Life Sciences / Regulatory Review π§¬
Q1 2025 was the quarter the US regulatory landscape structurally shifted. The FDA's QMSR final rule entered its active transition year, replacing the 30-year-old Part 820 QSR framework with ISO 13485 incorporation by reference. The FDA continued to clarify Clinical Decision Support and General Wellness boundaries through the guidance pipeline. The FDA and EMA's joint AI principles were still taking shape ahead of their January 2026 publication, the GLP-1 agonist market entered its most competitive phase with oral and next-gen formulations advancing, the Change Healthcare breach aftermath continued reshaping cybersecurity requirements, and the UK MHRA's digital health reforms began producing tangible outputs.
π Navigate
π Exec Summary
Q1 2025 was the quarter the US regulatory landscape structurally shifted. The FDA's QMSR final rule entered its active transition year, replacing the 30-year-old Part 820 QSR framework with ISO 13485 incorporation by reference. The FDA continued to clarify Clinical Decision Support and General Wellness boundaries through the guidance pipeline. The FDA and EMA's joint AI principles were still taking shape ahead of their January 2026 publication, the GLP-1 agonist market entered its most competitive phase with oral and next-gen formulations advancing, the Change Healthcare breach aftermath continued reshaping cybersecurity requirements, and the UK MHRA's digital health reforms began producing tangible outputs.
π What Moved
QMS framework (US)
QMSR transition active; ISO 13485 incorporation by reference replaces 21 CFR Part 820. Biggest QMS structural change in 30 years.
AI/ML in CDS
Guidance pipeline active; clearer off-ramp emerging for low-risk CDS software.
General wellness devices
Updated guidance: optical BP, stress, sleep outside device territory. Expanded non-device perimeter for wearables.
International AI harmonization
FDA x EMA alignment discussions. First formal transatlantic AI alignment was still forming.
GLP-1 therapeutics
Oral formulations advancing; Amgen MariTide Phase 2. Pipeline deepening beyond injectables.
Healthcare cybersecurity
Legislative proposals; mandatory MFA/encryption standards. Shift from voluntary to mandatory requirements.
π Trend Arcs
1. QMS Harmonization Countdown β Velocity: Accelerating
The QMSR compliance date of February 2, 2026 means Q1 2025 was the inflection point: companies with mature ISO 13485 systems began gap analyses, while those running legacy Part 820 systems faced 12 months to overhaul documentation, processes, and internal audits. The incorporation of ISO 13485:2016 by reference is not a cosmetic rebrand β it introduces design and development planning requirements, management review structures, and risk-based process controls that differ materially from the old QSR. Notified body and registrar demand is surging. Companies that delayed are now paying premium consulting rates.
2. AI/ML Regulatory Perimeter Clarification β Velocity: Steady
The CDS and General Wellness guidance pipeline represents the FDA drawing a clearer line between software that requires premarket review and software that does not. For CDS, the key move is enforcement discretion for tools providing a single recommended output β a pragmatic carve-out that enables AI-driven clinical tools to operate without 510(k) burden when they meet the four statutory criteria under Section 520(o)(1)(E). For general wellness, non-invasive optical sensing for blood pressure, stress, and sleep estimation can fall outside device territory when intended solely for wellness use. These are builder-relevant signals: the regulatory aperture for AI-powered health software is widening, not narrowing.
3. GLP-1 Market Fragmentation β Velocity: Accelerating
The GLP-1/GIP agonist market is no longer a two-horse race. Novo Nordisk and Eli Lilly still command ~68% of weight-loss drug sales, but Q1 2025 saw Amgen's MariTide (bispecific GLP-1/GIP monthly shot) report up to 20% weight loss in mid-stage data, Lilly's oral orforglipron show 12.4% weight reduction in Phase III ATTAIN-1, and Pfizer, Roche, and AstraZeneca all advancing pipeline candidates. Analysts project 16 new obesity drugs entering the market by 2029, adding $70B to the segment by 2031. The competitive dynamic is shifting from "who has a GLP-1" to "who has the best oral formulation, dosing convenience, and side-effect profile."
πΊοΈ Landscape Shift
| Player | Q4 2024 Position | Q1 2025 Move | Net Effect |
|---|---|---|---|
| FDA (CDRH) | QMSR published; guidance pipeline active | CDS / General Wellness clarification; QMSR transition support | Clearest regulatory direction in years for digital health |
| EMA | Bilateral AI discussions | Joint 10-principle AI framework taking shape with FDA | Transatlantic alignment reduces regulatory divergence |
| Novo Nordisk | GLP-1 market leader (Ozempic/Wegovy) | Oral semaglutide advancing toward FDA approval | First-mover in oral GLP-1 for obesity |
| Eli Lilly | Strong #2 (Mounjaro/Zepbound) | Orforglipron Phase III data (ATTAIN-1) | Close behind Novo on oral formulation |
| Amgen | GLP-1 challenger | MariTide Phase 2: up to 20% weight loss (monthly dosing) | Credible third entrant with differentiated profile |
| Insilico Medicine | AI drug discovery pioneer | Phase IIa rentosertib (IPF) results advancing | First generative-AI-designed drug in Phase II |
| UK MHRA | Post-Brexit reform planning | AI Airlock pilot; digital mental health guidance; PMS reforms | Emerging as pragmatic digital health regulator |
| Change Healthcare / UHG | Breach recovery | ~192.7M individuals affected; $1.5B+ cost | Catalyst for mandatory cybersecurity standards |
π§ Regulatory Direction of Travel
| Jurisdiction | Q1 2025 Action | Binding? | Builder Impact |
|---|---|---|---|
| US (FDA) | QMSR transition year begins | Yes (Feb 2026 deadline) | All device manufacturers must transition to ISO 13485-aligned QMS |
| US (FDA) | CDS / General Wellness clarification β single-output AI and wellness boundaries | No (guidance) | Low-risk AI CDS tools get clearer path to market without 510(k) |
| US + EU (FDA Γ EMA) | Joint AI principles in development | No (principles) | Signals regulatory convergence; shadow AI use now on regulators' radar |
| EU | AI Act prohibited practices enforced Feb 2 | Yes | AI systems in healthcare must avoid banned categories (emotion inference in workplace, social scoring) |
| UK (MHRA) | AI Airlock pilot Phase 1 complete; Phase 2 funded | No (pilot) | UK positioning as sandbox-friendly for AI medical devices |
| UK (MHRA) | Post-market surveillance reforms (Part 4A) | Yes (June 2025 effective) | Serious incident reporting window drops from 30 to 15 days |
| US (Congress) | Healthcare Cybersecurity and Resiliency Act of 2025 introduced | Proposed | Mandatory MFA, encryption, and audit requirements for healthcare entities |
π° Funding
Insilico Medicine (follow-on)
Undisclosed amount for AI drug discovery (IPF, oncology). First AI-designed drug reaching Phase II validates thesis.
Amgen (internal pipeline)
MariTide (GLP-1/GIP bispecific). Up to $2.5B projected peak sales.
Digital health SaaS (sector)
~$3B+ aggregate across multiple Q1 rounds for regulatory compliance and QMS tooling. QMSR transition driving demand for compliance platforms.
π Counter-Narrative
- The consensus: The FDA is loosening AI oversight β move fast and worry later. The reality: The CDS and General Wellness guidance pipeline is clarifying, not deregulating. The FDA is drawing sharper lines, not removing them. Single-output CDS enforcement discretion applies only when all four statutory criteria are met β including the requirement that the healthcare professional can independently review the basis for recommendations. General wellness exemptions evaporate the moment a product makes clinical claims or mimics clinical values without validation. The builders who win are those who design to the boundary, not those who assume the boundary has been removed.
π Builder's Benchmark
Time remaining for QMSR compliance
16 months (Q4 2024) to 12 months. Countdown accelerating.
FDA AI/ML-enabled device authorizations (cumulative)
~950 to ~1,000+. Steady growth.
GLP-1 market size (annualized)
~$50B to ~$60B+. Expanding rapidly.
Healthcare data breaches (major, US)
Recovery ongoing; 192.7M affected. Breach impact still materializing.
AI CDS tools eligible for enforcement discretion
Unclear to single-output tools with 4 criteria. New pathway defined.
MHRA AI Airlock technologies in pilot
Phase 1 to Phase 2 (9 technologies selected). UK sandbox advancing.
π What to Watch
- QMSR transition readiness surveys β which device segments are lagging?
- FDA's next AI/ML action plan update β expected mid-2025
- Oral GLP-1 approval timelines β Novo vs. Lilly race to market
- Change Healthcare litigation outcomes and their effect on cybersecurity mandates
- EMA follow-up guidance operationalizing the 10 AI principles
- UK MHRA AI Airlock Phase 2 outcomes β will UK become the preferred sandbox for AI devices?
- Amgen MariTide Phase 3 initiation timing
- Congressional movement on Healthcare Cybersecurity and Resiliency Act