Trend 1 = RWE is written into regulatory intent — from optional support to expected input

What’s changing: Major regulators began explicitly positioning RWD/RWE and data analytics as legitimate inputs to decisions across the product lifecycle (development, authorisation, supervision, and post-authorisation management), with infrastructure explicitly referenced as part of the model.

Seen in: EU reform proposal for pharmaceutical legislation explicitly emphasising the role of real‑world data and analytics, with EHDS and DARWIN EU® referenced; DARWIN EU® scaling plans and pilots aligned to regulatory and HTA questions.

So what? RWE becomes harder to treat as “nice-to-have.” When regulators frame RWE as a legitimate decision input, organisations need repeatable ways to generate, document, and defend it (data provenance, governance, transparency, and methods).

Trend 2 = Health‑data access and interoperability mature into operating infrastructure

What’s changing: Data access is increasingly treated as a system capability: structured nodes, pilots, common data models where useful (but not mandatory), and building blocks to support cross‑country evidence generation.

Seen in: DARWIN EU® participating as a research/data node in the EHDS pilot (EHDS2) and testing multi-country data handling; France’s Health Data Hub work on health data warehouses and user participation tools; EHDEN validation of OMOP standardisation activity (SNDS); EU Data Act momentum (late 2023 signals).

So what? The “data work” becomes a programme deliverable. Evidence timelines increasingly depend on access pathways, permissions, technical readiness, and the ability to combine heterogeneous sources. Teams need capability in metadata, linkage governance, and auditability—not just analytics.

Trend 3 =  AI moves from innovation messaging to evidence governance and controlled validation

What’s changing: Regulators shifted toward practical oversight models for AI-enabled medical technologies, including controlled environments to generate evidence, and clearer expectations for lifecycle thinking.

Seen in: UK MHRA announcement of the AI Airlock regulatory sandbox; MHRA/FDA/Health Canada collaboration on guiding principles for machine‑learning-enabled medical devices and predetermined change control plans (PCCPs); France CNIL guidance on “AI that respects personal data.”

So what? Where AI is part of the evidence story, organisations should expect questions about representativeness, bias management, change control, and real‑world performance monitoring. “One‑off validation” becomes harder to defend.

Trend 4 = Privacy, consent, and cross‑border transfer routes tighten (and directly affect feasibility)

What’s changing: Multiple updates in 2023 reinforced that secondary use of health data is possible, but only through defensible privacy positions (lawful basis, consent exceptions where applicable, and clearer transfer pathways).

Seen in: UK‑USA data bridge enabling certain transfers under an adequacy-type mechanism for certified US organisations; Lithuania revisions linked to health data reuse and consent/justification; Vietnam profile updated for personal data protection decree; recurring UK focus on confidential patient data handling processes.

So what? Feasibility and contracting increasingly depend on privacy design: controller/processor clarity, transfer routes, and documentation of why the use is lawful and proportionate. This is no longer a “legal review at the end.”

Trend 5 = Operational standardisation accelerates: templates, contracts, and digital submission pathways

What’s changing: Authorities and health systems continued to standardise the “how” of research delivery—particularly contracts and mandated artefacts—while expanding digital platforms.

Seen in: UK mandated template shifts (e.g., mNISA/CRO‑mNISA update introducing an unmodifiable financial appendix and mandated use for IRAS submissions); UK mCDA updates; Mexico COFEPRIS DIGIPRiS procedures and services platform; increased emphasis on standardised processes to reduce negotiation and delay.

So what? The operational risk shifts from interpretation to execution: use the right template version, follow the tool/process steps, and avoid modifications that trigger delay. Strong version control becomes a compliance requirement, not a “nice SOP detail.”