Insights

The EU Pharma Package represents the most significant reform of EU pharmaceutical legislation in over two decades, setting the stage for a new era in medicine regulation. Introduced by the European Commission back in April 2023, the proposals are designed to promote innovation, strengthen medicine availability and affordability, reduce regulatory burdens, ensure a fair and competitive European pharmaceutical market, and modernize the EU's pharmaceutical framework. The EU Pharma Package will replace the more than twenty-year-old Directive 2001/83/EC and Regulation 726/2004, and incorporates the separate regulations on orphan and pediatric medicines, thereby bringing the entire regulatory framework up to date.

On December 11, 2025, the Council of the European Union and the European Parliament reached provisional agreement on the long-awaited “Pharma Package,” (see the announcement here). The Pharma Package is a comprehensive and major overhaul of the EU legislative framework for pharmaceuticals, which replaces the more than 20-year-old Directive 2001/83 and Regulation 726/2004 and incorporates (and updates) the separate regulations on orphan and pediatric medicines (Regulations 141/2000 and 1901/2006 respectively).

On November 13, 2025, the president of the French-speaking Brussels Enterprise Court ruled in the long-running battle between Sandoz and Regeneron about the correct interpretation of the EU’s Supplementary Protection Certificate (SPC) Manufacturing Waiver Regulation regarding exports to a non-EU market. The Brussels Court dismissed Regeneron’s claim that Sandoz had provided a defective notification and agreed with Sandoz’s interpretation of the Regulation.

In this fifth alert in our weekly series on the EU Pharma Package, we will delve into the global marketing authorization (GMA) concept which has largely remained untouched in the legislative proposal – aside from an important introduction of the notion of a GMA for orphan medicinal products. We will discuss the missed opportunity to codify existing case law and provide further clarification in this respect.

In our first alert in our new weekly series on the EU Pharma Package, we provided some important background and general information about the status of the Pharma Package and how the trilogues work. In this second alert, we will discuss the respective positions of the European Commission, the European Parliament and the Council of the European Union with respect to one of the most debated and anxiously anticipated topics on the table, the regulatory data protection (RDP).

On June 4, 2025, after nearly two years of intense debate and negotiation between the 27 EU Member States, the Council of the European Union adopted its position on the proposed overhaul of the EU general pharmaceutical legislative framework known as the new Pharma Package.

At the beginning of the year, we brought to your attention that a number of important Belgian and EU legislative changes are likely to have an impact in 2024: there are new laws that have been adopted and proposals that are expected to firm up into law.

On May 14, 2024, the Netherlands Authority for Consumers and Markets (the “ACM”) revealed that they were fining Epic Games 1,125,000 Euros for violating “professional diligence,” following ACM’s 2023 finding that the developer of Fortnite created an environment that pressured children into make purchases in its video game. In issuing the fine, the Decision declared that “ACM is making it known that unfair treatment of children in the digital world is particularly grave and will be dealt with severely.” 

A number of important Belgian and EU legislative changes are likely to have an impact in 2024. On the one hand, there are new laws that have been adopted and will start to bite, and, on the other, there are proposals that are expected to firm up into law.

 

In a judgment of August 1, 2022, the Court of Justice of the European Union (CJEU) provided further guidance on two important aspects of the General Data Protection Regulation (GDPR) (CJEU C-184/20). In summary, the CJEU held that, first, for a national law that imposes a legal obligation to process personal data to be able to constitute a legal basis for processing, it needs to be lawful, meaning that it must meet an objective of public interest and be proportionate to the legitimate aim pursued, and second, that non-sensitive data that are liable to reveal sensitive personal data need to be protected by the strengthened protection regime for processing of special categories of personal data.