzi, “EU Parliament’s Key Committee Adopts Digital Markets Act,” 


Vol. 34, No. 2
February 2022
Pages: 7–8

When referring to this article, please cite it as B. Piachaud-Moustakis, “Updated Guidance to the EU’s Digital Markets Act,” 

The Digital Markets Act is transforming the use of digital content by the pharmaceutical industry.