Operationalize regulatory risk management to drive life sciences and healthcare success

Continuous innovation, continuous compliance

The pandemic revealed just how quickly innovation can happen when focused time is directed toward it. In the years since, technology has continued to change at a previously unimaginable pace. While this creates new opportunities for pharma, life sciences and healthcare to innovate and expand, it also widens the cavernous gap between research, development, and Canada's regulatory regime.

As Alexis Kerr, Partner, Norton Rose Fulbright Canada told Lexpert: "Even though AI-specific legislation is still under development in Canada, AI is not a lawless space."¹ AI holds new possibilities for pharma and life sciences organizations creating novel therapies, drugs, devices, healthcare paradigms (such as virtual care), and business models. It is one more factor helping high-tech, high-innovation ideas to flourish within the sector. That confluence of concepts, products, and services brings additional questions about not only how to develop, test, and approve these offerings - but how to do so when the science is moving more quickly than the regulations intended to govern it. What's more: market entry isn't the end of compliance. It's just the beginning.

Organizations don't get a free pass not to comply simply because regulatory machinery lags behind the pace of innovation. This leaves many pharma and life sciences leaders looking to apply rules in regulatory situations they simply weren't designed for. This adds additional complexity for any organization looking to balance speed-to-market with regulatory compliance. This dynamic has a particular impact on emerging and evolving focus areas such as:

Digital health

In Canada, digital health spans health technologies that improve access to healthcare information, facilitate diagnosis and treatment, and improve patient access to care. These data-driven healthcare solutions help stakeholders (patients, healthcare providers, and others) communicate and connect seamlessly through technology. They bring both broad, system-wide improvements and individual-level, personalized medicine (think targeted therapies; innovative devices enabling improved diagnostics, surveillance and prevention; and enhanced communication and systems integration).

Innovation within digital health raises regulatory considerations around :

• Data protection and privacy, patient safety, professional regulatory requirements, public policy, cybersecurity, and civil liability risks.
• Not to mention the compliance risks triggered by the cross-border data transfers which are a feature of multi-jurisdictional health technology systems.

Gene therapy

In recent years, the incredible promise of gene therapy has become a reality, with multiple products entering the Canadian market. That includes CAR-T therapy (a gene therapy for treating blood cancers) and AAV-based therapy (for restoring gene function). Canada doesn't have a distinct legislative framework for gene therapy products. Instead, they're subject to the same regulatory provisions as other drugs under the Food and Drugs Act and Food and Drug Regulations.

Innovation within gene therapy products raises regulatory considerations around :

• Data protection (new drugs are eligible for data protection if considered an innovative drug; one that contains a medicinal ingredient not previously approved in Canada);
• Patent protection (subject to the same legislation as other patented products in Canada);
• Patent litigation (with the first case concerning a gene therapy patent initiated in 2022);
• As well as a host of emerging issues including gene editing technology and market access.

Biometric data

The explosive growth of AI technology has fed an equally rapid expansion of biometric data use. This entails measurable and unique human characteristics, such as fingerprints or keystroke patterns, to identify or authenticate individuals. Wearable commercial health tech used by the weekend warrior. Innovative AI scribes rolled out in family medicine offices. Remote monitoring in long-term care facilities. Pharmaceutical research analytics. Use cases abound as biometrics cement themselves in all parts of the health sector lifecycle. And regulators are paying attention. In 2025, the Office of the Privacy Commissioner of Canada released its updated guidance on using biometric information. Similar developments are shaping provincial guidance in British Columbia and Ontario.

Innovation within biometric data raises regulatory considerations around :

• New privacy compliance obligations as well as potential penalties for contravention (i.e., administrative and monetary penalties under provincial laws);
• Sensitivities and requirements around using of personal information;
• Appropriate practice guidelines that ensure collection of biometric information serves and appropriate use;
• Consent matters;
• Personal Information Protection and Electronic Documents Act compliance considerations.

Modernizing clinical trials for current realities

In a move to simplify existing rules and establish a modern framework for flexible, risk-based oversight: Health Canada announced draft Clinical Trial Regulations at the end of 2025. The refresh is geared to better support innovative trials, reduce the regulatory burden, and enhance participant access and safety.

What stands out?

The draft is part of a broader Health Canada Clinical Trials Regulatory Modernization initiative. It builds on regulatory flexibilities piloted during the COVID-19 pandemic, as well as stakeholder feedback and consultations. It's also said to be more flexible and internationally aligned - which could help attract global investment, increase research capacity, and expand access to new therapies.

What is new?

The update keeps much of the current regulatory framework in place. It also adds new regulatory features:

• Shift to regulating clinical trial conduct (Health Canada would retain these powers while gaining direct [flexible and risk-based] oversight over conduct throughout the trial's lifecycle)
• Review process improvements and extended timelines
• Increase in flexibility around innovative trial design
• Imposition of terms and conditions on a clinical trial authorization at any point to mitigate risk or address uncertainties
• Use of a national research ethics board to approve and protect informed consent across multiple trial sites in Canada
• Obligation for post-trial reporting to enhance patient safety over the long term

What happens next?

The initial consultation has wrapped up. Once final, the regulations would come into force 12 months after being published in the Canada Gazette.