Insights

On October 19, 2026, President Trump signed an executive order (EO) titled “Advancing Women’s Health to Improve Outcomes in All Phases of Life,” establishing new federal infrastructure dedicated to improving women’s health research, clinical translation, and coordinated policy leadership. The EO creates a White House Women’s Health Task Force and directs the U.S. Department of Health and Human Services (HHS) to establish a new Women’s Health Division within the National Institutes of Health (NIH).  

The life sciences sector is uniquely vulnerable to the inherent risks of AI-generated evidence in drug development and discovery. This client alert focuses on five core challenges: hallucinations, skewed predictions from unrepresentative training data, the opacity of AI reasoning, input sensitivity that undermines reproducibility, and adversarial manipulation of training data. To address these risks, companies should use experimental validation and human oversight as the common legal and regulatory safety net. This entails among other measures auditing AI outputs, characterizing training data, and structural oversight. Companies also should prepare for evolving frameworks and guidance from the U.S. Food and Drug Administration (FDA) and the European Union (EU) that address use of AI in drug discovery and development .  

At a glance: A New Mexico jury found Meta liable for nearly 44 million deceptive trade practice violations based on misleading privacy and platform-safety statements—showing that public-facing privacy claims can create significant consumer-protection exposure.

On August 31, 2026, the U.S. Securities and Exchange Commission (SEC) and the U.S. Food and Drug Administration (FDA) signed a Memorandum of Understanding (MOU) establishing a formal framework for the two agencies to share non-public information concerning FDA-regulated products and the companies and individuals engaged in their manufacture, distribution, and sale. The MOU was signed by SEC Chairman Paul S. Atkins and Acting FDA Commissioner Kyle Diamantas. It takes immediate effect and runs for three years, subject to renewal, modification, or termination. In a press release, Chairman Atkins described FDA-related disclosures by public companies as having “a significant impact on our markets” and identified the FDA as “a valuable partner in our efforts to administer and enforce applicable disclosure requirements under the federal securities laws.” Acting Commissioner Diamantas framed the MOU as protecting “both the patients who rely on FDA-regulated products, and the public trust that drives health care innovation.”

The rapid emergence of AI/ML tools in drug discovery, from target identification to generative molecular design, lead optimization, and repurposing, has transformed how life sciences companies build some of their most valuable assets. As AI/ML tools take on an increasingly significant role in the drug discovery process, companies face a set of largely unresolved IP challenges that require careful planning and proactive governance.  

The U.S. Department of Health and Human Services’ (HHS) Office of Research Integrity (ORI) published its long-anticipated Guidance on Generative Artificial Intelligence in August. The guidance explains how generative AI (GenAI) use is evaluated under the revised research misconduct regulations (42 CFR Part 93), which took effect January 1, 2025, and became applicable to new allegations on January 1, 2026. The new guidance builds on prior guidance documents regarding the definitions of fabrication, falsification, and plagiarism, as well as revised evidentiary standards. As of April 30, 2026, institutions were required to have compliant policies on file with ORI as part of their annual report covering 2025. 

Over the past several years, the biopharmaceutical industry has embraced artificial intelligence and machine learning (AI/ML) in near lockstep with the pace of AI/ML innovations. Today, industry leaders are using AI/ML to, among other things: discover and assess biological pathways, target chemical structures and sequences; design proteins; model pre-clinical and clinical trials; recruit and screen potential patient populations; evaluate clinical trial results and biomarker data; prepare regulatory filings; and manage supply chains. Deployment of new AI/ML models promises extraordinary advances in pharmaceutical development. However, as with any technological and scientific advances, the use of AI/ML also poses substantial legal risks that life sciences companies need to consider and proactively manage. 

The U.S. Food & Drug Administration (FDA) is seeking feedback on a regulatory framework that could be used to evaluate generative artificial intelligence (GenAI)-enabled medical devices. Such devices could create new types of risks because their outputs can vary and evolve, unlike more traditional software-enabled devices. An August 18, 2026, discussion paper (“Considerations for the regulation of GenAI-enabled medical devices”) discusses potential regulatory considerations for GenAI-enabled medical devices. 

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

On June 22, 2026, House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) announced a bipartisan agreement on a revised version of the KIDS Act (H.R. 7757), marking the most significant congressional advance on children's online safety legislation in years. The House passed H.R. 7757, as amended, on June 29, 2026, setting up a potential showdown with the Senate. The revised KIDS Act consolidates elements of 14 pending legislative proposals — including KOSA and COPPA 2.0, both of which have previously passed the Senate and cleared the House Energy and Commerce Committee — into a single, comprehensive framework. The announcement, however, was met immediately with objections from Senate sponsors and civil liberties groups, underscoring the difficult legislative road ahead.

On April 29, 2026, the New York Department of Financial Services (NYDFS) announced the finalization of a $2.25 million settlement with Delta Dental of New York and Delta Dental Insurance Co., resolving allegations that the affiliated companies failed to comply with the state’s stringent cybersecurity, consumer data protection, and incident reporting requirements. For health insurers, managed care organizations, and their third-party service providers operating in New York, the announcement comes as the latest signal that the NYDFS intends to aggressively enforce its cybersecurity regulations — which are widely considered the strictest in the nation following a 2023 overhaul. These regulations, codified at 23 NYCkRR 500 (Cybersecurity Requirements for Financial Services Organizations), apply to any entity licensed under New York insurance law, including health insurers, managed care organizations, and their third-party service providers.

Consistent with recent FDA initiatives directed at leveraging AI technologies and improving early-phase clinical trial conduct, the FDA has issued a Request for Information (RFI) for input on a proposed AI-enabled optimization pilot program for early-phase clinical trials. The issues for which FDA is requesting information fall into two categories:  (A) Pilot program design and implementation and (B) Program evaluation metrics and success criteria.

Several recent class actions filed against Tempus AI, Inc., a health care technology company that combines AI with molecular and clinical data to develop precision medicine services, are the latest in a series of cases illustrating a fast-growing legal risk: the repurposing of genetic and clinical data — collected for diagnostic or treatment purposes — for artificial intelligence (AI) model training, analytics, and downstream commercialization following corporate acquisitions. At the same time, state genetic privacy regulation is expanding rapidly, with Utah and South Dakota being the most recent states to enact new statutes, and legislation advancing in several additional states. Organizations holding genetic datasets need to treat data governance as a core enterprise risk issue, not a downstream compliance matter.

At the International Association of Privacy Professionals’ (IAPP) annual conference March 30-31, 2026, enforcement officials from California, Connecticut, Indiana, and Delaware shared their current and upcoming enforcement priorities under U.S. state consumer privacy laws. This alert summarizes the key themes from the panel and offers practical guidance for companies navigating the evolving enforcement landscape.

In a development likely to ramp up regulatory pressure on an industry already under significant federal scrutiny, Federal Trade Commission (FTC) Chairman Andrew Ferguson recently directed leaders across his agency to launch a team dedicated to cooperatively advancing enforcement and advocacy activities relevant to health care.

On March 6, 2026, the White House released its National Cyber Strategy (Strategy) and issued an accompanying Executive Order, “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens” (EO). These documents outline the administration’s priorities for combating cybercrime and call for coordination across the federal government and the private sector to invest in new technologies, continue innovation, and prioritize the United States’ cyber capabilities. Key sectors of concern include energy, financial services, telecommunications, data centers, water, and health care. The Strategy and EO encourage increased public-private coordination, signal greater latitude for private sector offensive cyber operations, prioritize securing critical infrastructure, elevate cybercrime as a national security priority, outline a path for victim compensation, and promote streamlining cyber regulations.

On December 11, 2025, President Trump signed a much-anticipated Executive Order that seeks to forestall state regulation of artificial intelligence (AI) by threatening federal lawsuits and the withholding of some federal funds and calls for a national policy framework on AI. The Executive Order, Ensuring a National Policy Framework for Artificial Intelligence (EO), declares it the policy of the administration “to sustain and enhance the United States’ global AI dominance through a minimally burdensome national policy framework for AI.”

President Trump is preparing to sign an Executive Order that would seek to forestall state regulation of artificial intelligence (AI) by threatening federal lawsuits and the withholding of some federal funds. The draft, unsigned six-page Executive Order, “Eliminating State Law Obstruction of National AI Policy” (EO), the text of which has been circulating publicly since November 19, would declare it the policy of the Administration “to sustain and enhance America’s global AI dominance through a minimally burdensome, uniform national policy framework for AI.”

On September 30, 2025, the Food and Drug Administration (FDA) issued a Request for Public Comment (“Request”) inviting stakeholders to share practical experience and recommendations for measuring and evaluating the real-world performance of AI-enabled medical devices, including those powered by GenAI. According to FDA, the Request is not intended to communicate new guidance or regulatory expectations but aims to advance the conversation on how best to assure the safety, effectiveness, and reliability of AI-driven technologies in clinical practice.