Exclusive Archives

Last year, we published an article examining how policy signals from the Trump Administration reshaped parts of the FDA landscape in 2025. Since then, those signals have translated into concrete regulatory expectations. Sponsors now face a more exacting environment. FDA has finalised guidance on real world evidence (RWE) for medical devices, issued draft frameworks for the use of artificial intelligence (AI) in regulatory submissions, updated cybersecurity expectations for connected devices and sharpened expectations for advanced therapies. In parallel, Europe has moved ahead with binding changes for investigational ATMPs, while global convergence efforts continue through ICH. The question for sponsors in 2026 is no longer what has changed, but how to respond in practice.

This article is intended as a practical thought piece. Rather than restating guidance, we frame the key 2025–2026 regulatory shifts as questions sponsors should be asking of their own programmes. Each question reflects the issues regulators are now testing in reviews, inspections, and scientific advice, highlighting where evidence, governance, or documentation often fall short. We then translate those questions into concrete actions across expedited pathways and RWE, rare disease strategy, advanced therapies and IVDs, ESG disclosures, and CMC and supply chain planning.

Re-framing 2025 shifts as strategic questions

We structure this article around questions rather than statements for a reason. In recent interactions with the FDA and EMA, regulators are less interested in whether sponsors can cite guidance and more interested in whether they can defend their choices. Each question below aims to show sponsors how agencies are now probing submissions: asking sponsors to explain data provenance, methodological trade-offs, risk controls, and governance decisions. If a programme team cannot answer these questions clearly and consistently, that gap is likely to surface during review.

Expedited pathways and RWE

Question to ask: If we propose RWE in place of, or alongside, trial data:

Can we demonstrate clear end‑to‑end data lineage and reproducibility?
Have we identified and mitigated key sources of bias?
When participant‑level data are not accessible, can we justify why the evidence remains fit for purpose?

FDA’s updated device RWE final guidance (Dec 18, 2025) clarifies expectations for relevance and reliability and explicitly allows evaluation of RWE when only aggregate/de‑identified outputs are available, provided robust methodological transparency can be demonstrated.

AI in submissions

Question to ask: Where are we using AI to produce information that supports a regulatory decision (safety, effectiveness, or quality) and do we have a risk‑based credibility plan (context‑of‑use, model risk, validation, lifecycle controls) that aligns with FDA’s Jan 2025 drug/biologic draft (plus the documentation expected for AI‑enabled devices)?

The FDA’s January 2025 draft guidance for drugs/biologics proposes a risk-based credibility framework for AI in drug and biologics submissions and detailed lifecycle and marketing submission recommendations for AI-enabled devices. Their subsequent companion device AI draft guidance covered TPLC documentation and marketing submission content.

Device cybersecurity

Question to ask: Do our premarket files demonstrate a Secure Product Development Framework, complete SBOMs, vulnerability monitoring/patching, and labelling consistent with the June 27, 2025, final guidance, including obligations for “cyber devices” under FD&C Act §524B?

The FDA updated its premarket cybersecurity guidance in June 2025 and aligned recommendations to new statutory obligations.

Advanced therapies and IVDs

Question to ask: Are our ATMP CMC/clinical plans aligned to the EU’s investigational ATMP guideline (effective July 1, 2025) and are we coordinating parallel FDA–EMA advice while tracking the ICH Cell & Gene Therapy Discussion Group (CGT‑DG) roadmap?

EMA’s final ATMP clinical trial guideline became legally effective on 1 July 2025 and ICH’s CGT Discussion Group is advancing a harmonisation roadmap.

ESG divergence and disclosure

Question to ask: How do we keep investor/procurement narratives consistent when the U.S. federal rule is stayed and the SEC withdrew its defence (Mar 27, 2025), while UK SDR and EU CSRD continue to shape expectations?

After issuing a voluntary stay on April 4, 2024, the SEC withdrew its defence of the 2024 climate rule on Mar 27, 2025. Litigation was subsequently held in abeyance for periods in 2025, while the UK FCA’s SDR regime and EU CSRD continue to shape market expectations, albeit with scope adjustments and revised timelines.

Practical implications for development programmes

1) Expedited pathways and RWE: speed with credibility

The path is open, but evidence matters, including provenance, auditability, reproducibility, and bias control, especially for external controls and de‑identified, large datasets. FDA’s device RWE final guidance elevates explicit relevance/reliability assessments and explains when participant‑level data may not be necessary if methods and provenance are robust. Build protocol/SAP before extraction and preserve versioned pipelines.

For small molecules/biologics, assume accelerating pathways hinge on defendable surrogate or intermediate endpoints and strong confirmatory plans; leverage early division engagement and track accelerated‑approval programme updates. For external controls, align to FDA’s draft guidance (Feb 2023): justify data source fitness, comparability, missingness handling and timing; pre‑specify SAPs; and secure FDA access to underlying data.

Sponsor actions

Create a single integrated evidence plan that shows: which decisions will rely on trial data, which decisions will rely on RWE, and how confirmatory evidence will be generated if approval is accelerated.
Before any data are extracted, document how you will handle incomplete data (missingness), control for confounding and population differences, and test whether results change under alternative assumptions.
Use FDA Q‑Submissions to agree, in advance, whether RWE is acceptable, whether external controls are appropriate, and whether de‑identified datasets are sufficient for the proposed use.

2) Rare disease and orphan value cases, pressure testing resilience

Novel therapy approvals continued in 2025 (with 46 CDER novel drugs versus 50 in 2024 and >50% orphan) but the pattern showed a late-year surge and a slightly lower count of CDER novel drug approvals than in 2024. The implication is not to chase speed at the expense of durability. For orphan programmes, ensure your risk-benefit narrative survives closer inspection of surrogate endpoints, external comparators, and manufacturing robustness. In your U.S.–EU plan, remember EMA’s growing clarity for ATMP trials and the ICH CGT roadmap signal where convergence is likely.

Sponsor actions

Where accelerated or conditional approval is based on surrogate or intermediate endpoints, document clear triggers for confirmatory evidence, including what data will be generated, when it will be generated, and what outcomes would prompt changes to the development plan
Maintain regular FDA engagement to confirm whether protocol adaptations, additional cohorts, or endpoint refinements are acceptable as evidence matures.

3) Advanced therapies and IVDs, coordinate global standards early

EMA’s investigational ATMP guideline (effective 1 July 2025) details quality documentation and the consequences of immature quality for later MAAs. Meanwhile, ICH’s CGT‑DG is advancing a harmonisation roadmap across in vivo viral vectors and ex vivo modified cells. Schedule parallel FDA–EMA advice; harmonise CMC narratives; and pre‑agree how site/scale/process changes will be handled in both regions.

Sponsor actions

Identify which critical quality attributes (CQAs) and process controls must remain the same across regions, and document where regional differences will be managed.
For parallel FDA–EMA submissions, define comparability strategies early, document how changes will be justified scientifically (using ICH Q5E principles), and agree change‑management tools such as Established Conditions or PACMPs under ICH Q12.
Where ATMPs are combined with diagnostics or software‑enabled components, review IVD evidence against current cybersecurity and AI documentation expectations, not just clinical performance requirements.

4) Submissions: make credibility your anchor

If AI produces information that supports a regulatory decision for a drug/biologic, FDA’s Jan 2025 draft guidance which proposes a credibility plan/report: define context‑of‑use, assess model influence/decision consequence, validate accordingly, and plan lifecycle monitoring. For AI‑enabled devices, provide TPLC documentation, data management, performance/bias analysis, human factors and change governance. Treat model cards/change protocols as submission‑critical.

Sponsor actions

For each use of AI that supports a regulatory claim or quality decision, document: the context of use, the impact of model outputs on decisions, validation activities, and plans for ongoing monitoring.
For AI‑enabled devices, ensure teams can clearly explain where training and input data come from, how model drift will be detected and managed and how cybersecurity risks are controlled across the product lifecycle, in line with FDA’s TPLC expectations.

5) ESG and disclosure, align investor messaging across the Atlantic

In the U.S., the SEC withdrew its defence of the 2024 climate disclosure rule in March 2025 and kept the rule on hold pending litigation, creating uncertainty for uniform federal climate disclosure. By contrast, the UK FCA’s Sustainability Disclosure Requirements and the EU’s corporate sustainability reporting framework continue to influence investors and buyers, even as the EU pursues simplification and adjusted timelines for some in-scope entities. Maintain a coherent narrative that meets UK and EU needs and avoids greenwashing, while monitoring the U.S. outcome.

Sponsor actions

Review all sustainability‑related statements used in investor materials, procurement responses, and public communications to confirm they are accurate, evidence‑based, and consistent with the UK FCA’s anti‑greenwashing standard.

Where EU CSRD applies, ensure disclosures align across regions, even if U.S. federal requirements remain stayed, to avoid conflicting narratives for investors and partners.

“America First” manufacturing, options and trade-offs

If trade policy or incentives push onshoring/dual‑sourcing, plan CMC for traceability and comparability up front, not as a bolt‑on. Use ICH Q5E for scientific comparability and ICH Q12 tools (Established Conditions, PACMP) for predictable change management across regions.

What regulatory teams should do

If onshoring or dual‑sourcing is being considered, develop at least one alternative manufacturing scenario that sets out which sites will perform which steps, what bridging or comparability data would be required, and how changes would be justified to FDA and EMA.
Assess the impact of these scenarios on the CMC dossier early, including process splits, technology transfer requirements, and validation and change‑control implications.
Coordinate EU–U.S. expectations for quality systems and release testing, noting that EMA’s updated investigational ATMP expectations and ICH CGT workstreams will influence future EU requirements.
A stepwise action plan for sponsors
Map the pipeline against expedited/orphan opportunities; flag programmes that will rely on RWE or AI‑assisted analyses; book early Q‑Subs/Type B meetings to align on fitness and bias control.
Reassess benefit–risk narratives for accelerated paths; document confirmatory strategies that match FDA expectations for surrogate/intermediate endpoints.
Harden device/IVD submissions with cybersecurity files and SBOMs aligned to the June 2025 final guidance and §524B.
Synchronise ATMP plans with EMA’s guideline (1 July 2025) and the ICH CGT roadmap; schedule parallel FDA–EMA advice where it reduces divergence.
Operationalise RWE governance (relevance/reliability assessments, de‑identified dataset justifications, auditable pipelines).
Align ESG communications to UK/EU regimes, keeping U.S. investor messaging consistent during the SEC rule’s stay/abeyance.
Institutionalise cross‑functional governance that locks decisions on comparators, endpoints, model use, cyber controls, and change management across regions (use Q12 tools to codify ECs/PACMP).

What ‘ready’ looks like for sponsors

Pre‑aligned expedited strategies with credible RWE and confirmatory plans.
AI credibility files aligned to FDA’s Jan 2025 drug/biologic draft; TPLC documentation for AI‑enabled devices.
Cybersecurity by design embedded in design controls, SBOMs and submission documentation per the June 2025 final
ATMP CMC/clinical aligned to EMA’s 2025 guideline and ICH CGT priorities.
Consistent ESG disclosures meeting UK SDR and recognising EU CSRD expectations while U.S. rules remain stayed.

Conclusion

Taken together, the regulatory shifts of 2025 point to a single, unifying theme: credibility is now the decisive currency of regulatory strategy. Whether sponsors are leaning on RWE to accelerate decisions, incorporating AI into evidence generation, advancing complex ATMP and diagnostic platforms, fortifying device cybersecurity, or navigating diverging ESG expectations, the agencies’ expectations are clearer, more structured, and far less tolerant of ambiguity. Success in this environment requires moving from reactive compliance to proactive, cross‑functional governance, where evidence plans, quality systems, data pipelines, and stakeholder narratives are aligned from the outset. Sponsors who invest early in methodological transparency, lifecycle‑ready CMC frameworks, harmonised global engagement, and durable governance will not only withstand heightened scrutiny; they will be positioned to secure faster, more predictable decisions across regions. In a year defined by both opportunity and sharper regulatory contours, readiness is no longer about knowing the rules, but about showing, with rigour, that your development programme can meet them.

DLRC partners with sponsors to translate these moving parts into an integrated regulatory strategy, from expedited pathways and RWE governance to AI credibility, device cybersecurity, ATMP CMC and global submissions. If you would like an independent 2026 regulatory-readiness review of your pipeline, our team would be pleased to help.

This article reflects DLRC’s interpretation of recent FDA, EMA and ICH developments as of early 2026