A More Volatile World: The Digital Omnibus

Legal news, , , , , , , ,

On November 19, 2025, the European Commission unveiled a landmark proposal: the Digital Omnibus Regulation. This initiative is not just another legislative tweak – it signals a philosophical shift in how Europe approaches digital regulation. In a world increasingly defined by volatility, complexity, and rapid technological change, the Commission seems to be saying: “We’ve heard you – let’s regulate, but let’s make it easier to comply.”

Why Now? The Context Behind the ‘Digital Omnibus’

The proposal comes against a backdrop of mounting pressure on Europe’s competitiveness. In his now-famous “Please, do something” speech to the European Parliament, Mario Draghi urged EU institutions to act decisively to restore Europe’s ability to innovate and compete globally. Could the Digital Omnibus be seen as a response to this heartfelt appeal?

For years, the EU has been a global pioneer in digital regulation – think GDPR, AI Act, Data Act, Digital Services Act (DSA), Digital Markets Act (DMA), NIS2, and more. But this success has come at a cost: fragmentation, complexity, and heavy compliance burdens. Businesses have struggled to navigate overlapping obligations. The Digital Omnibus is designed to change that. In the “explanatory memorandum” to the Digital Omnibus, the Commission emblematically acknowledges, for instance, that “some entities, especially smaller companies and associations with a low number of non-intensive, often low-risk data processing operations, expressed concerns regarding the application of some obligations of the GDPR”.

The ‘Digital Omnibus’ Proposal

The proposal introduces technical amendments and structural simplifications across a wide range of legislation, including:

  • General Data Protection Regulation (GDPR)
  • AI Act
  • Data Act
  • ePrivacy Directive
  • NIS2 Directive
  • Data Governance Act
  • Free Flow of Non-Personal Data Regulation
  • Platform-to-Business (P2B) Regulation (to be repealed

Key Highlights

  • GDPR Simplification:
    • Clarifies the definition of personal data
    • Supports controllers with respect to the criteria and means to determine whether data resulting from pseudonymization does not constitute personal data
    • Introduces flexibility for AI development: processing personal data for AI training under “legitimate interest,” with safeguards.
    • Modernizes cookie consent rules – centralized browser settings to end “cookie fatigue.”
  • AI Act Adjustments:
    • Expands regulatory sandboxes and simplifies compliance for SMEs and mid-cap companies.
    • Clarifies the interplay between the AI Act and other EU legislation
    • Introduces an obligation on the Commission and Member States to foster AI literacy
  • Incident Reporting:
    • Creates a single-entry point for incident notifications under GDPR, NIS2, DORA, and CER – ending duplicative reporting.

A New Philosophy?

There are strong indications that the “Digital Omnibus” is more than a mere technical adjustment and may represents a strategic shift in EU “digital law”. The proposals will now proceed to the European Parliament and the Council for deliberation. It remains to be seen whether words will be turned into action.

Italy’s New AI Law: A Boost for Healthcare Research?

Legal news, , , , , , , , , , , ,

Italy has recently enacted its own “Artificial Intelligence Act”, set to take effect on October 10, 2025.

You might be wondering: Did we really need another layer of AI regulation? That was our initial reaction, too. But a closer look reveals that the Italian AI Law introduces several interesting provisions, especially in the healthcare sector, that could facilitate research for both public and private entities. Here are some highlights:

1. Healthcare Data Processing as Based on Public Interest

The law explicitly recognizes that the processing of health-related personal data by:

  • Public or private non-profit entities,
  • Research hospitals (IRCCS),
  • Private entities collaborating with the above for healthcare research,

is of “substantial public interest.” This significantly expands the scope of Article 9(2)(g) of the GDPR, offering a clearer legal basis for processing sensitive data in research contexts.

2. Secondary Use of Data

The law introduces a simplified regime for the secondary use of personal data without direct identifiers. In particular:

  • No new consent required, as long as data subjects are informed (even via a website).
  • Automatic authorization unless blocked by the Data Protection Authority within 30 days of notification.

This provision applies only to the entities mentioned above so it is limited in scope, but in any case significantly strengthens the framework for nonprofit research projects.

3. Freedom to Anonymize, Pseudonymize and Synthesize

Under Article 8(4) of the AI Law, processing data for anonymization, pseudonymization, or synthesization is always permitted, provided the data subject is informed. This is a major step forward in enabling privacy-preserving AI research.

4. Guidelines and Governance

The law delegates the creation of technical guidelines to:

  • AGENAS – for anonymization and synthetic data generation.
  • Ministry of Health – for processing health data in research, including AI applications.

It also establishes a national AI platform at AGENAS, which will act as the data controller for personal data collected and generated within the platform.

Final Thoughts

While the GDPR aimed to support research, its implementation often created legal uncertainty and operational hurdles. Italy’s AI Law appears to address some of these gaps, offering a more pragmatic and enabling framework for healthcare research.

European Biotech Week 2025 Webinars

Legal news, , , , ,

We hope you had a refreshing and inspiring summer! Hopefully you are fully recharged and ready to dive into the webinars we’ve organized for the European Biotech Week 2025 — a week dedicated to showcasing the power of biotech in improving lives, driving innovation, and shaping a sustainable future.

Curious about the interaction between the AI Act and the Medical Device Regulation? Join us and life sciences experts of the Alliance of European Life Sciences Law Firms for a lively discussion on September 30 (in English) https://www.linkedin.com/feed/update/urn:li:activity:7371220934059450368

Interested to hear how scientists view “biosolutions” and their impact on the future? https://www.womentech.eu/eventi/il-futuro-del-biotech-scienza-per-le-generazioni-che-verranno/ on October 1 is the place to be. This will be a fascinating 360-degree review (in Italian) of what biotech can achieve, and about obstacles to the adoption of biotech scientific solutions. Professors Gardossi and Abbracchio, along with biotech entrepreneur Elena Sgaravatti, will enlighten us.

Focused on life sciences legislation and worried that you may have missed anything new? Head to the hybrid event at our offices (Via Dante 9 – Milan) or online held by our team on October 2 (in Italian) that will tackle the pharma reform, shortages of pharma products, intelligent devices and a new decision on anonymized personal data: https://www.grplex.com/it/convegni/download/1537/life-sciences-tutte-le-novita-normative-del-2025

Hope to see you there!

WHAT’S NEW IN THE UPDATED GUIDELINES ON MEDICAL DEVICE ADVERTISING?

Legal news

The Italian Ministry of Health has published new guidelines on advertising of medical devices (“Guidelines”), which replace all previous guidelines issued by the Ministry over the years.

  • WHAT’S NEW?
  • Advertising aimed at healthcare professionals

When advertising is directed at HCPs, the following requirements must be met:

  • A disclaimer must be included stating that the content is intended exclusively for HCPs; but also
  • a “pop-up” message and/or similar technologies must be implemented to require users to confirm that they are HCPs before accessing the advertising content.
  • Content of the advertising message

Each advertising message must include the following wording: “It is a CE medical device (including the notified body number, if applicable). Read the warnings or instructions for use carefully. Ministerial Authorization of dd/mm/yyyyy”.

  • Expanding use of social networks – including TikTok

The list of approved social networks for medical devices advertising now includes TikTok. However, the following features must be disabled:

  1. Comment function;
  2. Duet function (which allows the user to post his/her video side-by-side with a video from another creator);
  3. Stitch function (which allows a user to crop and integrate scenes from another user’s video into his/her own video).
  • ANY ADVANTAGES FOR COMPANIES?
  • Simplified compliance. Companies now benefit from a single, consolidated regulatory framework gathering all the regulations concerning medical devices’ advertising.
  • Broader digital scope. The inclusion of platforms like TikTok increases the scope of digital channels where advertisement of medical devices is regulated. Regrettably, rules on LinkedIn are lacking.
  • Other marketing channels. The Ministry of Health may admit the use of additional social networks (beyond Facebook, Instagram, YouTube, and TikTok), subject to prior authorization.

Bottom line: a consolidated document is certainly helpful, but we do not understand the choice not to regulate LinkedIn, the channel where the boundary between corporate communication and advertisement of medical devices is more problematic.

What if hospitals don’t pay?

Legal news, ,

Many of our clients encounter challenging dilemmas when public hospitals fail to reimburse the supplies they provide. Our seminar, held yesterday in our auditorium, was designed to discuss risks and potential solutions.

We regret if you were unable to attend, particularly as it was followed by an enjoyable aperitivo. However, we have included the slides presented by our attorneys, Fabrizio Sardella, Damiano Pallottino, and Francesco Clerici, who offered an analysis of the topic from a criminal, administrative, and civil law perspective.

slidesDownload

NIS2: new guidance for companies

Legal news

On April 14, 2025, the National Cybersecurity Agency (“NCA”) published measure no. 164179 (“Measure”) to further implement the decree 138 of 2024 (“NIS2 Decree”).

  • What’s new?

With this Measure, the NCA has identified:

  • Security measures that companies must guarantee in case they are identified as an important subject (annex 1) or an essential subject (annex 2);
  • Types of significant incidents that companies must report, depending on whether they are classified as an important (annex 3) or essential subject (annex 4).
  • Since when?

The Measure will enter into force on 30 April 2025. However, companies will have:

  • 18 months from the communication of their inclusion on the NIS subject list to comply with these new security measures;
  • 9 months from the communication of inclusion on the NIS subject list to activate mechanisms to ensure the notification of incidents identified as significant.
  • As a company, what do you have to do now?
  • Wait for the NCA’s communication to verify if your company has been included in the NIS list;
  • In case of a positive answer, your company will be required to provide further information (such as member states where the service is carried out; name and contact details of a substitute for the point of contact) by May 31, 2025;
  • Implement, within 9 months from the communication of the inclusion on the NIS subject list, mechanisms for the notification of incidents expressly identified by NCA as “significant incidents”;
  • Implement, within 18 months from the communication of the inclusion on the NIS subject list, the security measures expressly identified by the NCA.

Understanding EDS: The Health Data Ecosystem Explained

Legal news, , ,

On March 5, 2025 the Ministry of Health’s decree on “EDS” was finally published. What is EDS and why is it important for life sciences companies?

“EDS” stands for “ECOSISTEMA DATI SANITARI” (health data eco system), a system regarding health data that will be active by March 31, 2026. The new ministerial decree clarifies the architecture of EDS, its content and its necessary safety measures.

EDS will be populated with data deriving from the electronic health record (fascicolo sanitario elettronico). With regard to processing for cure, prevention and international prophylaxis purposes, personal health data will be processed on the basis of consent and subject to information to the patient. Only in case of emergency access to EDS will be temporarily possible to healthcare providers even in the absence of consent.

Anonymized health data included in EDS will be available for the purpose of study and scientific research in the medical, biomedical and epidemiological field.

What’s new? Private and public entities with an institutional research mission may request an extraction of anonymized data by submitting a description of the scientific research they intend to carry out that complies with data protection recommendations. Agenas will evaluate data requests and grant access to the anonymized data.

Regulation On Space Activities Under Parliamentary Examination

Legal news, , , , , , ,

When it comes to human activities in space, a paradigm shift is currently taking place. Government authorities, instead of operating on their own, increasingly opt for the development of multiple forms of interaction with private operators, while the latter are keen to invest to ultimately conduct space activities in partial independence from governments. The involvement of private actors in space missions is led by technological progress and by the view of space as an economic asset.

This phenomenon implies the need for new regulations, shaping the peculiarities of the relationship between governments and private entities, while avoiding any overregulation that would constrain a rising market. The matter is, in fact, sensitive:

1) States – while wishing to interact with private entities and boost the “space economy” – are bound by international treaties and agreements.

2) Private entities need a clear delimitation of the perimeter in which they can profitably intervene, with legal certainty on the allocation of responsibilities. 

3) States and private entities ultimately need each other to harness the inherent potential of space economy. 

Today, space laws regulating the relationship between States and private operators have been adopted by more than 40 countries. Generally, States opt for an authorization system either for specific missions or for a fixed period of time.

Italy still lacks a relevant specific discipline, being merely part of international treaties regulating states’ access to outer space and space resources.

Additionally, section 189 of the Treaty on the Functioning of the European Union excludes the possibility of any harmonization of laws and regulations of EU member states in space-related policies. Thus, member states must ultimately rely on their own forces to regulate the space economy.

The good news is that Italian Parliament is currently examining a legislation, proposed on September 10, 2024, potentially able to fill the regulatory void

Specifically:

  1. the regulation would apply to space activities carried out both by operators of any nationality in Italian territory and by Italian national operators outside Italian territory;
  2. the relevant space activities virtually concern all possible extra-atmospheric human activities and are subject to authorization issued by the Government, which may involve a single space activity or several space activities of the same type or several interrelated space activities of different types;
  3. issuance of authorization is subject to objective (safety of space activities, resilience of infrastructure and, interestingly enough, environmental sustainability) and subjective criteria (including having an insurance contract and financial soundness). However, the Government’s power to deny authorization is broad and highly discretionary: authorization is in fact denied if space activity is detrimental to national interests or if there is any link between the space operator and non-democratic states.

The proposed regime for the allocation of liabilities provides for a liability of the operator for damages caused to third parties on the earth’s surface as well as to aircraft in flight and to persons and property on board of such aircraft. The liability is excluded only if the operator proves that the damage was caused exclusively and maliciously by a third party – unrelated to the space activity – and that could not have been prevented.

Furthermore, the Italian Government will be entitled to exercise a right of recourse against the space operator who caused damage to persons or property.

Will Parliament consider this framework enough to get the ball of space economy rolling? Stay tuned for the parliamentary progresses of this piece of legislation.