The EU Chips Act is a major European legislative package launched to boost the EU’s semiconductor industry, aiming to double its global market share to 20% by 2030, enhance supply chain resilience, and reduce reliance on external chipmakers. The EU Chips Act 2.0 is a proposed follow-up to the 2023 Chips Act, driven by a coalition of EU member states (including Germany, France, Netherlands) in late 2025 to shift from crisis management to long-term industrial strategy. It aims to secure supply chains, boost competitiveness, and accelerate investment by simplifying regulations and targeting R&D.

Digital Europe

Program Digital Europe is an integral part of the Multiannual Financial Framework 2021-2027, representing the European Commission’s response to the challenges of the digital transformation in the EU. It is a key financial instrument for building digital policy capacity, as recommended by the European Council. The programme builds on and complements existing investment initiatives. The Programme’s main objective is to support the digital transformation of the European economy and society and ensure that it benefits EU citizens and businesses, to support and accelerate the digital transformation of the European economy, industry and society, to deliver benefits to citizens, public administrations, and businesses across Europe, and to contribute to a competitive Europe within Europe. The general objective is further specified in five specific objectives in Regulation (EU) 2021/694 of the European Parliament and of the Council:

Large-scale calculations:

– Implementation, coordination, and operation at EU level of an integrated, demand-driven, high-performance computing and data infrastructure aligned with global standards. This infrastructure will be easily accessible to both public and private users, with a particular focus on small and medium-sized enterprises (SMEs), regardless of the Member State in which users are located. It will also be available for scientific research purposes, in accordance with Regulation (EU) 2018/1488.

– Deployment of operational technology emerging from research and innovation, to create an integrated EU high-performance computing (HPC) ecosystem. This ecosystem will encompass various aspects of the scientific and industrial value chain, including hardware, software, applications, services, interactions, and digital skills, while ensuring a high level of security and data protection.

– Implementation and operation of a computing infrastructure that will exceed exascale capabilities, including integration with quantum computing technologies and research infrastructures, supporting the development of the necessary hardware and software at EU level.

These activities will be implemented mainly through the European High Performance Computing Joint Undertaking, established under Council Regulation (EU) 2018/1488.

Artificial Intelligence:

– Strengthening key AI capabilities and knowledge in the EU, including the development of high-quality data resources, exchange mechanisms, and algorithm libraries. All this should be implemented with a human-centric and inclusive approach, consistent with the Union’s values.

– These capabilities must be accessible to companies, especially small and medium-sized enterprises (SMEs), start-ups, civil society organizations, research institutions and universities, and public administrations. The goal is to maximize their benefits for European society and the economy.

– Strengthening and integrating AI testing and experimentation networks across Member States.

– Developing and promoting commercial applications and production systems that facilitate the integration of technologies across value chains, fostering innovative business models and shortening the time needed to transition from innovation to commercial use. It is also important to promote AI-based solutions in areas crucial to society.

– Data based on AI must respect privacy and security principles from the design stage and fully comply with applicable data protection law.

Cybersecurity and Trust:

– Supporting the development and procurement of advanced cybersecurity equipment, tools and data infrastructure, in cooperation with Member States, to achieve a high level of cybersecurity at European level, in compliance with data protection rules and fundamental rights, and ensuring the strategic autonomy of the Union.

– Supporting the accumulation and optimal use of knowledge, capabilities and skills in the field of cybersecurity in Europe, as well as sharing and popularising best practices.

– Ensuring the widespread implementation of modern, effective cybersecurity solutions in the European economy, paying particular attention to public institutions and small and medium-sized enterprises (SMEs).

– Increasing the capacity of Member States and the private sector to help them comply with Directive (EU) 2016/1148 of the European Parliament and of the Council, including by supporting the uptake of best practices in cybersecurity.

– Improving resilience to cyberattacks and increasing risk awareness and knowledge of cybersecurity processes, as well as supporting public and private organizations in achieving basic levels of cybersecurity, for example by introducing full encryption of data transmission and regular software updates.

– Intensifying cooperation between the civilian and defense sectors on dual-use cybersecurity projects, services, competencies, and applications, in line with the Regulation establishing the European Cybersecurity Industrial, Technology, and Research Competence Centre and the National Coordination Network.

Advanced digital skills:

– Supporting the creation and implementation of high-quality long-term training and courses, including residential education, aimed at both students and the professionally active population,

– Supporting the creation and implementation of high-quality short-term training and courses for people working, especially in small and medium-sized enterprises and the public sector.

– Supporting high-quality on-the-job training and internship programs for students, including internships, and for the working population, particularly in SMEs and the public sector.

These activities are implemented primarily through direct management.

Implementation and optimal use of digital capabilities and interoperability:

– Support for the public sector and areas of public interest, such as healthcare, education, justice, customs, transport, mobility, energy, environment, and culture and creative industries. This support involves the effective implementation of modern digital technologies, such as high-performance computing (HPC), artificial intelligence (AI), and cybersecurity, as well as facilitating access to these technologies.

– Implementation, operation and maintenance of a modern trans-European interoperable digital service infrastructure throughout the Union, with an emphasis on complementarity with national and regional actions.

– Supporting the integration and use of trans-European digital service infrastructures and agreed European digital standards in the public sector and public interest areas, with the aim to facilitate cost-effective implementation and interoperability.

– Facilitating the development and modernisation of solutions and structures by public administrations, businesses and citizens, including open source and the reuse of interoperable solutions.

– Ensuring the public sector and EU industry, in particular small and medium-sized enterprises (SMEs), easy access to testing and piloting digital technologies and increasing their use, including across borders.

– Supporting the public sector and EU industry, in particular SMEs and start-ups, in adopting modern digital technologies such as HPC, AI, cybersecurity, and innovative technologies such as distributed ledger technologies (e.g., blockchain).

– Supporting the design, testing, implementation, and maintenance of interoperable digital solutions, including digital government, for public services at EU level. These services will be delivered through reusable, data-driven platforms to foster innovation and create a common framework that unleashes the full potential of public government services for citizens and businesses.

– Ensuring the EU’s continued capacity to lead digital developments, monitoring and analysing rapidly evolving digital trends, and promoting the exchange and dissemination of best practices.

– Fostering cooperation to create a European ecosystem of trusted infrastructure for data exchange and digital services and applications based on distributed ledger technologies (such as blockchain). Promoting interoperability and standardisation, as well as implementing cross-border solutions within the EU, is key, in line with the principle of security and privacy by design and in compliance with consumer and data protection regulations.

– Development and strengthening of European digital innovation hubs and their networks.

European Digital Innovation Hubs

Digital innovation centers are essential for the implementation of the program and their tasks include:

– Building awareness and providing or ensuring access to expertise, know-how and services in the field of digital transformation, providing testing and experimental facilities.

Virtual Chip Design Platform

In the context of the intended creation of a so-called virtual chip design platform, this regulation provides for measures to develop the European semiconductor ecosystem, which was further strengthened by Regulation (EU) 2023/1781 of 13 September 2023, which amends Regulation 2021/694 and establishes a framework for measures to strengthen the European semiconductor ecosystem, including initiatives related to chip design and manufacturing.

The virtual design platform, supported by the Chips for Europe Initiative, aims to enable the development of large-scale innovative design capabilities for integrated semiconductor technologies available across the European Union. The platform will stimulate broad collaboration between user communities and design companies, start-ups, SMEs, intellectual property and tool providers, designers, and research and technology organizations. It will integrate existing and new design databases with extended EDA libraries and tools. It will promote flexible access models to design tools, especially for prototyping, and common interface standards.

The virtual design platform will be continuously developed and enriched with new technologies and designs, including low-power processors (e.g., based on the RISC-V architecture) and FPGA-based programmable logic devices. Services will be offered in the cloud, increasing the platform’s accessibility and openness by integrating existing and new design centers across EU Member States. The pilot lines will be equipped with specialized design infrastructure, including models simulating the manufacturing process using tools used for circuit and system design. A user-friendly virtualization of these lines will be created, enabling direct access across Europe via the aforementioned design platform.

These pilot lines will accelerate the development of European intellectual property and skills related to innovation in semiconductor manufacturing technology. These will strengthen Europe’s position in the context of new devices and materials for the production of advanced semiconductor technology modules, such as lithography and semiconductor wafer technologies. Building a network of competence centers across the EU will provide expertise for small and medium-sized enterprises and start-ups, enabling them to develop skills and access design infrastructure and pilot lines, thus attracting innovation and talent.

To support the Initiative’s activities, a new legal instrument is needed: the European Chip Infrastructure Consortium (ECIC). This instrument should have legal personality. This means that the ECIC, rather than individual organizations, can apply for funding for the Initiative’s activities. All applications to the program will be open to various forms of collaboration. The ECIC’s primary goal is to foster collaboration between research organizations, industry, and Member States.

To achieve the overall goal and address the challenges in the semiconductor market, the initiative should consist of five key elements:

– A virtual platform accessible throughout the EU should be created to connect design companies with small and medium-sized enterprises, startups, and technology and tool suppliers. The platform should support the development of virtual prototyping technologies.

– To improve security of supply and reduce dependence on production in third countries, pilot lines should be developed to test and validate semiconductor technologies. Pilot lines should operate at higher technology readiness levels, with minimal environmental impact. EU investment in these lines is essential to reduce existing gaps in innovation and competitiveness.

– The initiative should support the development of alternative technologies, such as quantum technologies, by investing in quantum chip design libraries and testing centers.

– To support access to semiconductor technologies and address the skills shortage, competence centers should be established in each Member State. Access to pilot lines and other resources must be open and fair.

Grants

Grants under the Digital Europe Programme can cover up to 100% of eligible costs. They are awarded and managed according to specific specifications that address different objectives.

Award criteria are defined in work programmes and calls for proposals. They take into account the following aspects:

– the level of maturity of a specific action in the project development phase;

– the feasibility of the implementation plan;

– financial barriers, such as a shortage of market financing;

– the leverage effect of EU support on public and private investment;

– the expected economic, social, climate, and environmental impact;

– the availability of appropriate services;

– a trans-European dimension;

– a balanced geographical distribution across the Union, including actions to reduce the digital divide between the outermost regions;

– a long-term plan to ensure the sustainability of operations;

– the possibility of reusing and adapting project results;

– compatibility with other EU programmes.

The EU Emissions Trading System (EU ETS) is a mechanism that addresses carbon dioxide emissions from energy-intensive industries and the energy sector. Based on established emission caps and trading, this system is a key tool for the EU in reducing emissions.

The new regulations include:

– including maritime transport in the emissions trading system; – accelerating the reduction of available emission allowances and phasing out free allowances in selected sectors; – introducing a CO₂ offsetting and reduction mechanism for international aviation within the EU ETS; – increasing funding for the modernization and innovation fund; – modifying the market stability reserve.

REPowerEU plan

In 2022, the European Commission presented the REPowerEU plan, which lays the foundation for implementing the legislative proposals contained in the Ready for 55 package . The plan aims to reduce the European Union’s greenhouse gas emissions by at least 55% by 2030, in line with the European Green Deal, to achieve climate neutrality by 2050. The main source of financing for the plan is the Recovery and Resilience Facility , which was established in response to the crisis caused by the COVID-19 pandemic, aiming to temporarily mitigate the socio-economic impact of the situation.

Since the adoption of Regulation (EU) 2021/241 of the European Parliament and of the Council of 12 February 2021, which established the Recovery and Resilience Facility, the geopolitical situation has changed significantly. In response to the difficulties in the global energy market caused by Russia’s aggression against Ukraine, the European Commission announced the REPowerEU plan in 2022, aimed at rapidly reducing Europe’s dependence on Russian fossil fuels by 2030 and accelerating the EU’s energy transition.

Reforms under REPowerEU aim to: – Facilitate the development of renewable energy sources (RES).

– Eliminate barriers to the development of RES.

– Support local energy communities.

– Accelerate the integration of renewable energy sources into distribution networks.

– Develop sustainable transport.

– Develop green skills.

– Increase energy efficiency.

European Chip Act.

The European Chip Act aims to increase Europe’s competitiveness and resilience in semiconductor technology. This act will give Europeans the opportunity to strengthen their technological leadership and achieve their digital and ecological transformation goals. Furthermore, the development of the semiconductor industry could create new jobs in regions that were not previously considered technology hubs. The document aims not only to strengthen the semiconductor ecosystem in the European Union but also to ensure the stability of supply chains, reduce external dependencies, and enable a faster response to changing market needs. This is a key step towards the EU’s technological sovereignty and towards achieving the goal of doubling the global semiconductor market share to 20% by 2030.

The European Semiconductor Council will act as a facilitator in mapping and monitoring the EU semiconductor value chain and preventing crises in this area through appropriate emergency measures.

The European Chips Act focuses on five strategic objectives.

These are:

– strengthening our leadership in research and technology,

– developing and strengthening Europe’s capacity to innovate in the design, production and packaging of advanced chips,

– establishing the right framework to increase production by 2030,

– addressing the skills shortage and attracting new talent,

– increasing knowledge of global semiconductor supply chains.

The three pillars of the act.

To achieve these goals, three key actions are planned:

– the Chips for Europe initiative, which aims to support technological capacity building and large-scale innovation,

– the development of a security framework that will support investments in production facilities, ensuring security of supply and the resilience of the EU semiconductor sector,

– The creation of tools and methods for predicting semiconductor shortages and related crises, as well as the ability to respond to them, aims to ensure supply continuity. Several key elements can be identified in this context:

– Supply Chain Alerts (SCAN);

– Crisis Phase and a set of tools that can be used in the event of an emergency.

The European Semiconductor Board (ESB) plays an important role, providing the Commission with advice, support, and recommendations in three key areas: – Monitoring the situation and responding to crises;

– Advising on the initiative for the Public Authorities Board of the Chips Joint Undertaking;

– Consulting the Commission on decisions regarding the granting of IPF and OEF status.

Article 5 of the Act describes in detail the tasks to be implemented.

Operational objective 1 includes: – creating and managing a virtual design platform, accessible throughout the Union, that would integrate existing and new design functions with extensive libraries and tools for automated electronic design (EDA); – strengthening design capabilities by supporting innovative solutions such as open processor architectures, chiplets, programmable chips, and modern types of memories and processors – manufactured in accordance with safety-by-design principles; – expanding the semiconductor ecosystem by integrating vertical market sectors, including health, mobility, energy, telecommunications, security, defense, and space, which will contribute to the implementation of the Union’s green, digital, and innovation programs.

Under Operational Objective 2: – strengthening production capacities for next-generation chips and equipment by integrating research and innovation activities and preparing the development of future generations of technologies, including the latest generations of technologies, FD-SOI (fully depleted silicon on an insulator), new semiconductor materials and heterogeneous systems integration; – supporting large-scale innovation by providing access to new or existing pilot lines, enabling experimentation, testing, process control and validation of new design concepts combining key functions; – providing support to integrated production facilities and open EU factories by granting preferential access to new pilot lines, as well as fair access to these lines for a wide range of users of the EU semiconductor ecosystem.

Under Operational Objective 3: – developing innovative design libraries dedicated to quantum chips; – supporting the development of new and existing pilot lines, clean rooms, and factories for prototyping and manufacturing quantum chips aimed at integrating quantum circuits and control electronics; – expanding facilities for testing and validating advanced quantum chips to be manufactured in pilot lines to bridge the feedback gap between designers, manufacturers, and users of quantum components.

Under Operational Objective 4: – strengthening capabilities and making a wide range of expertise available to stakeholders, including startups and small and medium-sized enterprises (SMEs), which are end-users. Facilitating access to these capabilities and facilities and supporting their effective use. Addressing knowledge and skills shortages, as well as skills mismatches, requires strategies to attract, mobilize, and retain new talent in research, design, and production. Supporting the development of appropriately qualified personnel in STEM (science, technology, engineering, and mathematics) fields at postdoctoral level is crucial. These actions aim to strengthen the semiconductor ecosystem by offering students appropriate training opportunities, such as dual-degree programs and introductory programs for students. It is also worthwhile to focus on upskilling existing workers.

Under Operational Objective 5, these actions include: – increasing the efficiency of EU budget spending to leverage private sector financing;

– providing support to companies facing difficulties in accessing financing and addressing the need to strengthen economic resilience across the Union and Member States;

– accelerating and improving the availability of investments in chip design, manufacturing technologies, and semiconductor integration. Furthermore, attracting financing from both the public and private sectors will be crucial, contributing to the security of supply and resilience of the semiconductor ecosystem across the entire value chain.

Artykuł CHIPS AND DIGITALIZATION pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Pharmaceutical production is one of the most regulated activities in Poland, Europe, and globally. The reason seems obvious: creating drugs can cause numerous complications, health problems, and in extreme cases, even death, depending on the individual patient’s health contraindications. Due to the above-mentioned reasons, the process of creating a new drug is often very expensive and lengthy, and involves a large number of professionals and scientists specializing in this field. In an era of dynamic digitalization, the need to develop specific operational rules for drug production and principles for using AI (Artificial Intelligence) and ML (Machine Learning) models is increasingly emphasized. Manufacturers are often considering implementing AI systems to support pharmaceutical production processes.

The European Medicines Agency has created a special report divided into drug production phases, highlighting the particularly useful aspects of AI-based models in each of these stages. The problem, however, lies in the ethics and risks of such use, due to the continuing ignorance and distrust of such algorithms, capable of predicting, learning, and processing enormous amounts of data in a short time. Due to these latter aspects, this tool—if used properly and ethically—can significantly improve workflow, but without appropriate legal regulations, it can also be very detrimental to potential patients. The purpose of this article is to present the pharmaceutical drug production process and cite basic legal regulations.with particular emphasis on the ethical use of AI systems in this process and the requirements in this respect imposed by EU and national law.

From the point of view of regulations that may be applied in Polish pharmaceutical production, it is necessary to mention primarily the Pharmaceutical Law[1], the provisions of the Civil Code on liability for damage caused by a dangerous product[2], GMP standards (Regulation of the Minister of Health of 9 November 2015 on the requirements of Good Manufacturing Practice[3]issued on the basis of the statutory delegation contained in the Pharmaceutical Law) and all recommendations related to the production of drugs (soft law). In the scope of the use of AI and ML models, it is worth mentioning Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)[4], commonly referred to in the legal community as the “AI Act “, which, however, currently has the status of a pending act in some of its parts, which is justified by a certain expectation of the EU legislator for the smooth implementation of these regulations. to the methodology of everyday operations of enterprises (in the regulation, the “entity using” – Art. 3, item 4 of the “AI Act “). The regulation itself provides for very high sanctions, but also measures to support start- ups and SMEs (Micro, Small and Medium-sized Enterprises).

It seems reasonable to pay attention to the definition used by the AI Act to understand the characteristics of systems that actually define the scope of its standards for new technology systems. Article 3, point 1 of the Regulation provides a specific definition of an AI system, which, according to this definition, is a machine system designed to operate with varying degrees of autonomy after implementation, capable of adapting after implementation, and—for explicit or implicit purposes—inferring how to generate results based on received input data, such as predictions, content, recommendations, or decisions that may impact the physical or virtual environment. Therefore, models based on the operation of artificial intelligence and machine learning certainly fall under this definition, and their application falls under the standards of Regulation 2024/1689.

First and foremost, it’s important to highlight certain phases of drug development, adherence to which is a constant, necessary, and inherent element of the process. These stages are presented in the following, sequentially enumerated sections:

1. Drug discovery,

2. Nonclinical development,

3. Clinical trials,

4. Precision medicine,

5. Product information,

6. Manufacturing,

7. Post-authorization.

Before describing the specific phases of drug production, it’s important to outline the general requirements that legal regulations impose on potential manufacturers of medicinal products. As previously mentioned, the pharmaceutical industry is one of the most regulated sectors of the economy. A manufacturer must obtain a permit from the Chief Pharmaceutical Inspector to begin production. Only after obtaining this permit can they begin work on the new product and complete further stages of the procedure.

During the drug manufacturing process itself, it is crucial to adhere to Good Manufacturing Practices established in the Regulation of the Minister of Health of November 9, 2015, regarding the requirements of Good Manufacturing Practice. Furthermore, the use of AI and models based on machine learning should also be borne in mind, especially with regard to the regulation of so-called “prohibited practices”, to which these provisions are currently applied. These regulations have entered into force, and all companies using such computerized work are obligated to comply with the rigors contained therein. However, it seems best to discuss the potential application of these regulations, individualizing their fragments within a given phase of medicinal product production. Furthermore, manufacturers must also be mindful of product liability, which is regulated by the Civil Code and covers property and non-property damage caused to anyone by the product during its intended use. The basis of this liability regime is the principle of manufacturer’s risk, which means that the manufacturer’s fault in causing the damage is irrelevant.

Re. 1)

This process can be briefly described as a search for formulas and chemical compounds with therapeutic properties, as well as attempts to investigate the mechanism of action of a given disease, which allows for the selection of an appropriate biochemical combination for use in a drug to combat it. This involves creating an invention that, in the subsequent stages of non-clinical (point 2) and clinical (point 3) studies, will be tested for its response to the “target environment.” It is indicated that models based on artificial intelligence may find application in this regard in protein design and in the so-called docking process[5]. The European Medicines Agency (EMA) indicates the possibility of training AI and ML models to predict the most effective protein structures for use in treating a disease. Such positive application of new technologies in this field can significantly reduce the costs of developing a new medicinal product and its currently very long development time (current sources indicate that it takes several years for just one drug – this is due to the variability of reactions that can occur in a given patient’s body, which in turn necessitates multiple tests). However, the Agency also pointed out certain problems in its report, namely the possibility of so-called “black box” effect , which means that we have a certain output, but it is impossible to determine exactly how this result was achieved.

Good Manufacturing Practices require appropriately qualified individuals to participate in production from A to Z. There may be a risk of AI models examining the relevant characteristics of different scientists, as is the case, for example, in employee recruitment. Article 5, paragraph 1, point c (sub-items i and ii) of Regulation 2024/1689 prohibits the use of AI-based models to analyze personality traits, character traits, and even social behavior or emotions. In the case of a “recruiter”, such scoring may lead to discrimination or other unfair treatment of a candidate for work on the development of a new drug. Generally speaking, it seems that in this production phase, the greatest scope for illegal use of AI and ML may be the processes related to the examination of competences of human capital that could potentially participate in the production and supervision of this production, and therefore all models that could analyze data of a specific category (a concept under Regulation 2016/679 – GDPR[6]) and other non-personal data regarding candidates (e.g. propensity to commit crimes – also a practice prohibited in the field of AI under the EU act in question).

Ad. 2)

This stage primarily focuses on assessing the potential risks associated with using the drug in its current form, so that it can be modified appropriately if the results are unfavorable. In this stage, AI and ML are identified as tools that can enable greater humaneness in research by reducing the use of animals. Furthermore, AI can significantly reduce the cost of materials simply by reducing their use. After appropriate training, the AI, based on previous preclinical studies, will learn to predict the likely outcomes of new medicinal products during clinical trials and the risks that may arise with this use. The challenge, however, is to actually verify the probability of obtaining the correct result.

Ad. 3)

This phase of production involves testing and assessing the risk and effectiveness of a new medicinal product, albeit with human participation. This is where the broadest scope for AI and ML applications appears to be. It seems that new technologies and biomedical engineering products will play a significant role in the clinical trials phase, as it is necessary to meticulously analyze test results after administering a given drug sample to a patient. (With appropriate training and development of AI, it is conceivable that these models could, in principle, make probable diagnoses, thus narrowing the scope for further research for scientists working on the new medicinal product.) ML and AI models can also be used at this stage to select and collect data, generate average scores, and analyze them. Furthermore, the European Medicines Agency has indicated that AI can even aid in the study of emotional states in patients. All these areas of this innovation could ultimately help select the appropriate treatment for a specific group of patients while consuming significantly fewer resources—both time, human resources, and financial resources. However, the European Medicines Agency has also identified several areas where AI users face challenges. The protection of personal data and specific categories of data, such as biometric data, is once again at the forefront. Developers will need to ensure proper implementation of safeguards against data leaks (a requirement under the GDPR), and also be careful not to engage in prohibited AI practices, such as scoring or biometric data analysis, that are incompatible with its actual purpose (in this case, medical).

Ad. 4)

Of course, not every drug will work in the same way or with the same intensity in different organisms. In the fourth stage of medicinal product production, the need for individualization based on the patient’s genotype, allergens, chronic diseases, and other medical parameters that distinguish specific patients must be adequately assessed. In its report, the European Medicines Agency identified areas for the use of ML/AI, such as individualizing treatment conditions for each patient, adjusting dosage, and individualizing biomarkers[7] to be used during treatment. In this case, the risks associated with the use of AI may be most significant, due to the transition to clinical trials involving humans. Among the risks, the analyzed report notes the reluctance of potential patients to undergo therapies and treatments generated by AI.

Ad. 5)

The importance of this phase can be inferred essentially from its name itself. It involves creating specific documentation with its specific features, in order to materialize and consolidate the results of research on the product’s effectiveness and safety conducted in the preceding phases. AI can significantly accelerate the process of organizing information collected during the previous stages and generating such documentation. However, it should be remembered that the data contained in such documents is typically so-called sensitive data and cannot be processed by public products and systems based on artificial intelligence, as the processing process must be transparent. Furthermore, the documentation produced in this regard must meet the requirement of transparency (Chapter IV of the Regulation of the Minister of Health on the requirements of Good Manufacturing Practices sets numerous requirements for such information documentation). It also appears questionable whether it is possible to create documentation regarding the drug production process on an ongoing basis using AI at this stage, a requirement also included in the Regulation. However, under the AI Act, it seems reasonable to prohibit the use of AI models that create misleading content. The documentation – generated by AI – must certainly be properly checked by a team of specialists.

Ad. 6)

At the penultimate stage, a series of controlled biochemical reactions must be conducted (in accordance with the requirements of Good Manufacturing Practices listed in the Regulation of the Minister of Health referred to at the beginning of this text) to confirm the “practical” effectiveness, effects, and other parameters of the product. The Agency indicated that, according to Good Manufacturing Practices, the production of a medicinal product must be efficient, purposeful, and safe. Therefore, AI can be used to optimize the time and cost of the entire process, as well as to model and control the production process based on the analysis of current data. The agency also indicated that AI and ML can even monitor the maintenance of quality standards.

Ad. 7)

This is essentially a period, rather than a stage of medicinal production, during which the manufacturer obtains the legally required authorization to introduce the medicinal product to the general market and is available for use by a potential patient. AI is used in this area, particularly to analyze potential risks associated with drug administration, as well as to compress and analyze vast amounts of data, which would seem to require significant product control at this final stage. This can accelerate response times to risks identified during this phase and optimize countermeasures.

AI and ML appear to be tools that can help drug manufacturers combat diseases. However, it’s important to remember the legal requirements and enormous responsibility associated with this activity, particularly the provisions of the AI Act, the GDPR, and the Good Manufacturing Practices Requirements. Compliance with these requirements is a means of avoiding potentially significant sanctions from regulatory authorities, but also provides guidance on how to adhere to the “ethics” of medicinal product production.

[1]Journal of Laws 2025.750, i.e. of 2025.06.06;

[2]Civil Code (Journal of Laws 2025.1071, i.e. of 2025.08.06) – art. 449 ¹ -449¹⁰ ;

[3]Journal of Laws 2022.1273, i.e. of 2022.06.20;

[4]OJ EU.L.2024.1689 of 2024/07/12;

[5]a computer method that allows for the prediction of the preferred position of a ligand after binding to a macromolecule (e.g. a protein ) in its binding site to form a stable complex and for the interpretation of the interactions occurring between the bound ligand and the macromolecule.

[6]OJ EU.L.2016.119.1 of 2016.05.04

[7] Biomarker is a biological indicator , such as a substance, physiological property or gene , that indicates or may indicate the presence of a disease state or a physiological or mental disorder; it is also used to monitor the body’s response to therapeutic measures.

Artykuł LEGAL ASPECTS OF THE USE OF ML AND AI IN PHARMACEUTICAL PRODUCTION – POLISH AND EU REGULATIONS pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Artificial intelligence (AI) is currently finding widespread use in healthcare. A prime example is the Polish National Health Fund (NFZ) initiative, which utilizes AI to analyze patient data stored in the Fund’s databases. This data is then analyzed with the support of machine learning tools to make strategic decisions regarding the health of Poles. This approach will certainly simplify the work of doctors by searching for and analyzing the desired information, undoubtedly reducing their workload. However, such a solution may raise several issues and legal requirements related to regulations regarding the protection and processing of personal data.

What is personal data?

The most common definition of personal data is contained in the EU Regulation 2016/679 (GDPR), according to which personal data is any information about an identified or identifiable natural person. This includes direct identification (e.g., name and surname) or certain factors allowing indirect identification (e.g., job description or nationality). This concept is expanded by the Polish Act on the Protection of Personal Data Processed in Connection with the Prevention and Combating of Crime of December 14, 2018, by applying it directly to health. Health data here means personal data relating to the physical or mental health of an individual, including data on the use of healthcare services that reveal information about their health.

Patients’ rights

A number of patient rights are listed in the EU Regulation 2025/327 (Regulation on the European Health Data Space). The fundamental right is the right of individuals to access their electronically collected data (especially “priority data,” e.g., electronic prescriptions or imaging test results), which should be granted immediately after data is registered in the system. Individuals can also add their own information to their data already visible in the system and correct it. Furthermore, patients can grant access or request the transfer of their data to another provider. Access to healthcare professionals can also be restricted (however, in such cases, the patient should also be informed of the potential impact of such action on the quality of care provided). In this case, institutions collecting patient data should be aware of these rights, because if they are not respected, the patient could file a complaint (provided, however, that the rights or interests of the individual are adversely affected) and demand appropriate compensation.

The EU GDPR also provides similar rights, which additionally provides for one crucial privilege: the right to object. According to this regulation, an individual may object at any time to the processing of their data, including in connection with the performance of healthcare tasks, for reasons relating to their particular situation. In such a case, the data may no longer be processed unless the controller demonstrates compelling and legitimate grounds for further processing. Under the regulation, a patient could also request the deletion of their personal data if, for example, they are no longer necessary for the purpose for which they were collected or if they were processed unlawfully. Furthermore, the regulation also provides for the possibility of imposing an administrative fine of up to €20 million for a controller’s violation of guaranteed rights. Furthermore, Article 79 of the GDPR grants the right to an effective judicial remedy if the individual (patient) believes that the processing of their personal data violated the law.

Obligations of entities storing and processing data

Pursuant to Article 24 of the GDPR, the data controller is obligated to implement appropriate technical and organizational measures to ensure data processing is carried out in compliance with legal provisions and the rights and freedoms of others. The controller must also review and update these measures as necessary. In the case of AI-based patient data processing, the obligation specified in this article to design the measures described above is also crucial, ensuring that only information necessary to protect the patient’s life and health is processed by default. In the event of a personal data breach, the controller should (within 72 hours of becoming aware of the breach) notify the relevant supervisory authority of the personal data breach. However, the controller is not obligated to do so if the likelihood of a breach affecting the rights and freedoms of natural persons is low. If the risk of a breach is high, the controller should also notify the affected individual. Furthermore, before processing begins, even using new technologies (including AI), if it may result in a high future risk to the rights and freedoms of natural persons, it will be necessary to assess the impact of the planned processing on personal data protection. If such an assessment indeed reveals a high risk, and if the controller fails to implement any measures to mitigate it, the controller must contact the relevant supervisory authority (in Poland, the President of the Personal Data Protection Office [President of the UODO]), which then provides the controller with a written recommendation and may also temporarily restrict or prohibit processing or issue a warning to the controller. General obligations, according to which personal data must be processed lawfully and fairly, in a transparent manner, and limited to what is necessary for the purposes for which they are processed, are also important.

In this situation, Regulation 2024/1689 (“AI Act”) also provides an interesting requirement. According to Article 4 thereof, healthcare entities using AI systems to make strategic decisions about patients are responsible for maintaining an appropriate level of AI competence among their staff, taking into account the purpose of using the system and the persons for whom the systems are to be used.

Requirements for the AI systems themselves

The basic requirements that AI systems used for data processing would have to meet are set out in the aforementioned AI Act. This document explicitly classifies AI systems as “high-risk systems”, and therefore, the requirements set out in the act apply to them. Primarily, this requires maintaining appropriate documentation for the system: technical documentation regarding the quality management system (including data acquisition, collection, analysis, and labeling) and an EU declaration of conformity confirming the system’s compliance with the requirements set out in the regulation. Furthermore, this documentation should be kept at the disposal of the competent national authorities for 10 years after the system’s commissioning. Such systems should also meet transparency requirements, meaning they should be designed to facilitate proper use and interpretation of their actions (they should also have clear operating instructions). They must also have an appropriate oversight system that allows for human oversight of the AI if necessary, especially if its operation were to get out of control and harm others. Finally, AI systems are also subject to certain formal requirements, such as undergoing a pre-market conformity assessment and registering in a dedicated EU database for high-risk AI systems. It is also important to remember that high-risk AI systems are subject to general CE marking regulations. Once placed on the market, suppliers are required to establish a post-market monitoring system for AI systems to ensure their legal compliance.

The issue of non-personal data

It is also worth raising the issue of non-personal data, for example, in the context of a situation where a hospital, in order to decide on the appropriate medication for a patient, requests information about certain medications from a pharmacy. A public sector body may request such information only to the extent that the lack of this data would prevent it from performing its public interest tasks or when the body has no other available means of obtaining such data. A request for this purpose should be submitted (specifying, in particular, the purpose for which the information is requested). However, the data subject who received it may refuse to provide it if they have no control over the requested information or if a similar request for the same purpose has already been submitted by another public sector body. Once the requested information is in the possession of the requester, they must not use it in a manner inconsistent with the purpose for which the data was provided. They must ensure measures to protect its confidentiality or integrity, and they must delete the data as soon as it is no longer needed for the specified purpose. They are also prohibited from using the information obtained to improve a competitive product or from disclosing any information in this regard to third parties. It is also important to bear in mind the right of a public sector body to share the data received with individuals or organisations for the purposes of scientific research or analyses consistent with the purpose for which the data was requested, or with national statistical offices (e.g. the Central Statistical Office). It is important here that these organisations do not have a commercial nature or are not related to entities that do.

The status in Poland

As mentioned above, Poland has established a special supervisory authority for personal data protection, the President of the Personal Data Protection Office (UODO), acting with the assistance of the Office for Personal Data Protection. Among other things, this authority is responsible for consultations on data processing that poses a significant risk of violating the rights of others. It also conducts proceedings in cases of violations of personal data protection regulations and establishes a plan for monitoring compliance with these regulations.

It is also worth remembering the regulations of the Polish Act on Patients’ Rights and the Patient Ombudsman. It stipulates that patients have the right to access medical records concerning their health and the services provided to them. The entity storing this documentation is obligated to disclose the data contained therein only to the patient themselves or an authorized person (or, for example, to a university or research institute for scientific purposes, but without any data allowing for the identification of the individual). Furthermore, the entity providing services is obligated to retain medical records only for a specified period (generally 20 years), after which they should be destroyed in a way that prevents the identification of the patient to whom they pertained. The Act on the Healthcare Information System also limits access to these records to medical professionals and physicians.

Also important are the provisions of the Act on the computerization of the activities of entities carrying out public activities, under which an entity maintaining a public register (i.e. any type of records used to carry out public tasks based on the relevant provisions) should provide another public entity with access to the data in its possession to the extent necessary to carry out public tasks.

It is also important to remember the Polish Code of Medical Ethics, which, in Article 14, requires physicians to inform patients about the benefits and risks associated with proposed diagnostic procedures and, where appropriate, about the possibility of using other methods. Furthermore, according to Article 12, the use of AI in treatment may only occur after the following conditions are met: informing the patient that artificial intelligence will be used in the diagnosis or therapeutic process; obtaining the patient’s informed consent to the use of artificial intelligence in the diagnostic or therapeutic process; and using AI algorithms that are approved for medical use and have the appropriate certifications. However, the final decision always rests with the physician.

A government draft legislation is currently being prepared, which will be designed to adapt the national legal system to the requirements imposed by the AI Act. The government’s proposals primarily envisage the establishment of the Artificial Intelligence Development and Security Commission, which will oversee the AI market within the scope specified in Article 2 of Regulation 2024/1689. The second main body will be the President of the Personal Data Protection Office (UODO) that will oversee high-risk AI systems, including those related to healthcare.

Summary

Processing personal data for healthcare purposes, additionally supported by artificial intelligence, is undoubtedly a convenient and practical solution, but it is associated with a number of legal obligations intended to ensure the security of the data used (e.g., using the acquired data only for a strictly defined purpose), the security of patients themselves (e.g., the obligation to inform the patient of the intention to use artificial intelligence in the treatment process), or simply related to formalities (e.g., the requirement to register the artificial intelligence system in an EU database). Currently, EU regulations are much more detailed in this matter.

Artykuł National Healthcare and the processing of personal data by means of AI pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.