Summary
This week's digest highlights the EDPB's new guidance on smart glasses under GDPR, Italy's enforcement of the EU AI Act, and the legal uncertainties surrounding medical AI. Additionally, the EMA warns of significant changes needed for the Clinical Trials Information System due to the proposed EU Biotech Act, impacting clinical trial sponsors.
Welcome to iliomad's weekly digest for biotech and healthtech professionals. This edition covers the fortnight of 6 to 13 October 2026 and draws together the most consequential developments in data protection, AI regulation, clinical trials governance and healthcare cybersecurity.
1. GDPR and AI Regulation: New Guidance and Enforcement Architecture
EDPB Holds Smart Glasses Manufacturers Directly Responsible Under GDPR
On 13 October 2026, the European Data Protection Board (EDPB), the independent EU body that coordinates the application of the General Data Protection Regulation (GDPR, Regulation 2016/679) across member states, adopted an eight-page preliminary statement on AI-enabled smart glasses and comparable wearables. The EDPB's central conclusion is that device manufacturers and the providers of linked AI services qualify as data controllers in their own right, meaning they bear the primary obligations for lawfulness, transparency and purpose limitation. Critically, the Board rejects the argument that manufacturers can discharge their GDPR duties simply by instructing wearers to notify bystanders: third parties who are recorded without their knowledge retain full data-subject rights, and the burden of compliance falls on those who design and deploy the technology. Life sciences organisations that are evaluating wearable devices for decentralised clinical trials should note that this guidance directly affects their vendor-selection and data-processing-agreement frameworks.
Italy Activates Enforcement Powers Under the EU AI Act
Italy's second AI Act implementing law entered into force via the Official Journal on 8 October 2026, completing the country's enforcement architecture for the EU AI Act (Regulation 2024/1689), which has applied in its principal provisions since 2 August 2026. The National Cybersecurity Agency (ACN) becomes Italy's designated market-surveillance authority, empowered to conduct unannounced remote or on-site inspections and to maintain a register of high-risk AI systems. Fines may reach 7% of global annual turnover for the most serious breaches. For sponsors and contract research organisations deploying AI in clinical decision support or trial monitoring, this signals that national-level AI enforcement is now operational in at least one major EU jurisdiction.
European Parliament Study Exposes Legal Gaps in Medical AI and Health Data Reuse
A study commissioned by the European Parliament's Committee on Public Health (SANT) and reported on 9 October 2026 examines AI applications spanning diagnostic imaging, personalised treatment and hospital management. Its central finding is that reusing medical data to train, test and validate AI systems sits in an unresolved legal space at the intersection of the GDPR, the AI Act and the European Health Data Space Regulation. The authors identify particular uncertainty around the legal bases available for secondary use of patient data in AI model development, an issue that directly implicates clinical research sponsors who aggregate real-world data for regulatory submissions.
2. EU Clinical Trials and Biotech Regulation
EMA Warns That EU Biotech Act Will Force a Near-Total Rebuild of CTIS
The European Medicines Agency (EMA) has advised stakeholders that the proposed EU Biotech Act, still under negotiation between the European Council and the European Parliament, would require changes to approximately 70% of the current functionality of the Clinical Trials Information System (CTIS), the EU's centralised portal established under EU Clinical Trials Regulation 536/2014 (CTR) for submitting, authorising and monitoring clinical trials. The scale of the required rebuild reflects the Act's ambition to create a more favourable regulatory environment for biotechnology by altering data-submission workflows and transparency requirements. Sponsors that have invested in CTIS integration should treat this as a forward risk: data architecture decisions made now may need to be revisited once the Biotech Act's final text is agreed.
EU Launches CHAIN Network to Federate Cardiovascular Health Data for AI Validation
The European Cardiovascular Health Data and AI Network (CHAIN), coordinated by the European Society of Cardiology and funded through the EU4Health Programme, unites 53 partners across 20 European countries including universities, hospitals, health ministries and technology companies. CHAIN's objective is to build a federated ecosystem, one in which data remains at source and only analytical outputs are shared, for testing and deploying AI in cardiovascular care. The initiative illustrates how federated architectures are being adopted to satisfy GDPR data-minimisation obligations while enabling large-scale AI research, a model increasingly relevant for sponsors designing data-governance frameworks for multi-country cardiovascular trials.
3. EU Digital Omnibus: GDPR Simplification in Deadlock
Franco-German Pressure Prevents Council Mandate on GDPR Simplification Package
The EU Council's effort to agree a negotiating mandate for the Digital Omnibus package, a legislative initiative intended to reduce administrative burdens under the GDPR and the Data Act for businesses operating in the EU single market, has now stalled on two consecutive occasions. A Coreper (Committee of Permanent Representatives) session scheduled for 7 October 2026 was reduced to discussion only under pressure from France and Germany, and the rescheduled vote on 11 October was not placed on the agenda at all. The substance of the disagreements relates to the scope of GDPR derogations and the definition of compliance thresholds. Until a Council mandate is agreed, the package cannot advance to trilogue negotiations with the European Parliament, leaving the compliance calendar for businesses uncertain.
4. Healthcare Cybersecurity: Escalating Threats and Expanding Breaches
97% of US Healthcare Organisations Suffered Cyberattacks in the Past Year
The fifth annual "Cyber Insecurity in Healthcare" report, published on 13 October 2026 by Proofpoint in partnership with the Ponemon Institute and based on a survey of 705 IT and IT-security practitioners at US healthcare organisations, finds that 97% of respondents experienced at least one cyberattack in the preceding 12 months and that 74% of those attacks disrupted patient care. These figures carry direct implications for clinical trial sites, where network breaches can compromise trial data integrity, delay safety reporting and trigger obligations under both the HIPAA Security Rule (45 CFR Parts 160 and 164) and, for EU-facing studies, the GDPR's 72-hour breach notification requirement under Article 33.
Oracle Health Breach Now Affects Nearly 20 Million Patients at Up to 80 US Hospitals
Attackers accessed legacy Cerner servers at Oracle Health before early 2025; Oracle began notifying affected healthcare customers in March 2025, but the scale of the incident has continued to grow as state attorney-general filings emerge. A Texas breach-notification portal entry dated 2 October 2026 and Bloomberg's reporting on 5 October place the total at nearly 20 million affected individuals across up to 80 US hospitals. The breach underscores the risk posed by unmitigated legacy infrastructure, a concern equally applicable to clinical trial data held on older electronic data-capture systems that have not been migrated to validated cloud environments.
Ransomware Group Claims Breach of Winnipeg's Health Sciences Centre
On 11 October 2026, the ransomware group known as "incransom" posted a claim on its dark-web leak site alleging it had breached the Health Sciences Centre (HSC) in Winnipeg, one of Canada's largest hospital campuses. The claimed data includes patient identifiers, medical records and financial information. HSC has disputed the scope of the claim. The incident is a reminder that healthcare institutions operating clinical research programmes must maintain incident-response plans that address both patient-care continuity and trial-data integrity under applicable Canadian provincial privacy law as well as any applicable GDPR obligations for EU-participant data.
Joint US Advisory Attributes Healthcare Network Intrusions to China-Linked Group
A joint US cybersecurity advisory (reference AA26-281A), based on multiple FBI investigations, attributes a state-linked espionage campaign to the China-based Integrity Technology Group. Confirmed or suspected victims include entities in government, critical manufacturing, healthcare and information technology. Tactics include password-spraying attacks against internet-facing systems. Sponsors and CROs holding sensitive trial data on US-hosted infrastructure should review whether this advisory triggers any contractual or regulatory notification obligations.
5. Digital Health Innovation: AI Diagnostics, Consumer Health and Funding
Clairity Brings FDA-Authorised Breast Cancer Risk AI Directly to Consumers
Clairity's breast cancer risk-prediction algorithm, which analyses routine mammogram images to estimate five-year risk without requiring genetic or family-history data, received FDA de novo authorisation as the first AI tool of its kind. Rather than distribute exclusively through physicians and insurers, the company is partnering with Everlywell, a direct-to-consumer health-testing platform, to reach patients outside traditional clinical pathways. This model raises GDPR and informed-consent questions for any EU deployment: where an AI diagnostic tool is offered directly to individuals, the transparency obligations under GDPR Articles 13 and 22 (automated decision-making) apply in full.
Pew Research: Privacy Concerns Are the Primary Barrier to AI Chatbot Adoption
A Pew Research Center survey of 5,119 US adults, fielded in February 2026 and published on 9 October 2026, finds that among the 51% of respondents who have never used an AI chatbot (such as ChatGPT, Gemini or Copilot), 79% cite data-privacy concerns as a major or minor reason for avoidance. These findings are relevant for life sciences organisations that are introducing AI-assisted tools into patient-facing contexts, including ePRO platforms and eConsent systems, where participant trust in data handling is integral to recruitment and retention.
Closing Note
The developments this week illustrate a rapidly tightening regulatory and threat environment for biotech and healthtech organisations. The EDPB's smart-glasses ruling, Italy's activated AI Act enforcement powers and the ongoing stagnation of GDPR simplification all demand proactive compliance planning, whilst the accelerating pace of healthcare cyberattacks underscores the operational stakes.
If your organisation needs assistance with GDPR compliance frameworks for clinical trials, data-processing agreements for wearable-device vendors, DPIA preparation or AI Act readiness assessments, please contact the iliomad team via our website.
FAQs
Our frequently questions
A study commissioned by the European Parliament's Committee on Public Health (SANT), reported on 9 October 2026, identifies a significant unresolved legal space at the intersection of the GDPR, the EU AI Act and the European Health Data Space Regulation. The core uncertainty concerns which legal bases are available for the secondary use of patient data in training, testing and validating AI models. This directly affects clinical research sponsors who aggregate real-world data for regulatory submissions, as there is currently no clear harmonised framework governing these activities across EU member states.
Extremely serious. The 2026 "Cyber Insecurity in Healthcare" report found that 97% of US healthcare organisations experienced at least one cyberattack in the past year, with 74% of those attacks disrupting patient care. For clinical trial sites, a breach can compromise data integrity, delay safety reporting and trigger notification obligations under the HIPAA Security Rule and, for EU-facing studies, the GDPR's 72-hour breach notification requirement under Article 33. The Oracle Health breach, now affecting nearly 20 million patients, further highlights the risk of legacy infrastructure in clinical data environments.
The EU Digital Omnibus package, which aims to reduce GDPR and Data Act administrative burdens for businesses in the EU single market, is currently in deadlock. Franco-German pressure prevented the EU Council from agreeing a negotiating mandate on both 7 and 11 October 2026. Key disagreements concern the scope of GDPR derogations and compliance thresholds. Until a Council mandate is reached, trilogue negotiations with the European Parliament cannot begin, leaving the compliance calendar for businesses — including clinical trial sponsors — highly uncertain.
The European Medicines Agency (EMA) has warned that the proposed EU Biotech Act would require a rebuild of approximately 70% of CTIS's current functionality. This is driven by the Act's ambition to reform data-submission workflows and transparency requirements under EU Clinical Trials Regulation 536/2014. Sponsors that have already integrated with CTIS should treat this as a significant forward risk, as data architecture decisions made today may need to be substantially revised once the Biotech Act's final text is agreed.
Italy's second AI Act implementing law entered into force on 8 October 2026, making the National Cybersecurity Agency (ACN) Italy's designated market-surveillance authority. ACN can conduct unannounced inspections and maintain a register of high-risk AI systems. Fines can reach 7% of global annual turnover for serious breaches. Sponsors and CROs deploying AI in clinical decision support or trial monitoring must now treat Italy as an actively enforced AI Act jurisdiction and ensure their high-risk AI systems are fully compliant.
Yes. On 13 October 2026, the EDPB confirmed that smart glasses manufacturers and linked AI service providers qualify as independent data controllers under the GDPR. They cannot transfer their compliance obligations to device wearers. Third parties recorded without consent retain full data-subject rights. Life sciences organisations evaluating wearables for decentralised clinical trials must therefore update their vendor-selection processes and data-processing agreements to reflect these responsibilities.
Find out how iliomad can help your company.
Only visible in production
Medical trials and AI: navigating the GDPR, EHDS and EU AI Act overlap
Legal uncertainty surrounds AI use in medical trials. Learn how GDPR, the EHDS and the EU AI Act interact and what sponsors must do to stay compliant.
AI passports and EHDS: what the CHAIN network means for health AI governance
The EU CHAIN network introduces AI Passports and federated health data models. Learn what this means for GDPR compliance, high-risk AI obligations and clinical sites.
Healthcare Data Breaches, AI Transparency and Clinical Research Standards: Weekly Digest
This week: Danish CPR breach, IQVIA Garante fine, OpenAI EU watermarking, Epic MyChart flaws, NIH funding decline and cancer trial QoL standards.
