New rules for medicines, medical devices and health data
Medicines, medical devices and health data are governed by rules that change in the EU, Germany, the US and the UK at the same time. COBACK reads the publications every day and checks each one against your medicines, devices, sites and processes.
Topics and rules
What is changing, who in the company works with it and which legal acts are behind it.
Marketing authorisation and market access
The EU pharma package replaces Directive 2001/83/EC and Regulation (EC) No 726/2004. The Council adopted it in September 2026 and publication in the Official Journal is pending. Baseline protection falls to eight years of data protection plus one year of market protection, with possible extensions. An incomplete or insufficiently substantiated environmental risk assessment becomes a ground for refusing the marketing authorisation. Since 12 January 2025, joint clinical assessments under the HTA Regulation have also applied, starting with new cancer medicines and advanced therapy medicinal products. Regulatory affairs and market access are affected.
Examples
- EU pharma package (adopted by the Council in September 2026)
- HTA Regulation (EU) 2021/2282
- German Medicinal Products Act (Arzneimittelgesetz, AMG)
Pharmacovigilance
Marketing authorisation holders must run a pharmacovigilance system with a qualified person responsible for pharmacovigilance (QPPV) and report suspected adverse reactions on time. The duties are set out in Directive 2001/83/EC, Regulation (EC) No 726/2004 and Implementing Regulation (EU) No 520/2012, and EMA's good pharmacovigilance practice (GVP) guidelines describe how to meet them. In Germany, the pharmaceutical company appoints a graduated plan officer (Stufenplanbeauftragter) under section 63a AMG for this. Drug safety and the QPPV are affected.
Examples
- Directive 2001/83/EC, Title IX
- Implementing Regulation (EU) No 520/2012
- EMA guidelines on good pharmacovigilance practices (GVP)
- German Medicinal Products Act (AMG), section 63a
Medical devices and in vitro diagnostics
For devices with certificates issued under the old directives, the MDR transition periods run until the end of 2027 or the end of 2028 depending on class, provided the conditions of Regulation (EU) 2023/607 are met. Since 10 January 2025, manufacturers must give at least six months' notice of an anticipated interruption or discontinuation of supply where it could seriously harm patients or public health. In December 2025 the Commission proposed a targeted revision of the MDR and IVDR, which has not yet been adopted. Regulatory affairs and quality management are affected.
Examples
- Medical Devices Regulation (EU) 2017/745 (MDR)
- In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR)
- Regulation (EU) 2023/607
- Regulation (EU) 2024/1860
Security of supply and falsified medicines
Shortages have become a legislative topic: Council and Parliament reached a provisional agreement on the Critical Medicines Act on 12 May 2026, and the pharma package requires plans to prevent shortages. Prescription medicines generally carry a unique identifier and an anti-tampering device under the Falsified Medicines Directive and Delegated Regulation (EU) 2016/161. Supply chain, quality assurance and regulatory affairs are involved.
Examples
- Critical Medicines Act (provisional agreement, May 2026)
- Falsified Medicines Directive 2011/62/EU
- Delegated Regulation (EU) 2016/161
Clinical research and health data
Clinical trials in the EU run under Regulation (EU) No 536/2014 through the central CTIS portal; in Germany, the Medical Research Act changed the procedures in October 2024. The European Health Data Space Regulation applies from 26 March 2027. Its rules on the secondary use of health data, for research among other purposes, apply from 26 March 2029, and for some data categories only from 2031. Clinical development, data protection and medical affairs are affected.
Examples
- Clinical Trials Regulation (EU) No 536/2014
- Medical Research Act (Medizinforschungsgesetz), BGBl. 2024 I No. 324
- European Health Data Space Regulation (EU) 2025/327
Environment and wastewater
The Urban Wastewater Treatment Directive requires producers of medicines and cosmetics to cover at least 80 percent of the cost of a fourth treatment stage at wastewater plants. On 3 September 2026, Advocate General Kokott proposed in Case C-193/25 that the Court annul this rule; the judgment is pending. Finance and environmental management are affected once Member States put the producer responsibility scheme in place.
Examples
- Urban Wastewater Treatment Directive (EU) 2024/3019
- Court of Justice, Case C-193/25 (Poland v Parliament and Council)
United States and United Kingdom
In the US, device manufacturers have worked under FDA's Quality Management System Regulation since 2 February 2026. For medicines, the Drug Supply Chain Security Act requires certain prescription drugs to be identified and traced electronically at package level. In Great Britain, new post-market surveillance duties for medical devices have applied since 16 June 2025. Regulatory affairs, quality management and vigilance are affected.
Examples
- Quality Management System Regulation, 21 CFR Part 820 (USA)
- Drug Supply Chain Security Act (USA)
- The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024
The path of a change
Example: notice of supply interruptions
01Law database
Regulation (EU) 2024/1860 is published in the Official Journal of the EU. COBACK reads it and picks up the new duty to give advance notice of anticipated supply interruptions for medical devices.
02Relevance
The twin shows that your company makes medical devices at two plants and, according to the product roadmap in Confluence, plans to discontinue two product lines. The relevance score is 91 out of 100. The reasoning cites the provision and the company facts it used.
03Open questions
Whether dropping one of the lines could seriously harm patients is not in the twin. COBACK asks instead of assuming. The head of regulatory affairs answers and marks the change as relevant.
04Task
COBACK creates tasks: by 30 November 2026, regulatory affairs reports the anticipated supply interruption to the competent authority and to the economic operators, health institutions and healthcare professionals supplied directly. Sales informs the customers. The notice is due at least six months before the planned discontinuation.
Working with COBACK
Daily reading of new publications
COBACK reads new publications every day, for example from EUR-Lex, EMA and the Bundesgesetzblatt, along with regulators and parliaments in Europe, the Americas and Asia.
Checked against your medicines and devices
Each publication is checked against your digital twin: group companies and sites, medicines and devices, processes and responsibilities. You get a relevance score from 0 to 100 with its reasoning, the sources and the company facts it used.
Questions instead of guesses
Where a fact is missing, such as whether a product has a second active substance supplier, COBACK asks a question. A person on your team decides whether a change is relevant.
Tasks and an optional module
Relevant changes become tasks with steps, owners and deadlines. Medical device manufacturers can add an optional product compliance module that checks bills of materials against substance lists such as REACH SVHC, RoHS and PFAS.
Frequently asked questions
Does COBACK replace our pharmacovigilance system?
No. COBACK does not process adverse event reports. It shows when pharmacovigilance rules change and, once you have decided a change is relevant, turns it into tasks for the department in charge.
Does COBACK decide whether a rule applies to us?
No. COBACK gives an assessment with a relevance score, reasoning and sources. A person on your team decides whether a change is relevant. COBACK does not give legal advice.
How do our medicines and devices get into the twin?
Through connected systems such as SharePoint, Google Drive or Confluence, public registers, your website and a questionnaire. Nobody uploads files by hand. Where a fact is missing, COBACK asks.
Does COBACK cover the US and the UK?
Yes. Among other sources, COBACK reads the US Federal Register and new legislation on legislation.gov.uk, along with publications from the EU, European countries, the Americas and Asia and from international bodies. You choose which jurisdictions to watch.
