Overview
The life sciences and healthcare sector across Central and Eastern Europe and the Adria region is entering one of its most significant periods of regulatory change. From cybersecurity to AI, from product liability to market access and anti-corruption, 2026 brings a convergence of new obligations and strategic opportunities that no business operating in the region can afford to overlook.
In our latest briefing, the CMS Life Sciences and Healthcare team maps the key developments shaping the regulatory landscape across thirteen jurisdictions: Austria, Bosnia and Herzegovina, Bulgaria, Croatia, Czech Republic, Hungary, North Macedonia, Poland, Romania, Serbia, Slovakia, Slovenia, and Ukraine.
We look at:
NIS2, data privacy, AI
Across the region, countries are transposing the EU NIS2 Directive into national law, significantly broadening cybersecurity obligations for healthcare providers, pharmaceutical manufacturers, medical device companies, CROs, and digital health providers — many of which were previously outside scope. At the same time, the EU AI Act is imposing risk-based requirements on AI systems used in clinical, diagnostic, and medical device contexts, while the European Health Data Space and the EU Data Act are reshaping how health data is accessed, shared, and protected.
Market access and reimbursement
The briefing tracks important shifts in how medicines and medical devices reach patients and secure public funding. Poland is progressing with a major amendment to its reimbursement law designed to simplify procedures and shorten timelines. Ukraine has introduced regional budget pooling for managed entry agreements and is expanding its outpatient reimbursement programme, including for innovative therapies with partial public funding for the first time. In Bulgaria, the Supreme Administrative Court has struck down successive NHIF reimbursement mechanisms, and the currently applicable mechanism is again under appeal. Croatia has introduced new supply-monitoring obligations for marketing authorisation holders, distributors, and wholesalers.
Anti-corruption and compliance
Hungary has strengthened its corporate criminal liability framework, extending liability to foreign entities, legal successors, and negligent conduct by executives — with particular attention to corruption offences in the pharmaceutical sector. Poland may see a reorganisation of its anti-corruption enforcement architecture, while at the EU level, a new Anti-Corruption Directive is expected to be formally adopted in 2026. In Ukraine, new binding standards for pharmaceutical promotional practices have been adopted, alongside more active enforcement.
Product liability
The new EU Product Liability Directive (EU) 2024/2853 must be transposed by 9 December 2026, expanding the definition of "product" to cover software, digital files, SaMD, and AI-enabled technologies, and introducing new factors for assessing defectiveness — including cybersecurity requirements and the capacity of AI systems for continuous learning. Several countries, including Hungary, have already enacted implementing legislation, while others are in the process of preparing draft laws.
Key Life Sciences and Healthcare developments and expectations for 2026
CEE and Adria region
