US cell and gene therapy developers arrive in Europe with a settled map of what a hospital may do without a license. Section 361 of the Public Health Service Act and 21 CFR 1271.10(a) draw the line with four criteria, minimal manipulation and homologous use first among them. Everything past it is a biological product that needs an IND and, eventually, a BLA, whoever makes it and wherever it is made.142 U.S.C. §§ 262 and 264; 21 CFR 1271.10(a) and 1271.20; FDA minimal-manipulation and homologous-use guidance (July 2020); United States v. Regenerative Sciences, LLC (D.C. Cir. 2014). That map has no room for a route on which a university hospital manufactures a substantially manipulated, genetically engineered cell product and gives it to its own patients under no marketing authorization at all. The EU has run exactly that route since the ATMP Regulation began to apply at the end of 2008. Art. 3(7) Directive 2001/83/EC carves advanced therapy medicinal products prepared on a non-routine basis for an individual patient in a hospital out of the Union code, and leaves the terms of the carve-out to each Member State.2Directive 2001/83/EC, Art. 3(7), inserted by Regulation (EC) No 1394/2007, Art. 28(2). The Pharma Package does not close that route. It converts it into something a US reader will find more familiar and, for that reason, easier to misjudge. The route becomes an approval, notified to the European Medicines Agency, with data duties of its own.3Council compromise text for the Pharma Package Directive, ST-6367/26 (6 March 2026), Art. 2; recital 18.
1. An Approval Replaces the Carve-Out: What Article 2 Keeps and What It Takes
The provision in force is short. Art. 3(7) Directive 2001/83/EC excludes from the Directive any ATMP prepared on a non-routine basis according to specific quality standards, used within the same Member State in a hospital under the exclusive professional responsibility of a medical practitioner, in order to comply with an individual medical prescription for a custom-made product for an individual patient. Manufacturing "shall be authorised by the competent authority of the Member State", and national traceability, pharmacovigilance and quality standards must be "equivalent" to those applying to centrally authorized ATMPs.2 Everything else was left to twenty-seven readings, and the Commission's own study of the exemption, completed in August 2025, measured how far they drifted. Nineteen Member States have a national framework, and between 2008 and 2025 those frameworks approved 110 hospital-exemption ATMPs, 62 of them still available, twelve of them gene therapy products. The time a competent authority takes to decide ranges from 14 days in Denmark to 210 days in Spain. An approval lasts for one patient in Italy, one year in the Netherlands, five years in Sweden and indefinitely in Belgium and Finland. Estonia and the Netherlands cap it at ten patients. Of the 51 approval holders the study could identify, 26 are public or academic hospitals and 14 are private companies.4European Commission, 'Study on the Hospital Exemption: Final Report' (DG SANTE, August 2025), executive summary and Tables 4, 5 and 13. Germany runs the exemption through § 4b of the Arzneimittelgesetz and the Paul-Ehrlich-Institut, France through Art. L. 4211-9-1 of the Code de la santé publique, and Italy through a 2015 ministerial decree that conditions it on the absence of a therapeutic alternative.5§ 4b AMG (Germany); Art. L. 4211-9-1 Code de la santé publique (France); D.Lgs. 219/2006, Art. 3(1)(f-bis) and DM 16 gennaio 2015 (Italy). The phrase "custom-made product for an individual patient" became a rule about scale in one capital, a rule about evidence in another and a rule about who may hold the approval in a third. That is the landscape Insight 06 mapped, and the one a US developer partnering with a single European academic center has been able to treat as a local matter.
Art. 2 of the Directive in the Council's compromise text of 6 March 2026 keeps every condition of Art. 3(7) Directive 2001/83/EC and adds one word and one institution. By way of derogation from Art. 1(1) of the Directive, only Art. 2 applies to ATMPs "prepared within the Member State" on a non-routine basis, used within the same Member State in a hospital under a medical practitioner's exclusive professional responsibility, to comply with an individual medical prescription for a custom-made product to meet the needs of an individual patient. The manufacturing "and use" of such a product "shall require an approval by the competent authority of the Member State", a "hospital exemption approval", applied for where the hospital is located, and "Member States shall notify any such approval, as well as subsequent changes, to the Agency".3 Recital 18 says why. It records that experience has shown "significant variations in the implementation of hospital exemption among Member States", and that the Directive introduces measures for the collection and reporting of data, their yearly review by the competent authorities and their publication by the Agency in a repository.3 Where Art. 3(7) Directive 2001/83/EC authorized manufacturing and said nothing to Brussels, Art. 2 of the Directive approves manufacturing and use and tells the Agency. For a developer whose European footprint is one partnership with one hospital, that is the first consequence. An approval that lived in a national register will live in a Union repository, next to every other one.
The exemption keeps every one of its conditions and loses the thing that made it convenient. A Member State that once granted it quietly will grant it on a form the Commission writes and report the result to the Agency.
What stays national is also worth stating, because the US reader tends to hear "EU approval" where the text says something narrower. The approval remains a decision of the Member State's competent authority, not of the Agency. Pricing and reimbursement remain outside the Directive under Art. 1(9), so whether a hospital-exemption product is paid for, and by whom, is answered by national health-insurance law. The Directive is addressed to the Member States and needs transposition. Art. 219 gives them twenty-four months from entry into force to adopt their measures and applies them from the same date, so the approval regime arrives through twenty-seven transposing acts, on a clock that starts with Official Journal publication.6Directive ST-6367 (n 3), Art. 1(1), 1(5)(c) and (d), 1(9), 219 and 220. And the "same Member State" limit survives unchanged. A product prepared in Barcelona under a Spanish approval still cannot be used in Lisbon, however complete its annual data. The exemption becomes visible across the Union without becoming portable across it.
2. GMP Equivalence, Annual Efficacy Data and the Agency's Repository
Art. 2(3) of the Directive replaces the open reference to "specific quality standards" with a named benchmark. Member States must ensure that hospital-exemption ATMPs comply with requirements "equivalent to" the good manufacturing practice and traceability requirements referred to in Art. 5 and Art. 15 of the ATMP Regulation, and with pharmacovigilance requirements equivalent to those provided at Union level under the revised Regulation 726/2004.7Directive ST-6367 (n 3), Art. 2(3); ATMP Regulation (n 2), Art. 5 and Art. 15; Commission GMP guidelines specific to ATMPs (22 November 2017). Art. 5 of the ATMP Regulation is the basis of the Commission's ATMP-specific GMP guidelines of November 2017. Art. 15 requires a traceability system running from sourcing through manufacturing, storage and transport to the hospital where the product is used, with the marketing authorization holder's records kept for thirty years after the product's expiry date.7 The ATMP Regulation itself survives the Package, amended rather than repealed, which is why the Directive borrows its articles instead of restating them. "Equivalent" is the word Art. 3(7) Directive 2001/83/EC already uses, and a hospital that has read it as permission to run a quality system of its own design will find the word unchanged. What changes is who checks. Under Art. 2(4) of the Directive the competent authority "shall verify the compliance" of the product with those requirements, at least annually, on data the approval holder reports.
The data duty is the center of the reform, and its vocabulary is the thing to notice. Art. 2(4) of the Directive requires that data "on the use, safety and the efficacy" of the product, together with any further data specified in implementing acts, be collected and reported by the approval holder to the competent authority "at least annually", "in a structured and standardised way that enables robust, reliable and comparable results and conclusions". The authority reviews the data and verifies compliance. Upon request it provides scientific and regulatory advice to developers and approval holders "on the further development" of the product "and when appropriate for the purpose of obtaining a marketing authorisation by the Union". Under Art. 2(6) of the Directive the authority transmits the data to the Agency annually, and the Agency, with the competent authorities and the Commission, sets up and maintains a repository of it, "including the mechanism for electronic submission". Under Art. 2(5) of the Directive, if an approval "is revoked due to safety or efficacy concerns", the authority informs the Agency and the Agency informs the competent authorities of the other Member States.8Directive ST-6367 (n 3), Art. 2(4), (5) and (6). Art. 3(7) Directive 2001/83/EC speaks of quality, traceability and pharmacovigilance, the vocabulary of safety. Art. 2 of the Directive adds efficacy to the annual return, makes the authority its reviewer, and names efficacy as a ground of revocation whose consequence travels to every other authority in the Union. A hospital exemption approval therefore becomes, in substance, a rolling data-generation obligation with an efficacy component, and the bridge the text builds toward a marketing authorization can be crossed in either direction. The Commission's study counted three hospital-exemption developers moving toward centralized authorization on the strength of what they had generated.4 A program whose annual return disappoints is, on the same text, a program whose revocation is notified to twenty-six other regulators.
Who receives all this at the Agency is decided elsewhere in the Package. The Regulation in the Council's compromise text folds the Committee for Advanced Therapies into the Committee for Medicinal Products for Human Use. Recital 37 records that after more than fifteen years ATMPs "are now more common" and that "the full integration of their assessment in the work of the CHMP" will let products in the same therapeutic class be assessed together. Recital 36 keeps the committee's expertise through working parties and a pool of experts. Art. 142 of the Regulation lists the Agency's committees, and the CAT is not among them. Annex I keeps ATMPs under the mandatory centralized procedure, and Art. 61 of the Regulation gives the Agency, rather than the CAT, the scientific recommendation on whether a product under development is an ATMP at all.9Council compromise text for the Pharma Package Regulation, ST-6366/26 (6 March 2026), recitals 36 and 37, Art. 61, Art. 142, Annex I point 2. The repository of hospital-exemption data is thus to be built by an Agency that is, in the same instrument, dissolving the committee that has classified these products since 2009. Which body will read the annual returns, and against what benchmark, the text does not say. Beneath the product sits a second reform. From 7 August 2027 the SoHO Regulation governs the human cells and tissues that are the starting material of most hospital-exemption ATMPs, and Art. 1(5)(d) of the Directive keeps substances of human origin outside the Union code unless they fall within the ATMP definition, so the same donation passes through two regimes before it reaches the product. Insight 60 takes up that layer.10Regulation (EU) 2024/1938 (SoHO Regulation), Art. 87 (application from 7 August 2027); Directive ST-6367 (n 3), Art. 1(5)(d).
3. Non-Routine by Implementing Act: The Variables Still in the Commission's Hands
Four things that decide whether a program qualifies are not in the Directive at all. Art. 2(7) of the Directive instructs the Commission to adopt implementing acts under the examination procedure of Art. 214(2). They are to specify the details of the application for approval "including the evidence on quality, safety and efficacy" for the approval and for subsequent changes, the content and format of the annual data, "the modalities for the exchange of knowledge between hospital exemption approval holders within the same Member State or different Member States", and "the modalities for preparation and use of advanced therapy medicinal products under hospital exemption on a non-routine basis".11Directive ST-6367 (n 3), Art. 2(7) and (8), Art. 214(2); Study (n 4), p. 24 on national definitions of non-routine. The last is the one that has never been written. "Non-routine" has had no Union definition since 2008. The Commission's study found the clearest national definitions in Belgium, Germany, Estonia and the Netherlands and a numerical cap in only two of them, so a program that treats forty patients under a framework with no cap is compliant where it stands and would not be across the border in Estonia or the Netherlands.4 The implementing act will replace nineteen answers with one, and neither the operative text nor the recitals indicate whether that answer counts patients, batches or years. The first act is as consequential. As of the Commission's 2025 study at least one national framework required no pre-clinical or clinical data for an approval and some authorities decided case by case. Whether the Union form asks for efficacy evidence at the door, before a single patient has been treated, is a question the Commission will answer after the Directive is adopted and, on the transposition clock, possibly after Member States have drafted their own forms.
The timing compounds it. Art. 220 of the Directive sets entry into force twenty days after Official Journal publication, and Art. 219 sets transposition and application at twenty-four months after that. Art. 2(8) of the Directive requires the Agency's first public report on the experience with hospital exemption approvals three years after the date of application, and every five years thereafter. Recital 18 gives the report a purpose, to assess "whether an adapted framework should be developed for certain less complex ATMPs that have been developed and used under the hospital exemption".11 As of publication the compromise text had been endorsed by the Council's Committee of Permanent Representatives on 6 March 2026 and by the Parliament's public-health committee on 18 March 2026, with the Council's formal adoption expected after the summer, the plenary vote in the autumn and Official Journal publication to follow. The Commission's original proposal dates from 26 April 2023 and the trilogue agreement from 11 December 2025.12European Parliament, Legislative Train Schedule, file on the revision of the pharmaceutical legislation (version of 22 May 2026); COM(2023) 192 final (26 April 2023). On that calendar Art. 2 of the Directive applies from late 2028 at the earliest and the Agency's first assessment of an "adapted framework" arrives around 2031. Between publication and that date the national frameworks continue under Art. 3(7) Directive 2001/83/EC, while the approvals they grant will one day be judged by a form that does not yet exist. The transitional provisions in Art. 218 of the Directive address pending marketing-authorization procedures and existing authorizations. They say nothing about hospital exemption authorizations granted under Art. 3(7) Directive 2001/83/EC, so whether a 2025 German authorization becomes a "hospital exemption approval" by operation of transposition, or must be applied for again on the Commission's form, is a question each transposing act will answer for itself.
The Package also offers three other legal homes for the same clinical scenario, and all three put an authorized product or a sponsor at the center. Decentralized manufacturing, defined in Art. 4(67b) of the Directive as manufacturing activities carried out under the control of a central site supervising decentralized sites "located in sufficient proximity to patients", is approved under Art. 26b as part of the marketing authorization. The decentralized sites need no manufacturing authorization of their own under Art. 142(3)(b) of the Directive, operate under the qualified person of the central site, and are registered and supervised under Art. 148 of the Directive. Recital 109 names ATMPs with a short shelf-life as the paradigm case.13Directive ST-6367 (n 3), Art. 4(67b), 26b, 142(3)(b), 148, recital 109; Regulation ST-6366 (n 9), Art. 113 to 115 (regulatory sandbox). The regulatory sandbox of Art. 113 to 115 of the Regulation, examined in Insight 37, supervises a product on its way to authorization. And Art. 1(5)(c) of the Directive keeps investigational medicinal products outside the code, so a hospital that wants its patients to count as trial evidence runs a clinical trial under Regulation (EU) No 536/2014, with a sponsor.6 A US developer that partners with an academic center therefore faces a choice of legal status for one manufacturing suite. The options are a decentralized site of a central-site marketing authorization holder, a hospital exemption approval holder, or a trial site. The data each produces has a different regulatory afterlife, and the hospital-exemption data are the only ones that a national authority reviews, an Agency repository holds, and a knowledge-exchange implementing act may require to be shared with other approval holders in other Member States.
4. Outside the Perimeter: Switzerland's Draft Art. 9c HMG and the Missing US Analogue
Switzerland is not an EU Member State, and neither Art. 3(7) Directive 2001/83/EC nor Art. 2 of the Directive has effect there. The "same Member State" condition closes the door in both directions. A Swiss hospital cannot use an EU hospital exemption approval, and a product prepared in Spain under one cannot be supplied to Zurich. Swiss law as it stands has no hospital exemption for ATMPs. Products consisting of or containing human organs, tissues or cells that have been substantially manipulated, a term Art. 2 Abs. 1 Bst. d of the TxV defines to include genetic modification, or that are not intended to perform the donor's function in the recipient, and any product consisting of or containing animal organs, tissues or cells, are Transplantatprodukte under Art. 2 Abs. 1 Bst. c TxV. Art. 49 of the TxG applies the HMG's medicinal-product provisions to them by analogy, so they need a Swissmedic authorization before use and an establishment license for their manufacture under the HMG's licensing ordinance. The formula routes of Art. 9 Abs. 2 HMG, which Insight 06 tested against this scenario, were written for conventional preparations.14Transplantationsgesetz (SR 810.21), Art. 49; Transplantationsverordnung (SR 810.211), Art. 2 Abs. 1 Bst. c and d; Heilmittelgesetz (SR 812.21), Art. 9 Abs. 2.
Two Swiss instruments are changing that, and they overlap. On 29 September 2023 Parliament adopted a revision of the TxG which, alongside a vigilance system and the cross-over living donation program, created an exceptional authorization for hospitals to use unauthorized transplant products. The ordinances implementing that revision were in consultation until 10 October 2025, and the Federal Council placed the vigilance system in 2027.15Änderung des Transplantationsgesetzes vom 29. September 2023 (Geschäft 23.023); Federal Council media release and ordinance consultation of 20 June 2025. Before that rule could take effect, the Federal Council's bill of 3 September 2025 to amend the HMG moved it. The bill introduces Arzneimittel für neuartige Therapien as a statutory category in Art. 4 Abs. 1 Bst. aundecies E-HMG, absorbs transplant products into it, repeals the corresponding TxG provisions, and carries the hospital rule into a new Art. 9c E-HMG. Under it Swissmedic may grant a time-limited authorization ("befristet bewilligen") for the use of an unauthorized ATMP where the product is manufactured occasionally and in small quantities ("gelegentlich und in kleinen Mengen"), is prescribed for a specific person, is used in a hospital or another clinically managed institution under a physician's responsibility, no authorized, alternatively usable and equivalent therapeutic product is available in Switzerland, and a positive benefit-risk ratio is to be expected. The Federal Council may exclude product groups of elevated risk. Art. 59a E-HMG requires the holder of an Art. 9c E-HMG authorization to ensure systematic follow-up of the product's efficacy and adverse effects and to keep records, and Art. 9 Abs. 2quinquies E-HMG withdraws the formula exemptions from ATMPs altogether. The National Council adopted the bill on 12 March 2026 and the Council of States on 11 June 2026, with differences remaining between the chambers. On 3 July 2026 the National Council's health committee, in its work on the remaining differences, asked the administration for information on the regulation of hospital exemptions for unauthorized novel therapies under Art. 9c E-HMG and scheduled its continuation for November 2026.16Botschaft zur Änderung des Heilmittelgesetzes vom 3. September 2025, BBl 2025 3017; Entwurf, BBl 2025 3018 (Geschäft 25.074), Art. 4 Abs. 1 Bst. a undecies, 9 Abs. 2 quinquies, 9c, 59a; Nationalrat 12 März 2026; Ständerat 11 Juni 2026; SGK-N 3 Juli 2026.
Read against Art. 2 of the Directive, the Swiss draft differs in three places that matter to a developer, and none of them is cosmetic. The first is subsidiarity. Art. 9c E-HMG is available only where no authorized, alternatively usable and equivalent product is available in Switzerland, a condition that neither Art. 3(7) Directive 2001/83/EC nor Art. 2 of the Directive contains and that the Italian decree does.5 A Swiss academic program built on a US developer's construct therefore holds an authorization that ends when an equivalent product is authorized in Switzerland, which may be the developer's own. The exemption competes with its beneficiary's commercial route, and the authorization is time-limited in any event. The second is scope. Art. 9c Abs. 1 E-HMG reaches products under numbers 2 and 3 of the new definition, human or animal cells and tissues substantially manipulated or used non-homologously, and does not on its face reach number 1, products containing or consisting of nucleic acids directly involved in the intended effect. Where a genetically modified cell product sits between the two numbers the draft does not say in terms. In the EU, by contrast, such a product is a gene therapy medicinal product under Part IV of Annex I to Directive 2001/83/EC, and the Commission's study counted twelve gene therapy products approved under national hospital exemptions.17Commission Directive 2009/120/EC, Annex I Part IV, point 2.1 (gene therapy medicinal product); Study (n 4), Table 13. The third is data. Art. 59a E-HMG places the follow-up duty on the authorization holder and stops there. There is no annual return to Swissmedic in the text, no repository, and no counterpart to the Agency notification. A product under a Swiss authorization is therefore, in Union terms, invisible, and a product under an EU approval is, in Swiss terms, unusable.
For the US reader the absence is the point. The Commission's own study of jurisdictions abroad states that its team "did not identify a similar pathway" to the hospital exemption in the United States, and the FDA framework confirms it. A cell or tissue product that fails any of the four criteria of 21 CFR 1271.10(a) is regulated as a drug, device or biological product under the FD&C Act or section 351 of the Public Health Service Act, and the practice-of-medicine argument that a US reader may reach for has not taken its manufacture outside that framework.1 A US developer therefore encounters the European exemption only as a third party. It does so as the licensor of a construct or process to an academic center that will hold the approval, as the sponsor of an authorized product competing, in the same indication and the same hospitals, with a product that needs no authorization, or as the acquirer of a European academic program whose principal asset is a national approval that cannot be transferred to another Member State, exported, or scaled beyond "non-routine". In each role the questions change with Art. 2 of the Directive. Who holds the approval, what its annual returns have shown, whether a revocation elsewhere has been notified, whether the data generated can support the developer's own marketing authorization under the advice Art. 2(4) of the Directive contemplates, and under what rights, are diligence questions that a national register never had to answer and a Union repository will.
5. Strategic Considerations
The questions that decide exposure here are questions of status before they are questions of compliance. Whether an existing national authorization survives transposition as a "hospital exemption approval", or lapses into a re-application on the Commission's form, decides whether a program that has treated patients since 2021 keeps its history or starts again. The compromise text does not answer it, and twenty-seven transposing acts will. Whether the implementing act on "non-routine" counts patients, batches or years decides whether a program compliant in a Member State with no cap is compliant on the day the act applies, and a developer whose European access runs through that program has no standing in the comitology procedure that will decide it. Whether the evidence on efficacy the Commission requires at the application stage resembles what a national authority asks for today decides whether the exemption remains a route into the clinic or becomes, for a new construct, a route that presupposes the trial it was meant to precede.
Behind those sit questions that depend on facts only the parties hold. What the collaboration agreement says about ownership of the annual efficacy return decides whether the developer can use it for a marketing authorization, and whether the hospital can share it under a knowledge-exchange act with an approval holder in another Member State that happens to be the developer's competitor. What the license says about revocation decides who bears the consequence when an efficacy-based revocation in one Member State reaches every other regulator, and whether that event is a termination trigger, a milestone failure or neither. And what a Swiss partner's authorization under Art. 9c E-HMG, in whatever form the chambers finally settle it, says about its own duration decides whether the developer's Swiss launch ends the academic program that generated its evidence.
For a US-listed developer the feedback loop is concrete. A revocation "due to safety or efficacy concerns" that the Agency circulates to twenty-six competent authorities is a foreign regulatory action of the kind a risk-factor disclosure has to weigh, and it will attach to a product the developer does not hold and a program it does not control. Whether a given program sits on the right side of each of these lines depends on the approval as granted, the contracts around the construct and the data, the Member State's transposition and, in Switzerland, on a bill still between the chambers. Those are questions of fact, of drafting and of timing, and they require analysis tailored to the program, the entities involved and the commercial context.