Digital medicine’s international race for regulatory sandboxes and voluntary alternative pathways picks up tempo

Abstract

The last months of 2025 have brought major new policy initiatives and pilots for digital medicine and AI regulatory sandboxes from the EU, UK, and US regulators. The EU has seen a regulatory simplification package with the promotion of sandboxes for innovative technologies. The UK sees the start of an important second phase of the world-leading ‘AI Airlock’ regulatory sandbox program. TEMPO, a major voluntary alternative pathway regulatory innovation pilot for digital health in chronic disease has been announced by the US FDA. These frameworks bring flexible approaches to explore digital health technology innovation together with regulatory innovation. They will all substantially advance digital medicine, with the US TEMPO project being the most innovative, bringing sandboxing principles to the on-market phase.

The approach of international regulatory frameworks for digital health technologies (DHTs), from their inception, has been to treat them like traditional physical medical devices – i.e., atomic and immutable. A device is “a thing made or adapted for a particular purpose, especially a piece of mechanical or electronic equipment” and the medical devices which preceded DHTs were just that – conceived by man for specific purposes. As devices are fixed and pre-conceived things, it made sense to regulate them based on lists of requirements, set out in standards and personalized by manufacturers to each product. Is this model perfect for all time, and as suitable for software as to the physical devices for which it was developed? Software has immutable and mutable properties. It can be fixed, or locked with frozen properties, or it can be flexibly implemented, calling upon changing libraries and with flexible interactions, and updated on frequent sprint cycles¹. With the advent of AI, the self-learning of models become, at least theoretically possible in real time¹, and re-training is already highly practical over weeks and months¹. With the advent of LLMs and other foundation and generalist models, AI-chatbots provide highly flexible and non-deterministic responses to open prompt formats, and can be built into self-executing agentic systems^2,3. AI-models are already in use in medicine that use zero-shot reasoning to solve real point-of-care medical problems, simulating generalist medical intelligence. By definition this is not a device, as its flexibility and generalizability goes beyond the fixed device conept⁴. International medical device regulation is highly influenced by the approaches of the UK, US and EU⁵. In late 2025 the regulatory bodies in these countries have announced approaches which acknowledge, much greater than before, that novel DHTs need innovative digital regulation approaches, including regulatory experimentation and co-learning spaces. These approaches are described and compared. With any innovation in regulation there is a risk of reading too much or too little into the changes being explored. These proposals cannot be seen as a wholesale shift from static, atomized device-centered regulation to adaptive, intelligently reactive governance for digital medicine. They are better seen as the tentative exploration of the next steps on this journey.

The EU and the Digital Omnibus Package and proposals to revise the AI and medical device regulations

A principal promise of the second Presidency of Ursula von der Leyen of the European Commission, beginning in December 2024, has been to cut red tape and to promote the implementation digital and AI decade for Europe⁶. The need for change was highlighted in the Future of European Competitiveness report by the important EU figure Mario Draghi⁷. He describes a ‘mid-tech trap’ where the EU is caught in a forever loop of incremental innovation relatively unprofitable mid-tech sectors, rather than advancing real high-tech transformational innovation. To blame for this are lack of access to capital and over-regulation, factors that can hardly be seen as separate phenomena⁸. Not many took the EU seriously on this commitment – and the last months of 2025 brought surprise through a genuine commitment from the Commission to reduce regulatory burden for medical devices and AI, including for digital medicine.

EU Digital Omnibus Package and proposed revision of the medical device regulations

On 19 November 2025, the European Commission published its Digital Omnibus Package which includes many amendments to EU digital legislation, aimed to reduce regulatory burden and stimulate competitiveness⁹. A number of these proposals will affect the regulation of DHTs. There is a measure to facilitate the use of personal data, clarifying data controllers can rely on legitimate interests, implemented through amending the main data protection regulation, the GDPR¹⁰, that would allow the processing of personal data for the training, development and operation of an AI system. There is also a measure which would effectively codify a recent decision of the Court of Justice of the European Union, that information is not personal data for a given entity (e.g., a manufacturer), if they cannot identify the person to whom the information relates, with taking into consideration the means reasonably likely to be used to achieve identification¹¹. Related to this, a measure would recognize that pseudonymized data may, in certain circumstances, no longer be considered personal data for certain entities. There is a further measure to postpone the entry into application of AI Act provisions for high-risk AI, and transitional periods for entry of certain transparency requirements for generative AI as well as targeted amendments to other EU AI Act provisions on oversight, AI literacy, documentation and registration. There is a proposed deferment of AI Act obligations for high-risk AI systems (that currently include most AI-enabled DHTs) from August 2026 until such later date when measures to support compliance, such as harmonized standards, common specifications, and Commission guidelines, are available, a measure I called for in ref. ⁵.

On 16 December the “Proposal for a revision of Regulations (EU) 2017/745 and 2017/746” (i.e., for simplifying the Medical Device Regulation (MDR)¹² and In-Vitro Diagnostic Medical Device Regulation (IVDR))¹³ was published by the European Commission¹⁴. This proposal is planned to pass through the European Council and Parliament procedures, and after refinement and changes, to come into force in late 2026 or 2027. It brings many proposed changes to the general EU regulatory framework for devices, including combination products and companion diagnostics, and it is likely to have a profound effect on the future regulatory framework. The proposal is one of simplification, changing MDR and IVDR requirements to reduce the regulatory burden. These changes will affect DHTs, as well as other medical devices, with the removal of the automatic need for recertification after 5 years The proposed changes also promote the concept of “digital by default” for the digital transformation of regulatory processes. There are several measures to reduce the clinical and post-market surveillance reporting requirements for devices, reducing some reporting frequencies and increasing the time allowed to manufacturers for some reporting activities. There are proposals to simplify labeling requirements and to promote modernized change management through predetermined change control plans (PCCPs)¹. Subject to adoption, there will be reduced Notified Body involvement for some device types, reduced unannounced audits, less frequent audits and the promotion of presubmission dialogue. Alongside, there would be stronger centralization of conformity assessment processes, while keeping the overall decentralized process with Notified Bodies. Importantly for DHTs, there are proposed changes to the classification rules for software. This is one area where experts disagree on the intention and implications of the proposal. Therefore, I do not describe these changes in detail here, as they are, in their current form, likely to confuse as much as to enlighten. Hopefully, the wording will be made clearer in the process between proposal and finalized law. Also proposed is a streamlined processes for the in-house development of medical devices, a highly positive change as hospitals are important factories of AI innovation^15,16. One for the few additional requirements would be new reporting requirements on cybersecurity vulnerabilities and incidents.

Most important for DHTs, under the proposal, sandboxes are promoted for emerging technologies, including AI-enabled medical devices. Importantly, many of the provisions of the AI Act¹⁷ would be moved into the MDR and IVDR directly, with some of the AI Act’s provisions dropped. Sandboxes, as considered under the revised MDR and IVDR, would be controlled environments for the testing and validation of innovative medical devices and IVDs under controlled regulatory supervision. For sandboxes methods to be applied, devices must address unmet needs or provide significant benefits for patients and there must be evidence that the standard regulatory requirements and approaches would impede or significantly delay development. A sandbox plan needs to be prepared, and member states can request EMA Expert Panel input on these plans. Interestingly, there is also a proposal for Union regulatory sandboxes, as commission-led environments, for informing regulatory requirements and approaches for emerging technologies.

The UK MHRA Airlock second cohort and large language models

The UK regulator, the MHRA, led the world in the exploration of the path forward for regulating Large Language Models (LLMs) in medicine in the first cohort of their “AI Airlock” (the UK name for AI regulatory sandboxes)^5,18, and the results of this sandbox were published on 16 October 2025¹⁹. Also, on 16 October 2025, the MHRA announced the selection for the manufacturers and devices in the second Airlock cohort (Phase 2), which include 7 additional AI-enabled technologies (known as ‘candidates’). Phase 2 will run until April 2026 and aims to address three core regulatory challenges relevant to emerging AI-enabled DHTs, specifically: (i) those of adaptive/evolving/self-learning AI-enabled DHTs¹; (ii) AI-enabled diagnostics; and (iii) implementing robust post-market surveillance. Each of these three challenges will be addressed with both multi-environment and simulation candidates. The AI Airlock has three testing environments. The simulation candidates will be explored through (i), a simulation environment, with focused roundtable workshops involving multiple stakeholder perspectives to address simulated scenarios. The multi-environment candidates will test each regulatory challenge in more than one of the environments, which also include, as well as (i), the: (ii) a virtual/research environment with testing in a controlled data environment that addresses specific research questions and generates evidence; and, (iii) a real-world environment ‘silent mode’ deployment of a product in the environment of its intended use with separation from the clinical pathways and decision-making processes. Candidates will include: (i) LLM-enabled clinical note taking; (ii) personalized evidence-based explanations of blood test results in accessible language; (iii) advanced skin cancer diagnostics; (iv) AI-augmenting pathologists’ interpretation of digital pathology slides; (v) eye disease detection tools; and, (vi) obesity treatment support systems.

The final candidate (vii) is potentially of huge importance and reveals the ambition of the entire Airlock program. The Airlock will assess, in multiple environments, the NHS England LLM-enabled summarization tool (for multiple use cases), with live monitoring and updates, hosted through the AI medical devices management functionality of the NHS Federated Data Platform²⁰. Although the specifically sandboxed tools are those with the modest purposes of discharge summary creation and assisting with clinical coding, in my view it is highly likely that the safety explorations will be relevant to ‘later’ advanced intended purposes of this technology stack, which are highly likely to include clinical decision support.

U.S FDA TEMPO pilot for expanding access to digital health in chronic disease – an ‘on-market’ regulatory sandbox

On December 05, 2025, the U.S. FDA announced and launched a new voluntary digital health devices pilot called TEMPO (Technology-Enabled Meaningful Patient Outcomes designed to increase access to chronic disease technologies, while safeguarding patient safety. Developed by the FDA’s Center for Devices and Radiological Health (CDRH), the pilot introduces a new, risk-based enforcement approach for digital health devices that improve patient outcomes in chronic cardio-kidney-metabolic, musculoskeletal, and behavioral health conditions. TEMPO will operate in collaboration with the Centers for Medicare and Medicaid Services (CMS) Innovation Center (CMMI) Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) model. In TEMPO, digital health manufacturers will offer devices that provide care, covered by the CMMI ACCESS model, while simultaneously collecting, monitoring, and reporting real-world performance data. The aim is to increase FDA and CMS understanding of how digital health technologies perform in real-life settings in improving chronic diseases care and to support and enable CMS efforts to expand access to technology-enabled care. DHTs to be considered will include those addressing low acuity cardiometabolic conditions (e.g., prediabetes), more complex cardiometabolic conditions (e.g., heart failure), musculoskeletal issues (e.g., chronic back strain), and behavioral health conditions (e.g., depression). TEMPO is a part of the FDA’s Home as a Health Care Hub initiative²¹, which aims to develop a regulatory framework that promotes rather than stands in the way of bringing health and wellness to people where they live. The novelty of TEMPO is that participating manufacturers can specifically request that the FDA exercise ‘enforcement discretion’ over certain regulatory requirements during the period when real-world data demonstrating the device’s performance is collected. This data must be shared back with the FDA and could include aspects such as normal premarket authorization and investigational device requirement²². In many ways, this can be considered a form of Voluntary Alternative Pathway (VAP) with lower regulatory requirements linked to the sharing of rich data that informs regulatory learning², a type of ‘on-market’ regulatory sandbox for highly innovated and highly-needed digital medicine technologies. In prior work, coauthors and I have called for this approach for highly innovative DHTs, including agentic systems². This rationale for the pilot is based on two primary observations and needs: (i) digital health technologies inherently have a rapid and iterative development processes^1,5; and, (ii) there is a large patient need and health system need for access to innovative technologies. This pilot aims to bring regulatory science and regulatory policy to bear on these needs and respond to them - providing a highly flexible program, allowing the regulatory framework to catch up and keep pace with technological development while safety is protected through Real World Data (RWD) collection, data sharing and Real World Performance (RWP)-monitoring. The FDA will work with participants to identify how enforcement discretion will be applied to individual devices. The FDA has been seeking statements of interest for participation in the TEMPO pilot since 02 January 2026, and it anticipated that there will be up to about ten selected manufacturers in each of the four clinical use areas²³.

Summary

So, which country is proposing better digital-first approaches for regulating DHTs? There is no doubt that the US pilot TEMPO has the greatest flexibility, as a pilot of a VAP, linking extensive RWP-monitoring with cooperative exploration of the regulation of new approaches to tackling the most important diseases for humanity. Collectively, the chronic cardiovascular conditions, metabolic diseases, musculoskeletal and behavioral conditions cause great costs for economies, increasing with demographic change and cause great personal suffering. The TEMPO approach takes aspects of the existing US system, such as enforcement discretion, which is a form of non-regulation, and links these to highly responsible and adaptive oversight. This creates a form of merged highly innovative pre/post-market regulatory sandbox for DHTs and should be commended. The UK’s Airlock Phase 2 has great ambition in addressing the most pressing questions for regulatory and manufacturers, as a post-market sandbox, but inclusion of the NHS federated learning platform for multiple use case LLM-enabled summarization effectively explores ‘in house’ roll-out of LLM-based reasoning across the entire NHS, and it learnings will likely be applicable beyond summarization and coding. The EU’s proposed frameworks for Sandboxes and PCCPs may seem modest in comparison to the new US and UK frameworks, however, I would interpret these differently. In my view, the EU is signaling a change of regulatory approach to highly innovative technologies, and acknowledging that highly-innovative AI-enabled technologies need regulatory innovation in response. It may be that EU regulation (i.e., what some consider to the supertanker of EU overregulation) will change direction, and can be an engine, of science-led regulatory innovation, exploring new ways of ensuring safe and flexible DHTs have a path to market.

Author contributions

S.G. developed the concept of the manuscript, wrote the first draft of the manuscript. Edited the manuscript, revised it critically for important intellectual content and had final approval of the completed version. S.G. takes accountability for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.

Data availability

No datasets were generated or analyzed during the current study.

Competing interests

S.G. is an advisory group member of the Ernst & Young-coordinated “Study on Regulatory Governance and Innovation in the field of Medical Devices” conducted on behalf of the Directorate-General for Health and Food Safety of the European Commission. S.G. has or has had consulting relationships with Una Health GmbH, Lindus Health Ltd, Flo Ltd, Thymia Ltd, FORUM Institut für Management GmbH, High-Tech Gründerfonds Management GmbH, and Ada Health GmbH, and he holds share options in Ada Health GmbH. S.G. is a News and Views Editor for npj Digital Medicine but is not part of a peer review process or decision making of this manuscript. S.G. played no role in the internal review or decision to publish this article.