Insights

On September 28, 2026, the General Services Administration (GSA) issued a new clause for incorporation into government contracts of artificial intelligence systems, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems, as a GSA Regulation Deviation (the Final Clause). The Final Clause will become effective on October 19, 2026.

The rapid emergence of AI/ML tools in drug discovery, from target identification to generative molecular design, lead optimization, and repurposing, has transformed how life sciences companies build some of their most valuable assets. As AI/ML tools take on an increasingly significant role in the drug discovery process, companies face a set of largely unresolved IP challenges that require careful planning and proactive governance.  

The U.S. Department of Health and Human Services’ (HHS) Office of Research Integrity (ORI) published its long-anticipated Guidance on Generative Artificial Intelligence in August. The guidance explains how generative AI (GenAI) use is evaluated under the revised research misconduct regulations (42 CFR Part 93), which took effect January 1, 2025, and became applicable to new allegations on January 1, 2026. The new guidance builds on prior guidance documents regarding the definitions of fabrication, falsification, and plagiarism, as well as revised evidentiary standards. As of April 30, 2026, institutions were required to have compliant policies on file with ORI as part of their annual report covering 2025. 

Over the past several years, the biopharmaceutical industry has embraced artificial intelligence and machine learning (AI/ML) in near lockstep with the pace of AI/ML innovations. Today, industry leaders are using AI/ML to, among other things: discover and assess biological pathways, target chemical structures and sequences; design proteins; model pre-clinical and clinical trials; recruit and screen potential patient populations; evaluate clinical trial results and biomarker data; prepare regulatory filings; and manage supply chains. Deployment of new AI/ML models promises extraordinary advances in pharmaceutical development. However, as with any technological and scientific advances, the use of AI/ML also poses substantial legal risks that life sciences companies need to consider and proactively manage. 

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement.

Section 230 of the Communications Decency Act (“Section 230”) protects online platforms from liability for user-generated speech. Based on the premise that platforms generally do not create original content but instead curate their users’ own speech, Section 230’s protections have historically applied to a platform’s algorithmically assembled, selected or sequenced content; algorithms or features that amplified or directed user generated speech to particular users were generally protected. Indeed, the old rule of thumb was the more a platform used algorithms or automation, the more likely user generated speech remained user generated speech. GenAI has the potential to change that calculus. A platform that ingests user generated content and publishes a transformed output, can blur Section 230’s line between publication and creation. The central question is whether Section 230 protects GenAI, which analyzes, but does not alter, user-created content to produce an outcome, and its corresponding outputs.

Two federal appellate courts have now looked at analogous allegations of price fixing using AI-driven pricing software and reached opposite conclusions—creating an arguable circuit split and providing additional guidance to companies using algorithmic pricing tools.

On July 6, 2026, Illinois Governor JB Pritzker signed SB 315, the Artificial Intelligence (AI) Safety Measures Act (the Illinois Act), to establish a framework for AI safety, transparency, and accountability for the world’s most powerful AI models. The governor’s approval follows unanimous passage of the bill by the Illinois House and nearly-unanimous support in the Illinois Senate in May. 

On June 26, 2026, the National Highway Traffic Safety Administration (NHTSA) took two major actions related to autonomous vehicles. First, NHTSA issued a Notice of Proposed Rulemaking (NPRM) proposing significant updates to Federal Motor Vehicle Safety Standard (FMVSS) No. 135, which has governed light vehicle brake systems in passenger cars and light trucks since 1995.[1]  Second, NHTSA formally withdrew its January 15, 2026 NPRM, which had proposed the Automated Driving System-Equipped Vehicle Safety, Transparency, and Evaluation Program (AV STEP), a voluntary program for vehicle manufacturers, fleet operators, and system integrators of autonomous vehicles and automated driving systems.

The nation’s power grid and infrastructure are facing increased pressure from artificial intelligence (AI) data centers, prompting new questions around environmental regulatory design and compliance. As technology companies race to build and expand new data center factories, they face a web of permitting requirements as well as potential community opposition, and environmental litigation — all against a backdrop of rapid and still-evolving agency guidance.

The General Services Administration (GSA) is seeking public comment on a new GSA Regulation clause, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems (LLMs), governing data safeguards and requirements prime contractors must comply with when providing or using LLMs under federal contracts. This updated clause (Revised Clause) reflects substantial revisions from an earlier version released in March 2026 (Original Clause) that faced substantial pushback from industry. Where the Original Clause cast a wide net — imposing obligations broadly across AI systems with little differentiation among supply-chain participants — the Revised Clause is more narrowly tailored. The Revised Clause:

On June 5, 2026, President Trump issued National Security Presidential Memorandum (NSPM) 11 (NSPM-11) to accelerate AI adoption by the U.S. military and intelligence agencies. It directs updated AI management, acquisition, and use policies and seeks to compel AI companies to comply with Trump administration policies.  It calls for expanded training and enhanced security in collaboration with the private sector and orders the “termination for default or for convenience” of government contracts with AI companies that wish to limit how the government uses their products. NSPM-11 could also herald a major change in autonomous warfighting policy by directing the update of the Pentagon’s primary directive on autonomous weapon systems.

On December 11, 2025, New York Governor Kathy Hochul signed S.8420-A/A.8887-B into law. This first-in-the-nation legislation, called the New York AI Synthetic Performers Disclosure Law, is intended to protect consumers and promote transparency in the age of AI advertising. This law represents a meaningful shift in the legal landscape for AI advertising. For the first time in any U.S. jurisdiction, the mere use of an AI-generated human likeness in a commercial advertisement triggers an affirmative disclosure obligation. The practical implications are significant, particularly for e-commerce retailers, digital advertisers, and agencies that have integrated AI-generated human imagery into high-volume creative workflows.

On June 2, 2026, President Trump signed a highly anticipated artificial intelligence and cybersecurity Executive Order, “Promoting Advanced Artificial Intelligence Innovation and Security” (the EO), directing several national security and civilian agencies to ramp up scrutiny of cutting-edge AI models and bolster federal cybersecurity defenses against AI-enabled threats.

Colorado’s original AI Act (SB 24-205), signed in May 2024, imposed broad obligations on developers and deployers of “high-risk AI systems” — including requiring risk management programs, impact assessments, and affirmative steps to prevent algorithmic discrimination across employment, housing, lending, insurance, health care, and education decisions. The operative date for SB 24-205 was extended twice, and a court temporarily suspended enforcement in early 2026, following a lawsuit filed by xAI, which the U.S. Department of Justice (DOJ) intervened to support. Industry feedback on SB 24-205 was generally negative. In response to this environment, Colorado’s legislature undertook a rewrite, drafting and passing SB 26-189 in a matter of weeks. SB 26-189 reflects the legislature’s effort to preserve the policy goal of filling the AI oversight vacuum given the lack of a comprehensive federal law, but within a more workable compliance framework.

On May 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. National Security Agency (NSA), the Australian Cyber Security Centre, the UK National Cyber Security Centre, the Canadian Centre for Cyber Security, and the New Zealand National Cyber Security Centre, published joint guidance on the “Careful Adoption of Agentic AI Services” (Guidance).

Consistent with recent FDA initiatives directed at leveraging AI technologies and improving early-phase clinical trial conduct, the FDA has issued a Request for Information (RFI) for input on a proposed AI-enabled optimization pilot program for early-phase clinical trials. The issues for which FDA is requesting information fall into two categories:  (A) Pilot program design and implementation and (B) Program evaluation metrics and success criteria.

The appropriate use of AI tools during the claims review process continues to be a major topic of debate within the health care industry — but in recent weeks, emerging litigation has inspired critics to turn their attention specifically to the technology’s application within federal health programs. On March 25, 2026, the Electronic Frontier Foundation (EFF) filed a lawsuit against the Centers for Medicare and Medicaid Services (CMS), citing the agency’s alleged failure to answer a Freedom of Information Act (FOIA) request for records the EFF believes will provide crucial insight into the design, safeguards, vendor relationships, and real-world performance of the Medicare Wasteful and Inappropriate Service Reduction (WISeR) Model, CMS’s  AI-driven prior authorization pilot program for certain Medicare services.