Media RSS Feed

Litigator of the Week Runners-Up and Shout-Outs

Fri, 16 Oct 2026 19:10:56 Z

A Cooley patent litigation team earned a runner-up spot on The American Lawyer’s Litigator of the Week Runners-Up and Shout-Outs list for securing a defense win for Box Inc., a cloud storage and file sharing company, in a long-running dispute involving file synchronization technology. US District Judge Jacqueline Scott Corley granted Box summary judgment of noninfringement on the remaining four patents after the Patent Trial and Appeal Board previously invalidated the asserted claims of two other patents, a decision upheld by the Federal Circuit earlier this year.

The Cooley team was led by partners Heidi Keefe, Lowell Mead and Reuben Chen, and associates Sam Whitt and HanByul Chang.

Read the article (subscription required)

Chambers UK 2027 Recognizes Cooley Practices + Lawyers

Thu, 15 Oct 2026 16:00:00 Z

London – 15 October 2026 – Chambers UK has recognized Cooley with rankings of seven practices and 29 individual lawyer rankings in their respective fields.

The results include a new Band 1 recognition in the Private Equity: Venture Capital Investment category. Cooley maintained its Band 1 recognition in the Life Sciences: Transactional and Product Liability: Mainly Defendant categories. There was also an upward move in the rankings for Corporate/M&A: £100-800 million and Data Protection & Information Law. Additionally, five Cooley lawyers received new Chambers rankings, and five lawyers improved their rankings.

Cooley’s Chambers UK 2027 practice rankings are listed below.

Leading practices

Corporate/M&A: £100-800 million +
Data Protection & Information Law +
Employee Share Schemes & Incentives
Life Sciences: Transactional
Private Equity: Venture Capital Investment +
Product Liability: Mainly Defendant
Tax

Indicates Band 1 ranking
+ indicates improved ranking

Tenable Holdings Announces Closing of $400 Million Secured Revolving Credit Facility

Wed, 14 Oct 2026 21:23:45 Z

Washington, DC – October 14, 2026 – Cooley advised Tenable Holdings (Nasdaq: TENB), the exposure management company, on its $400 million senior secured revolving credit facility.

Lawyers Michael Tollini, Addison Pierce, Charles Watkins and Timothy Shapiro led the Cooley team advising Tenable.

Cooley previously advised Tenable on its $800 million aggregate principal amount of 0.25% convertible senior notes due 2031 in September 2026, $425 million debt financing in July 2021 and $288 million initial public offering in August 2018.

Iambic Announces $150 Million IPO

Wed, 14 Oct 2026 19:12:00 Z

San Diego – October 14, 2026 – Cooley advised the underwriters of Iambic Therapeutics, a clinical-stage life sciences and technology company advancing novel medicines using its AI-driven platform, in connection with Iambic’s $150 million initial public offering (IPO). Iambic issued 9,375,000 shares of its common stock at a public offering price of $16 per share, with a 30-day option for the underwriters to purchase up to an additional 1,406,250 shares. Iambic’s common stock will begin trading on the Nasdaq Global Select Market on October 15, 2026, under the ticker symbol IAM.

J.P. Morgan, Jefferies, BofA Securities and Citigroup are acting as joint book-running managers for the offering.

Lawyers Charlie Kim, Denny Won, Kristin VanderPas and Carlos Ramirez led the Cooley team advising the underwriters.

Cooley Partners Shortlisted for Three Leadership in Law Awards 2026

Wed, 14 Oct 2026 17:05:50 Z

Three Cooley partners have been shortlisted for recognition in the 2026 Leadership in Law Awards, presented by Law.com International.

James Maton, co-partner in charge of Cooley’s London office, is shortlisted for Legal Leader of the Year, honoring his exceptional leadership, vision and commitment to empowering others across the firm.

Claire Keast-Butler, co-partner in charge of Cooley’s London office, is shortlisted for Outstanding Women in Law, celebrating her leadership, influence and contributions to advancing the legal profession.

Guadalupe Sampedro, a London partner, is shortlisted for Trusted Adviser, recognizing her role as a trusted strategic adviser to clients and senior stakeholders and the impact of her counsel beyond technical legal advice.

The Leadership in Law Awards celebrate individuals and teams across the legal profession who are shaping the future of law through outstanding leadership, innovative thinking and high-impact work. The 2026 shortlist includes more than 130 nominees across 22 categories.

Read the full shortlist.

The winners will be announced at the Leadership in Law Awards ceremony on December 3 in London.

California SB 253: November 10 Reporting Deadline Approaching

Wed, 14 Oct 2026 07:00:00 Z

The first reporting deadline under California’s Climate Corporate Data Accountability Act (SB 253) is approaching. The California Air Resources Board (CARB) has established November 10, 2026, as the initial reporting deadline under SB 253. SB 253 generally applies to US-organized public and private companies doing business in California with more than $1 billion in total annual revenue. Under CARB’s proposed implementing regulations, the $1 billion revenue threshold is determined using the lower of the entity’s gross receipts for its two most recently completed fiscal years.

For this initial reporting year, CARB has provided flexibility for covered companies to submit one of the following:

Scope 1 and Scope 2 emissions disclosures: Companies may report Scope 1 and Scope 2 emissions data for their prior fiscal year based on information they already had or were collecting when CARB issued its December 5, 2024, enforcement notice. Acceptable submissions include an existing annual or sustainability report containing Scope 1 and Scope 2 emissions data, information previously reported under a voluntary or other regulatory program, or data submitted using CARB’s reporting template. For 2026, CARB will accept submissions without third-party assurance.
Statement of nonreporting: For the initial reporting year, CARB has provided flexibility in implementing SB 253, including permitting companies to satisfy their initial reporting obligations through existing emissions disclosures and requesting a statement of nonreporting from companies that were not collecting nor planning to collect Scope 1 and Scope 2 emissions data as of December 5, 2024. Instead, CARB requests a statement on company letterhead confirming those circumstances and stating that the company is not submitting an emissions report.

Companies may submit emissions reports or statements of nonreporting through CARB’s voluntary reporting platform or by email to climatedisclosure@arb.ca.gov. Scope 3 emissions reporting does not begin until 2027.

Covered companies should evaluate whether they are subject to SB 253, confirm their reporting obligations and prepare any required submissions ahead of the November 10 deadline.

Litigation challenging SB 253 remains pending, but its reporting requirements have not been stayed. Separately, enforcement of California’s companion Climate-Related Financial Risk Act (SB 261) remains stayed by the US Court of Appeals for the Ninth Circuit pending appeal.

Cooley’s ESG and sustainability advisory attorneys are available to discuss these requirements. Reach out to your existing Cooley contact or email Cooley’s ESG and sustainability advisory team.

Cooley Shortlisted for Five Financial Times Innovative Lawyers Awards North America 2026

Wed, 14 Oct 2026 04:52:00 Z

Cooley has been shortlisted for five honors at the Financial Times Innovative Lawyers Awards North America. The annual program recognizes organizations and individuals across the legal industry whose innovative approaches, technologies and leadership are shaping the future of legal practice.

Cooley's shortlist recognitions include:

Intrapreneur – Recognizing individuals who drive innovation within their organizations, Peter Warner, chair of Cooley's global business department and co-chair of the global emerging companies and venture capital practice, was honored for more than a decade of leadership advancing innovation across the firm.
Innovation in Knowledge & Data – This recognition celebrates the use of knowledge, data and AI to advance legal practice. A cross-functional Cooley team was honored for developing an internal tool that helps lawyers determine in real time whether AI is permitted for a client or matter.
Innovation in People & Skills – Honoring new approaches to attracting and developing legal talent, Cooley was recognized for transforming entry-level associate recruitment from a single hiring event into a multi-year talent-building process.
Innovation in Technology for Clients – Vanilla by Cooley was recognized for its cloud-based fund subscription platform, reflecting the category's focus on technology that enhances client service. The platform has surpassed $100 billion in closed subscriptions, supporting more than 1,200 fund clients and more than 50,000 limited partners.
Innovative Lawyers in Unlocking Capital – Cooley was recognized for advising Navan on its $923 million initial public offering, reflecting the category's focus on innovative legal work that helps businesses access capital and achieve strategic growth.

Read the full shortlist.

The winners will be announced at an awards ceremony on December 7 in New York.

Cooley Advised Proscia on Agreement to Be Acquired By Agilent Technologies

Tue, 13 Oct 2026 19:46:39 Z

Cooley advised Proscia, a provider of digital pathology software for clinical and life-sciences customers, on its agreement to be acquired by Agilent, a global leader in analytical and clinical laboratory technologies, for $240 million in all-cash at closing and up to an additional $30 million based on achieving future performance milestones. Upon closing, Proscia will become part of the Agilent Life Sciences and Diagnostics Markets Group and will accelerate innovation while continuing to provide customers with the flexibility they need across clinical and life sciences workflows.

The transaction was announced publicly in this press release.

Aaron Binstock, Eddie Sniezek, Patrick Reed, and Sanjay Reddy led the Cooley team advising Proscia.

Danielle Gershowitz, Sacha Ross, Jessica Lauren Koffel, Nyron Persaud, Jonathan Rivinus, Michael Bruno, Joy Chow, Bomin Kim, Tony Guan, Morgan Perna, and Breanna Qin provided invaluable support.

Cooley previously advised Proscia on multiple financing matters leading up to its exit.

Rocket Software Announces Acquisition of Geniez AI

Tue, 13 Oct 2026 16:43:00 Z

New York – October 13, 2026 – Cooley advised Geniez AI, a generative AI company, on its acquisition by Rocket Software, a global technology leader in modernization software. This acquisition brings Geniez AI’s technical leadership and team to Rocket Software, where they will help accelerate Rocket’s AI initiatives.

The team was led by lawyers Roy Moran, Nathan Baum, Elaine Huang, Harrison Platt, J. Carr Gamble and Queenie Chen, with support from Jonathan Rivinus, Eerik Kukebal, David Wilson, Jack Jones, Chris Lynn, Chris Chynoweth, Alexander Ellebracht, Caroline Hobson, Michael Bergmann, Allison Nostdahl, Michael La Marca, Paula Holland, Anna Caro and Bryan Berman.

Electronics Manufacturers May Need to Use Different Test Labs

Tue, 13 Oct 2026 07:00:00 Z

The Federal Communications Commission (FCC) will vote on a Third Report and Order and Third Further Notice of Proposed Rulemaking on October 29 that will require device testing, certification and accreditation to occur in the US or countries that have entered into reciprocal agreements with the US. If approved, the measures will take effect on December 1, 2028. This Third Report and Order builds on rules the FCC has already adopted and is actively enforcing: The FCC already prohibits recognition of test labs and telecommunication certification bodies (TCBs) that are owned by, controlled by or subject to the direction of certain federally identified “prohibited entities,” and has already withdrawn recognition from numerous test labs on that basis.

Limiting recognition of test labs and telecommunications certification bodies

The FCC will vote on rules to limit recognition of test labs to those located in the US and reciprocal economies – i.e., the territory of an economy with which the US has entered into reciprocal treatment through a Mutual Recognition Agreement (MRA) or other comparable reciprocal trade agreement. The prohibition on recognizing non-MRA test labs will be applied to applications received on or after December 1, 2028, and will not affect equipment authorizations granted or applications received before that date. The FCC’s Office of Engineering and Technology (OET) will publish and regularly update the list of countries with reciprocal agreements. The FCC has declined to adopt a waiver process or case-by-case exceptions for test labs in nonreciprocal economies, so manufacturers should not expect case-by-case relief from the December 1, 2028, cutoff.

The FCC recognizes that five out of six radio frequency devices are tested in nonreciprocal countries, and that the incremental costs of complying with the rules will significantly outweigh the quantifiable benefits. These rule changes will impose additional costs for manufacturers. Nevertheless, the FCC finds that the national security benefits justify these increased costs.

Extension of limitations to testing and certifying within nonreciprocal economies

The new rules would not only prohibit test labs, TCBs and laboratory accreditation bodies from being located in a nonreciprocal economy, but also prohibit conducting any “covered activity” in such locations. For TCBs, covered activities include application evaluation, technical review, certification decisions, grant or dismissal, and FCC-required post-market surveillance. For a test lab, covered activities include test setup and operation, required measurements, technical analysis of results, and preparation or approval of the test report. For accreditation bodies, covered activities include the assessment, technical evaluation and decision to accredit a laboratory for a scope used to obtain FCC recognition.

The rules would not extend to pre-compliance or research and development testing that is not FCC-recognized testing and is not relied on in a certification application. An entity that has employees working remotely from a nonreciprocal economy may not perform the substantive covered tasks, but the entity would not lose recognition for simply having unrelated business in the nonreciprocal economy.

Third Further Notice of Proposed Rulemaking

The FCC proposes rules on whether it should also adopt a requirement to utilize the Legal Entity Identifier (LEI) to properly identify test labs, TCBs and laboratory accreditation bodies in its equipment authorization program. The FCC also seeks comment on other proposals to strengthen the integrity of its equipment authorization program, including extending the new rules to prohibit recognition of any entity owned by, controlled by or subject to the jurisdiction or direction of a nonreciprocal economy – a proposal that, if adopted, could reach US-based or reciprocal-economy test labs with foreign ownership or investment ties, not just labs located abroad. The FCC also asks whether equipment authorized through the Supplier’s Declaration of Conformity process should be tested by recognized or accredited laboratories. This last issue could significantly increase the costs of testing these products.

Comments on the Third Further Notice of Proposed Rulemaking will be due 30 days after Federal Register publication, with reply comments due 60 days after publication.

If you are interested in learning more about the new rules or participating in the comment process, please reach out to one of the Cooley lawyers listed below.

New York Enacts New Personnel Record Access Law, With Amendments Expected

Tue, 13 Oct 2026 07:00:00 Z

New York became the latest state to enact a personnel record access law, granting employees a statutory right to access personnel records beginning November 8, 2026. Below we summarize key new obligations and compliance steps for employers.

Scope of covered records

Explicitly modeled after the Massachusetts Personnel Record Law, S3460 requires employers to grant current and former employees access to their personnel files. The law broadly defines a “personnel record” as any record kept by the employer that is, has been or may be used to affect the employee’s qualifications for employment, promotion, transfer, additional compensation or disciplinary action. The definition expressly includes, without limitation, the following information about the employee:

Name, address and date of birth
Job title and description
Rate of pay and other compensation
Starting date Job applications, resumes and other forms of employment inquiry
Performance evaluations (including self-evaluations and written warnings)
List of probationary periods
Signed waivers
Termination notices
“Any other documents relating to disciplinary action”

Employers must retain the complete personnel record without deletion or expungement from the date of employment to three years after termination. Notably, the definition of “personnel record” extends to records kept by a third party with a contractual agreement with the employer to keep or supply such records on the employer’s behalf, such as professional employer organizations (PEOs) or payroll vendors. However, the definition excludes information “of a personal nature” about another person other than the employee if disclosure would constitute an invasion of privacy.

Right to access

Employees may submit a written request for a copy of their personnel record, which the employer must provide at no cost within five business days. Employers need not honor more than two requests per calendar year, but a review triggered by a “negative information” notice (described below) does not count toward this cap.

Negative information notice

Employers must notify an employee within 10 days of placement in their employee’s personnel record any information “to the extent that the information is, has been used or may be used, to negatively affect the employee’s qualification for employment, promotion, transfer, additional compensation or the possibility that the employee will be subject to disciplinary action.” The law does not specify the form of notice or further define “negative information.”

Right to respond and correct

If an employee disagrees with any information in their record, including but not limited to “negative information,” the employee and employer may mutually agree to remove or correct it. Absent agreement, the employee may submit a written statement explaining their position, and such statement must become part of the personnel record, appropriately retained, and included whenever the disputed information is transmitted to a third party. Employees may also seek expungement (through collective bargaining, judicial process or “other personnel procedures”) of information the employer knew or should have known to be false.

Enforcement and penalties

The attorney general will enforce the law, with fines of $500 to $2,500 per violation. Employers are also prohibited from retaliating against employees who exercise their rights under the law, including by threatening or making immigration status-related reports against the employee or their family or household members.

Amendments likely

In signing the law, Gov. Kathy Hochul acknowledged its ambiguities and stated she has reached an agreement with the New York Legislature to address them in the upcoming legislative session. Two areas were specifically flagged for clarification:

Confirming that employers are not required to create a personnel file or generate new documents beyond what they currently maintain.
Clarifying that personnel records are limited to records or documents actually used to determine an employee’s qualifications for hiring, retention, promotion, transfer, additional compensation or discipline.

Next steps

To prepare to comply, employers should consider the following steps:

Review existing personnel record policies. Review current practices for personnel record access and contents, and modify them as needed to comply with the new law. Confirm that retention practices meet the three-year post-termination minimum, keeping in mind that other state or federal laws may require longer retention periods.
Establish a request protocol. Build a process for receiving and responding to personnel record requests within five business days, including a designated point of contact. Employers that use a PEO or third party to maintain personnel records should ensure they have immediate access to those records to meet this deadline.
Establish a notice protocol. Because the law does not define whether “negative information” extends beyond formal discipline to informal records, the notice trigger could be interpreted broadly. Employers should establish criteria for identifying “negative information” and a process for issuing timely notice to employees.
Train human resources and management teams. Train HR and management on the law’s access, notice, response and anti-retaliation requirements. Managers should be especially aware of the tight turnaround between creating a personnel record with “negative information” and notifying the employee, and should coordinate with HR to ensure compliance. Accurate documentation of performance and disciplinary decisions remains critical, as undisclosed issues may be harder to rely on later if the required notice was never given.
Stay tuned for amendments. Watch for legislative developments when the legislature reconvenes in January 2027, and be prepared to adjust compliance procedures accordingly.

If you have questions about these laws or how to comply, please contact the Cooley employment team or one of the lawyers listed below.

Recent Circuit Court Decisions Coalesce on Scope of LP Self-Employment Tax Exception

Tue, 13 Oct 2026 07:00:00 Z

The long saga of who is a limited partner for purposes of the limited partner exception may finally be inching towards a resolution, with two circuit courts recently converging on similar definitions, both of which make it difficult for taxpayers engaged in management activities to claim the exception.

On August 12, 2026, the US Court of Appeals for the Fifth Circuit ruled that a partner who plays “no significant role in managing or running a business” is a “limited partner” for purposes of the limited partner exception to self-employment taxes described in Internal Revenue Code (IRC) Section 1402(a)(13).¹ In doing so, the Fifth Circuit withdrew its January 2026 opinion in Sirius Solutions, L.L.L.P. v. Comm’r,² which previously defined a “limited partner” for this purpose as a partner with limited liability.

Ruling on the same issue, on September 17, 2026, the US Court of Appeals for the Second Circuit similarly defined a limited partner for purposes of the exception as a partner that has limited liability and “who does not run, manage, or otherwise exert control or managerial authority over the partnership.”³

Limited partner exception

As discussed this December 2023 client alert, the IRC imposes a tax on the self-employment income of individuals, including gross income derived from any trade or business, less allowable deductions attributable to such trade or business, plus the distributive share (whether or not distributed) of income or loss from any trade or business carried on by a partnership of which such individual is a member. However, IRC Section 1402(a)(13) provides an exception for “the distributive share of any item of income or loss of a limited partner, as such,” other than guaranteed payments for services provided to or on behalf of the partnership.

Judicial interpretation of ‘limited partner’

The first decision in a series of cases at the Tax Court involving the limited partner exception was the Tax Court’s November 2023 decision in Soroban Capital Partners LP v. Comm’r.⁴ In Soroban, the Tax Court held that state law limited partners are not per se entitled to the limited partner exception under IRC Section 1402(a)(13). The Tax Court concluded that a functional analysis must instead be applied to determine whether a partner is a “passive investor” entitled to the limited partner exception. In decisions after Soroban, the Tax Court has consistently opined that a functional analysis should be applied – including in Denham Capital Management v. Comm’r⁵ and Sirius Solutions L.L.L.P. v. Comm’r.⁶ Denham has an appeal pending in the First Circuit.

On January 16, 2026, in the appeal for Sirius Solutions, the Fifth Circuit held that the term “limited partner” means a partner who, under state limited partnership law, has limited liability status in a limited partnership (the prior opinion). The government petitioned the Fifth Circuit for rehearing en banc. The Fifth Circuit denied the petition, but on August 12, 2026, the Fifth Circuit withdrew its prior opinion, defined a “limited partner” consistent with its “ordinary public meaning,” at the time of the statutory enactment, and rejected both the Fifth Circuit’s own “limited liability” test and the Tax Court’s “functional analysis” test. The opinion does not clearly describe when participation becomes “significant,” which, similar to the “functional analysis” test, leaves the application of the standard dependent on the partner’s functions and authority. The Fifth Circuit vacated the Tax Court’s decision and remanded the case using the revised reading of the term “limited partner” for purposes of IRC Section 1402(a)(13).

In the appeal for Soroban, the Second Circuit adopted a comparable standard to the Fifth Circuit in Sirius Solutions, concluding that a limited partner is a partner with limited liability who does not run, manage, or otherwise exert control or managerial authority over the partnership. The Second Circuit noted the Fifth Circuit’s holding in Sirius Solutions and said that to the extent that the Fifth Circuit held that “a limited partner may provide some services to the partnership, we do not disagree … [s]o long as the activities in question do not constitute controlling, managing or running the business, a partner may play a role in the partnership and still qualify as ‘limited.’”

While both the Second Circuit and the Fifth Circuit permit limited partners to provide services to the partnership, the “significant participation” standard adopted by the Fifth Circuit in Sirius Solutions is potentially more taxpayer-friendly than the standard adopted by the Second Circuit in Soroban. Both standards are less taxpayer-friendly than the Fifth Circuit’s withdrawn January 2026 opinion and indicate a narrowing limited partner exception. In response to the revised Fifth Circuit standard, the Department of Justice argued in a letter to the First Circuit (in Denham) that under the definition applied by the Fifth Circuit, the First Circuit should uphold the decision of the Tax Court.

Partners of investment managers claiming the limited partner exception should continue to monitor developments in the various circuit courts and continue to assess the application of the exception to their particular situations.

Notes

K Alain, L.L.L.P. v. Commissioner, No. 24-60240, slip op. (5th Cir. Aug. 12, 2026) (per curiam).
165 F.4th 374 (5th Cir. 2026).
Soroban Capital Partners LP v. Commissioner, No. 25-2079, slip op. (2d Cir. Sept. 17, 2026).
Soroban Capital Partners LP v. Commissioner, 161 T.C. 310 (2023).
T.C. Memo. 2024-114.
Docket Nos. 11587-20 and 30118-21 (T.C. Feb. 20, 2024).

Cooley Advised Freshworks on Agreement to Acquire Torii

Mon, 12 Oct 2026 20:53:20 Z

Cooley advised Freshworks, the AI-powered, unified service operations platform that is fast to deploy, intuitive to use, and enables every employee to be more productive, on its agreement to acquire Torii, a software company helping teams turn hidden SaaS and AI activity into governed, accountable operations. The deal extends Freshservice into software management and AI spend governance.

The transaction was announced publicly in this press release.

Sepideh Mousakhani, Jon Gavenman, and Gaël Hagan led the Cooley team advising Freshworks.

Charles Haley, Eileen Marshall, Alessandra Murata, Ross Eberly, Patrick Reed, Novak Topalovic, Seamus Howard, Randy Sabett, Kelley Harrington, David Zhou, Sam Dodson, Jacob Lahana, Tony Guan, Kathryn Sorenson, Joy Chow, Celine Koh, Cristina DeBiase, and Nikki DiFederico provided invaluable support.

Cooley previously advised Freshworks on its Series H financing in 2020, its $1.13 billion IPO in 2021, and on its acquisitions of AnsweriQ, Device42, and FireHydrant, Inc.

Firms Gear Up For Expected Surge In Congressional Probes

Mon, 12 Oct 2026 14:53:34 Z

Cooley partner and leader of the firm's bipartisan congressional investigations practice, Susanne Grooms was quoted in a Law360 article about how many law firms are expanding their congressional investigations practices in anticipation of increased congressional oversight following the 2026 midterm elections. Grooms noted the unique challenges clients face when navigating congressional investigations, including the absence of a neutral arbiter. The article also highlighted the firm's recent addition of Jessica Donlon to the practice.

Read the article (subscription required)

Cooley Lawyers Shortlisted for British Legal Awards

Fri, 09 Oct 2026 18:24:20 Z

Cooley partner James Maton and special counsel Tristan Lockwood were shortlisted for the British Legal Awards 2026, hosted by Law.com. Maton was shortlisted for Partner of the Year, and Lockwood was shortlisted as a Rising Star in the Private Practice category. The awards recognize outstanding achievement by law firms, in-house teams, chambers and individuals across the UK legal profession.

Read the full shortlist

The ceremony will take place in London on November 25, 2026.

Activist Investing Today: Cooley’s Brownridge on AI Activism

Fri, 09 Oct 2026 17:37:00 Z

Cooley partner Sean Brownridge, chair of the firm’s activism defense group discussed with Ron Orol on The Deal’s podcast, Activist Investing Today, the growing role of artificial intelligence in shareholder activism. He highlighted how activists are increasingly evaluating companies through the lens of AI adoption, cost optimization, growth potential and board oversight, while also examining how AI-related opportunities and risks may influence future campaigns and short seller activity. Brownridge noted that companies that can effectively articulate and execute their AI strategy may be better positioned as investors increasingly distinguish between AI leaders and laggards.

Read the article (subscription required)

Cooley Hires DOJ National Security Lawyer, Media Leaks Atty

Fri, 09 Oct 2026 16:09:10 Z

Cooley special counsel Menno Goedman was featured in a Law360 article, highlighting his arrival to the firm's Washington, DC office and global litigation department, where he will focus on complex commercial litigation, internal investigations and national security-related matters. Goedman joins Cooley from the DOJ’s National Security Division, where he spent five years prosecuting national security matters, bringing extensive experience in sanctions, export controls and more.

Ian Shapiro, partner and chair of Cooley’s global litigation department, shared how Goedman’s joining expands the firm’s elite litigation practice.

Read the article (subscription required)

UK Consumer Protection Regime – Lessons From the First Investigations by the UK’s Competition and Consumer Regulator

Fri, 09 Oct 2026 16:00:00 Z

In April 2025, new consumer protection measures under the Digital Markets, Competition and Consumers Act 2024 (DMCCA) came into force. This ushered in a new and significantly enhanced consumer protection enforcement regime administered by the UK Competition and Markets Authority (CMA) which has now been in force for almost 18 months and has not wasted any time in flexing its enforcement muscles. In that period, and across several sectors, the CMA has opened investigations into 19 businesses, issued more than 100 advisory letters, imposed fines of close to £6.2 million and ordered over £1.95 million in consumer redress. Further, the CMA shows no signs of stopping.

In this alert, we discuss key lessons which can be drawn from the first round of investigations and comment on what businesses should expect from the CMA going forward.

The CMA’s new powers

The DMCCA introduced new direct consumer enforcement powers and updated and expanded existing consumer protection prohibitions. Each of these developments is significant in its own right, and we summarised them in our April 2025 alert. Importantly, the CMA is now able to conduct investigations and issue infringement decisions without recourse to the court system (which is now only engaged in the event of an appeal against a CMA decision by the undertaking involved), and notably, is able to impose very significant fines.

As well as introducing a new enforcement approach, the DMCCA also updated the UK’s consumer law powers with various amendments and new prohibitions designed to better reflect the digital economy. As a result, the CMA’s stated current enforcement priorities have targeted three areas: fake reviews, drip pricing and online choice architecture.

Key lessons from recent investigations

The CMA is pursuing significant and aggressive enforcement and is actively monitoring businesses operating in the UK. The CMA has opened investigations into 19 businesses in just under a year across a wide range of sectors, including travel, ticketing, driving schools, gyms, parking, fashion, homeware and technology. In addition, the CMA has issued approximately 160 advisory and warning letters and approximately 50 information notices. At least three of these advisory letters are known to have since led to investigations. The CMA is clearly investing resource in delivering on its promise to act with pace.

It is also evident that the CMA is actively monitoring businesses. With the relevant conduct in most cases being publicly visible online, this is a relatively straightforward task for the CMA, which has developed its own sophisticated data tools allowing it to monitor and screen a wide variety of business practices. Businesses should take note that an advisory letter from the CMA is to be taken seriously and could lead to enforcement action if the CMA identifies through its monitoring that the issues identified have not been swiftly addressed. Key lesson: Businesses would be well advised to investigate quickly (under privilege) when warning letters are received, as prompt action to establish whether or not there is any wrongdoing, and consequential rectification can mitigate risk and level of enforcement.

Getting it wrong leads to meaningful fines and consumer redress is a key feature of the enforcement matrix. Out of the 19 investigations opened, three have concluded via the CMA’s settlement route. The CMA’s settlement procedure offers a reduction in the fine of up to 40% in exchange for an admission of liability and full cooperation. Notwithstanding this discount, fines have run into the millions of pounds and, in each case, the settlement included a consumer redress scheme to refund those affected by the relevant conduct.

The AA and BSM Driving Schools: Redress of £760,000 to affected learner drivers and a total fine of £4.2 million for engaging in drip pricing. The CMA’s investigation found that, between April and December 2025, more than 80,000 learner drivers were not shown the total price upfront when booking driving lessons online, as a mandatory booking fee was only included later in the booking process.
Marks Electrical: Redress of £600,000 to affected consumers and a fine of £720,000 in relation to online choice architecture where consumers were automatically opted in to certain services without their consent.
StubHub UK: Redress of £590,000 to affected consumers and a fine of £889,200 in relation to failing to include mandatory fees in the price of tickets shown at the beginning of the sales process (‘drip pricing’).

In addition, in February 2026, the CMA imposed a £473,000 penalty on Euro Car Parks for failure to respond to an information request. This was the first procedural penalty under the new regime and was imposed before the CMA had opened a formal investigation into the company. While the penalty remains under appeal, the CMA has since opened a full investigation into Euro Car Parks to examine whether its practices at petrol stations and its wider appeals process are in breach of UK consumer protection law. Key lesson: The CMA is open to settling these matters, but the reality is that it is not settlement in the way that companies might be used to in ordinary commercial litigation. It is highly procedural, involves an open admission of liability and the settled fines still remain notable.

Consumer enforcement takes priority. The CMA’s enthusiasm to use its new powers is matched by the current government’s focus on cost of living and doorstep issues. As a result, the CMA is now seemingly prioritising consumer over competition law enforcement. In its 2026 annual plan (which we wrote about in April 2026), the CMA indicated that this would be the case. This objective has been supported by aggressive enforcement in practice and significant investment in expanding the consumer enforcement team. To date, the CMA has launched only two antitrust investigations using its powers under the Competition Act 1998 (CA98) during 2026, which stands in stark contrast to the 19 consumer law investigations launched by the CMA since November 2025. Key lesson: Your commercial practices are under the spotlight, and proactive compliance should be seen as a key risk mitigation tool.

The CMA is investigating a broad array of practices. Whilst most cases opened to date fall within its priority areas (fake reviews, drip pricing and online choice architecture), the CMA is also looking at a broader range of consumer protection issues. Other investigations include whether early cancellation fees are unfair and misleading, changes to subscription terms and conditions, time-limited promotional offers and unfair fees. Key lesson: All businesses selling goods and services to consumers should consider themselves in scope.

Being small is no defence. The CMA is not focused only on the largest businesses or any particular sector. Its enforcement targets span a wide range of sectors and business sizes ranging from large US technology companies to smaller UK businesses and small and medium-sized enterprises (SMEs). Key lesson: Compliance matters regardless of size.

Quick resolutions and high case throughput. The CMA has been explicit that it will aim to conduct investigations with pace, prioritising cases that establish precedent and create a deterrent effect in order to promote both business confidence and consumer trust. So far, it seems to be delivering on its promise.

In contrast, a recent UK High Court judgment brought to a close a four-year enforcement case against Emma Matratzen GmbH (Emma Sleep) conducted under the CMA’s previous enforcement powers. The case principally concerned the use of recommended retail prices (RRPs) and ‘was’ pricing and regularity of promotions. While Emma Sleep settled and/or admitted certain elements of the case, the CMA lost on the ratio between products Emma Sleep had to sell at full price versus those it could sell at a discount, with the High Court finding that the CMA’s approach to reference pricing was unjustified and unworkable. The case is, for the time being, damaging to the CMA’s ability to pursue reference pricing breaches and it is to be expected that the CMA will seek to close cases by way of settlement to avoid other cases moving to protracted appeals with the risk of unhelpful precedents. Key lesson: If you are involved in an investigation, you can expect matters to move much more quickly than traditional court proceedings.

Greater CMA focus on consumer protection is consistent with other regulators and a global approach to compliance is recommended. In general, we see heightened and similar activity by consumer regulators in other jurisdictions, focusing largely on the companies’ online activities. In particular, certain of the UK’s new provisions are similar to Section 5 of the , which bans business practices that cause harm to, or are likely to mislead, consumers, supplemented by narrower federal statutes such as the Restore Online Shoppers’ Confidence Act (ROSCA) for subscription/negative-option features, which we have written about here. Whilst the FTC, unlike the CMA, does not have direct enforcement powers, consumer law compliance programmes for international businesses – particularly those with common online interfaces and promotional mechanics – should be developed from a global viewpoint.

We are also anticipating an enhanced regime in the EU where the Digital Fairness Act will look to build upon the existing consumer protection measures around unfair commercial practices, and, similar to the DMCCA, look to bring them up to date with the digital economy. Whilst no draft legislative text has been tabled as yet, when it does appear, it is anticipated that it will cover dark patterns, addictive design, personalised decision-making and pricing, influencer marketing, protection of minors and vulnerable consumers, and will enhance current enforcement measures. Key lesson: This is a global issue, and businesses will need to look at compliance top down and bottom up.

Looking ahead – Future enforcement priorities and next steps

The CMA has signalled that in year two of its enforcement of the DMCCA, which we are now in, it will focus its enforcement efforts on the following areas:

Subscription contracts: New rules around subscription contracts are expected to come into force in January 2027 as part of the government’s series of ‘everyday fixes’ to help UK consumers with the cost of living, with guidance to be issued around a similar time. Businesses will need to provide clearer information upfront, regular reminders and an easier exit. The CMA expects businesses to comply with the new rules as and when they come into force. We anticipate that the CMA is already actively monitoring businesses now with a view to launching investigations as soon as the new powers come into force.
Price transparency: Businesses are advised not to use ‘dripped’ or unlawful partitioned pricing. Any claims in relation to discounts must be true and not misleading.
Fake reviews: The CMA expects businesses to have “robust policies” in place, so reviews give consumers a good and honest indication of what others are saying (and businesses are expected to enforce and implement these policies)
Terms in contracts with consumers: Businesses should review their terms against the CMA’s revised guidance to ensure their terms are fair and transparent. This is especially relevant if contracts impose exit fees on consumers.
The use of AI, including agents: Specific focus is also placed on how businesses use AI, including AI agents. We wrote about this in March 2026.

These developments are set against a wider legislative picture whereby the UK government is expected to launch a consultation in the autumn of 2026 to assess whether false or misleading “was” prices and RRPs should be added to the list of automatically banned practices under the DMCCA. These practices are currently not on the list of practices that are always considered unfair in the DMCCA. Instead, they require an assessment of whether the prices are misleading and have caused a consumer to take a transactional decision that they would not have otherwise taken, but given the adverse ruling in the Emma Sleep case, we may see these practices added to the list.

Whilst enforcement action is ramping up, the impact for current or prospective defendants of investigations remains to be seen – particularly, whether we will see follow-on damages actions and/or if the government chooses to expand the opt-out class action regime to cover consumer law breaches in the same way as it applies to the competition regime.

Overall, compliance with consumer protection regimes is a multidisciplinary effort requiring coordination from legal, engineering, marketing and audit against increasingly complex and fragmented international laws and regulations. Businesses are advised to review compliance for each step of the consumer’s journey – from marketing through to post-sale services – and assess compliance from a global viewpoint.

The Cooley team continues to monitor these developments closely. If you would like to speak to someone about your compliance with UK or global consumer protection regimes, please contact a member of the Cooley team listed below.

CMA Fines Individual Employees for Concealing Evidence During Dawn Raid

Fri, 09 Oct 2026 13:50:03 Z

On 24 September 2026, the UK Competition and Markets Authority (CMA) published decisions imposing financial penalties for concealing evidence during a dawn raid on a senior employee (£20,000), an office manager (£5,000) and their employer, M&J Group Construction & Roofing (£25,000).

These are the first civil penalties imposed by the CMA directly against individuals for concealing evidence during a dawn raid. This is a significant development and represents a warning to individuals that failing to cooperate with the CMA during a dawn raid can have significant personal consequences (not just consequences for their employer).

They follow the £473,000 fine imposed on Euro Car Parks by the CMA for failing to respond to an information notice issued under its consumer law enforcement powers earlier this year, and represent further evidence that the CMA will not tolerate any interference with their investigatory powers.

What happened?

On 10 December 2024, the CMA attended M&J’s premises with a warrant to conduct a search as part of an investigation into suspected bid-rigging in the supply of roofing and construction services. Upon arrival, it provided the usual warnings not to obstruct the inspection, conceal or destroy documents, or provide false or misleading information.

Despite these warnings, Barry Pirrie (M&J’s estimating director) instructed Tracey Woods (the office manager) to remove a work mobile phone and paperwork from the premises, which she did shortly after the CMA’s arrival at 8:35 am. Pirrie then repeatedly told the CMA that he had no work mobile phone.

At around 4:00 pm the same day, M&J’s external lawyers handed the concealed materials over to the CMA. The CMA later found that these materials contained a significant amount of evidence relevant to the underlying bid-rigging investigation, including evidence of Pirrie’s direct involvement in that conduct.

The penalty imposed

The CMA has the power to impose a financial penalty of up to £30,000[1] on any “person” (which includes both companies and individuals) who, without reasonable excuse, fails to comply with a requirement imposed under section 28 (search under a tribunal warrant).

In this case, the CMA concluded that the following fines were appropriate:

Pirrie – £20,000
Woods – £5,000
M&J – £25,000

In each case – although the fine was below the statutory maximum – it was significant, and in the case of Pirrie and M&J near the top end of the available fining range. This reflects how seriously the CMA views this conduct. The CMA cited the following factors in support of its decision to impose fines of this magnitude:

Adverse impact on the investigation – given the risk that potentially incriminating evidence could have been lost or tampered with once it left the CMA’s control
Significant and flagrant conduct – removal of materials; Pirrie’s false statements were intentional, not merely negligent
Seniority and personal advantage – Pirrie, as a department head reporting directly to the CEO with 10 to 15 direct reports, was found to have sought a personal advantage by concealing evidence of his own involvement in the underlying bid-rigging
Diversion of CMA resources – officers had to pause the search to track the movement of staff and materials, review CCTV, search a vehicle and interview witnesses
Need for deterrence – including in respect of junior employees following instructions
In respect of Woods, her more junior, administrative role, her lack of involvement in the underlying bid-rigging conduct, her lack of premeditation, and her personal financial circumstances all reduced her penalty relative to Pirrie’s; despite these mitigating factors, the CMA concluded that a financial penalty was merited which serves as a cautionary tale that even junior employees are acting on the directions of their superiors can be found liable.

How does this compare with the CMA’s wider approach to inspections?

Although this is the first time the CMA has imposed financial penalties on individuals for failing to comply with a dawn raid, this is not the first time the CMA has imposed a penalty on a company in those circumstances. In 2019, the same £25,000 penalty was imposed on Fender when an employee removed multiple notebooks from the premises during a dawn raid.[2]

The CMA is not alone in taking a strict approach to noncompliance. At the European Union level, the European Commission’s IFF decision (Case AT.40882) reflects a similar approach. There, a senior employee deleted WhatsApp messages during a dawn raid and failed to disclose the deletion. As with M&J, the European Commission treated the conduct as a serious intentional obstruction – the same factors (seniority, intent and post-discovery conduct) featured prominently in the penalty assessment which resulted in a fine of €15.9 million being imposed on the company involved.

Practical steps companies should consider to mitigate risk in the event of a dawn raid

The M&J financial penalties further demonstrate the importance of ensuring that protocols are in place for how to manage a dawn raid and that staff have received appropriate training to minimise the risk both to those individuals and to the business as a whole.

We recommend that all companies take the following steps to mitigate risk in the event that they are targeted by a dawn raid:

Pressure-test dawn raid protocols before, not during, an inspection and ensure that appropriate dawn raid training has been carried out. In particular, it is important that all staff are aware that a dawn raid should be taken seriously. Failure to comply can have consequences not just for the company but also for them on a personal level.
Ensure that document retention procedures are available and have been rehearsed and can be swiftly and effectively implemented in the event of a dawn raid.
Keep a record of devices held by employees that are used for work purposes.

How Cooley can help

The first hour of a dawn raid can determine the outcome of any enforcement action. Cooley helps clients stress-test dawn raid protocols, train key personnel and navigate inspection-related risks before they become enforcement issues.

[1] This conduct occurred in December 2024 but note that – since 1 January 2025 – the CMA’s fining power has been expanded to allow the CMA to exceed the £30,000 cap in respect of companies provided the fine does not exceed 1% of turnover. The CMA also has the power to impose a daily fine for ongoing noncompliance but that did not apply in this case as the concealed documents were concealed on the same day.

[2] Fender Musical Instruments Europe Ltd (Case 50565-3, 20 March 2019).

SEC Report on Climate Action 100+ Signals Broader Scrutiny of Coordinated Shareholder Voting

Fri, 09 Oct 2026 07:00:00 Z

On October 7, 2026, the Securities and Exchange Commission (SEC) issued a report of investigation under Section 21(a) of the Securities Exchange Act of 1934 addressing the activities of Climate Action 100+ (CA100) and certain of its members in connection with the 2021 contested director election at ExxonMobil.

The SEC determined not to pursue an enforcement action based on the conduct known to it at this time and made no findings of violations. The report is nevertheless a significant warning to institutional investors and other shareholders that coordinated engagement, including voting activity, even if organized through an intermediary, may implicate beneficial ownership reporting requirements under Sections 13(d) and 13(g).

The report also comes amid broader regulatory pressure on coordinated shareholder voting and the proxy voting ecosystem. One important question to watch is whether the SEC applies similar theories to proxy advisory firms, particularly given the White House's December 2025 executive order expressly directing the SEC to analyze whether proxy advisers may serve as vehicles through which investment advisers coordinate their voting decisions and form a “group” under Sections 13(d) and 13(g). That question is especially timely given the SEC’s ongoing subpoena-enforcement action against ISS seeking data relating to its proxy recommendations and votes.

Key takeaways

No enforcement action, but a clear warning. The SEC’s investigation raised serious concerns, and the SEC used the report to provide guidance for investors participating in similar organizations. Coordinated action prompted by an intermediary’s pressure on members to align regarding the acquisition, holding, disposition or voting of securities may provide circumstantial evidence of an agreement or understanding sufficient to create a “group” as determined under Sections 13(d)(3) and 13(g)(3).
Disclaimers alone are not enough. Investors may reserve independent voting discretion and disclaim “group” status, but the SEC emphasized that actual conduct controls. At the same time, parallel voting, ordinary-course communications, independent voting decisions and passive receipt of an activist solicitation do not, standing alone, establish a “group.”
Schedule 13G eligibility presents a separate risk. Even if investors have not formed a “group,” a qualified institutional investor or passive investor holding more than 5% may lose eligibility to report on Schedule 13G if its activities have the purpose or effect of changing or influencing control of the issuer. The report suggests that this analysis can extend beyond a director contest to coordinated efforts targeting specific management or policy outcomes.
Proxy advisers are a natural area to watch. The report repeatedly focuses on intermediaries that organize investors around shared objectives and voting outcomes. That framework closely tracks the December 2025 executive order, which specifically directed the SEC to consider whether a proxy adviser can facilitate coordination among investment advisers sufficient to create a “group” as determined under Sections 13(d)(3) and 13(g)(3).

What happened at ExxonMobil?

CA100 is an investor coalition organized around climate-related engagement with designated public companies. According to the report, CA100 identified focus companies, designated lead investors to engage with those companies, and developed a process for “flagging” shareholder proposals – and, ultimately, director elections for member support.

ExxonMobil became a particular focus. Following disputes over climate-related shareholder proposals, CA100 participants developed a strategy that contemplated a “board refresh.” In 2021, Engine No. 1 launched a proxy contest seeking to elect four directors to ExxonMobil’s board. CA100 subsequently changed its procedures to permit the flagging of director elections and flagged the ExxonMobil vote. The SEC examined communications and interactions among CA100, Ceres, Engine No. 1 and institutional investors, including BlackRock and State Street, in considering whether investors’ activities reflected coordinated voting rather than independent decision-making.

The SEC ultimately did not bring an enforcement action. But it concluded that coordinated activities of this type may provide circumstantial evidence of an implied agreement to act together, particularly where an intermediary seeks to align investors’ votes, applies pressure to investors whose voting does not align with the coalition’s objectives or otherwise facilitates collective action directed at a particular issuer.

Two distinct beneficial ownership issues

The report emphasizes that “group” formation and Schedule 13G eligibility are separate inquiries.

First, two or more investors can form a “group” under Sections 13(d)(3) and 13(g)(3) through an express or implied agreement, arrangement, understanding or concerted action concerning the acquisition, holding, disposition or voting of securities. If the “group” collectively beneficially owns more than 5% of a covered class, beneficial ownership reporting obligations may arise. Formation of a “group” is a facts-and-circumstances inquiry and can be established through circumstantial evidence; a written agreement is not required.

Second, a qualified institutional investor or passive investor generally may use Schedule 13G only if the securities were not acquired or held with the purpose or effect of changing or influencing control of the issuer. Participation in an organization focused on replacing directors is an obvious area of concern, but the report goes further: Even absent a board refresh campaign, membership coupled with commitments and actions aimed at specific management or policy outcomes may call Schedule 13G eligibility into question.

The report also flags potential consequences from intermediary funding arrangements. In appropriate circumstances, funding routed through an intermediary could raise issues under Rule 13d-3(b)’s anti-evasion provision, which permits beneficial ownership to be imputed where an arrangement is used to circumvent the reporting requirements of Sections 13(d) or 13(g). The SEC did not find such an arrangement with respect to Engine No. 1, but expressly warned that intermediaries cannot be used to shield coordinated activity and influence from disclosure requirements imposed by the beneficial ownership reporting requirements under Sections 13(d) and 13(g).

Separately, the report flagged whether funding channeled through CA100 or Ceres to support Engine No. 1’s solicitation could have made BlackRock or other contributing CA100 members “participants” in that solicitation under Schedule 14A, a status that itself would trigger disclosure obligations under the proxy rules. The report found no evidence of direct funding to CA100 by the asset managers investigated, noting only routine membership dues paid to its investor network, but did not take a view on whether this exposed those members to participant disclosure obligations under Schedule 14A.

What to watch: Could proxy advisers be next?

The report may be most consequential for what comes next. Its focus on organizations that act as hubs for coordinated shareholder engagement overlaps directly with ongoing scrutiny of ISS, Glass Lewis and the broader proxy voting ecosystem.

In December 2025, the White House directed the SEC to analyze specifically whether a proxy adviser can serve as a vehicle through which investment advisers coordinate and augment their voting decisions and thereby form a “group” under Sections 13(d)(3) and 13(g)(3). The executive order also directed the SEC to scrutinize proxy adviser recommendations under the anti-fraud rules, consider additional transparency and registration requirements, and examine investment advisers’ reliance on proxy advice.

The report does not address proxy advisers, and ordinary use of a common proxy adviser does not necessarily mean that investors have agreed to act together. Indeed, the SEC’s emphasis on actual coordination, rather than mere parallel conduct or independently reached voting decisions, is an important limitation on the theory.

Still, the report gives the SEC a detailed analytical framework for examining intermediary-facilitated voting coordination at a time when the administration has already directed it to investigate substantially the same issue in the proxy adviser context. How, and whether, the SEC connects those dots will be an important development to watch heading into the 2027 proxy season.

For public companies, one practical consequence may be more guarded investor engagement. Only last month, SEC staff issued new corporation finance interpretations (CFIs) clarifying that an investor does not, without more, lose Schedule 13G eligibility by participating in issuer-requested discussions about voting decisions or by discussing its views with a person conducting a proxy solicitation. The report pulls in the other direction by emphasizing the risks of coordinated conduct and intermediary-facilitated engagement. Qualified institutional investors and passive investors may therefore become more cautious about engaging in contested or high-profile situations, even when companies themselves are seeking dialogue, potentially making shareholder outreach less candid and predictable heading into proxy season. Companies should also be alert to the beneficial ownership and proxy solicitation disclosure questions that arise where multiple investors appear to be acting through an intermediary or common coalition.

Cooley Advised BÉIS and Majority Stakeholder Beach House Group on BÉIS’s $210 Million Acquisition By Samsonite

Thu, 08 Oct 2026 19:03:47 Z

Cooley advised BÉIS, a leading lifestyle and travel brand founded in 2018 by actress and entrepreneur Shay Mitchell, and Beach House Group, BÉIS’s majority stakeholder, in connection with Samsonite’s acquisition of BÉIS with an enterprise value of approximately $210 million.

The transaction was announced publicly in this press release.

Dave Young, Tim Nguyen, James Allen, Lewis Loy, Jason Rooindej, Leila Kazerouni, Amalia Jaeck, and Meghana Bhimarao led the Cooley team advising BÉIS and Beach House Group.

Ellie Seber, Winda Fung, and Stevie Yu provided invaluable advice.

Cooley previously advised Beach House Group, the Los Angeles-based beauty incubator behind BÉIS, Pattern Beauty, Noyz, Moon, Florence By Mills and other breakout consumer brands, on a number of financing and other corporate matters.

Cooley Collaborates With Google Cloud to Develop AI Agent for Complex Litigation

Thu, 08 Oct 2026 17:03:12 Z

New York – October 8, 2026 – Cooley today announced a collaboration with Google to develop a new Gemini Enterprise AI agent using Google Cloud technologies to help lawyers review court filings for confidential information and prepare proposed redactions.

Redacting court filings to protect confidential information can consume days of lawyers’ time reviewing documents and identifying sensitive information, with little margin for error. Built on Google Cloud’s Gemini Enterprise, the new agent recommends targeted redactions of personally identifiable information (PII), technical information and other potentially confidential material for attorney review. Attorneys make all determinations about what should be redacted before the filing is submitted to the court. The tool is intended to expedite the review while keeping legal judgment firmly with the lawyers handling the matter.

The collaboration brings together Google Cloud’s trusted, enterprise-ready AI platform with the experience of Cooley’s elite global litigation practice. Cooley is the launch partner for this agent, providing product direction and ongoing feedback from litigators to help engineers design the workflow around the practical demands of complex litigation. The use case grew out of challenges encountered in real-world experience.

“Cooley has long collaborated with Google as litigation counsel,” said Ian Shapiro, chair of Cooley’s global litigation department. “And, as Cooley now endeavors to develop the AI-powered workflows that will enable us to litigate for our clients more effectively and efficiently, we are fortunate to be able to collaborate with Google’s exceptional team.”

“The most effective AI tools are built by validating technology against demanding, real-world use cases,” said Satish Thomas, vice president at Google Cloud. “Testing our agents in real-world environments with Cooley’s highly skilled team ensures we are solving genuine workflow challenges with the depth, speed and precision legal professionals require.”

The agent remains in development and is one of a growing number of AI-enabled tools and workflows Cooley is exploring and developing across the firm. It reflects Cooley’s broader approach to AI: pairing legal and industry acumen with leading technology to address practical client and lawyer needs, with attorney judgment at the center.

California Amends ‘Stay or Pay’ Law to January 1, 2027, and Expands Exceptions

Thu, 08 Oct 2026 07:00:00 Z

California recently enacted AB 1697, delaying by one year the operative date of AB 692, California’s law restricting “stay or pay” provisions, and expanding its exceptions.

Background

As described in a November 2025 alert, AB 692 applies to contracts entered into on or after January 1, 2026, and prohibits provisions requiring a California worker to repay a “debt,” or imposing any other penalty, fee or cost, upon termination of employment. A key exception covers discretionary or unearned payments made at the outset of employment that are not tied to job performance (e.g., sign-on or relocation bonuses), provided they meet certain conditions – including that the repayment terms appear in a separate contract, and the worker is notified of the right to consult an attorney and given at least five business days to do so.

Employers that violate the law face liability for actual damages or $5,000 per worker, whichever is greater, plus injunctive relief and attorneys’ fees and costs. Workers may bring claims on behalf of themselves and similarly situated workers.

What has changed

Delayed effective date

AB 1697 moves AB 692’s operative date to January 1, 2027, giving employers, in the legislature’s words, “an additional year to structure their employment contracts free of debt traps or quit fees that penalize workers who choose to exercise their freedom of employment.” AB 1697 also makes AB 692 inoperative from January 1, 2026, through December 31, 2026, so no liability accrues for that period, and any pending claim based on conduct during that window is moot.

Modified bonus exception

AB 1697 makes substantive changes to the discretionary or unearned bonus exception. Significantly, it removes the requirement that the bonus be paid “at the outset of employment,” so qualifying bonuses paid at any point during employment may now fit within the exception, provided they still meet the following conditions:

Repayment terms are contained in a contract separate from the employment contract
The worker is notified that they have the right to consult an attorney regarding the agreement and given at least five business days to do so.
Any repayment obligation is prorated based on the remaining term of any retention period (not to exceed two years) and is not subject to interest accrual.
The worker can defer receipt of payment to the end of a fully served retention period without any repayment obligation.
Separation from employment before the retention period is at the worker’s sole discretion, or at the employer’s election due to worker misconduct.

Advanced PTO payments exception

AB 1697 also adds a new exception for repayment obligations that arise from a worker’s voluntary separation, where the obligation relates to an advanced paid time off (PTO) payment exceeding the worker’s accrued balance. To qualify, the exception requires that:

The repayment terms are disclosed to the worker, separately from the primary employment contract, upon the worker's request for the advanced PTO payment.
The repayment obligation does not exceed 40 hours of accrued PTO.
The repayment obligation is not subject to interest accrual.

What hasn’t changed

The underlying prohibitions, the definition of “debt” and other existing exceptions (including the transferable-credential tuition exception) remain unchanged, as do the civil remedies for violations (actual damages or $5,000 per worker, whichever is greater, plus injunctive relief and attorneys’ fees and costs).

Next steps

The delay gives employers additional time to bring repayment arrangements into compliance. Employers should use this time to review and revise bonus and retention arrangements, train relevant teams on the updated law, and stay alert to similar restrictions in other jurisdictions, such as New York and Washington.

If you have any questions about these laws or how to comply, please contact your Cooley employment lawyer or one of the lawyers listed below.

CMS Seeks Comments on RAPID Medicare Pathway for Breakthrough Devices

Thu, 08 Oct 2026 07:00:00 Z

In August 2026, the Centers for Medicare & Medicaid Services (CMS) announced a notice with comment period (notice) providing information on the process CMS proposes to use to facilitate Medicare national coverage determinations (NCDs) under the Regulatory Alignment for Predictable and Immediate Device (RAPID) coverage pathway.¹ CMS describes the proposed RAPID coverage pathway as a voluntary process designed to provide accelerated Medicare beneficiary access to certain eligible Class II and Class III US Food and Drug Administration (FDA) breakthrough-designated devices (BDDs). The notice provides an opportunity for stakeholders to provide feedback on the proposed RAPID coverage pathway, with comments due on October 13, 2026.

RAPID reflects CMS’s latest effort to address stakeholder concerns that Medicare coverage of medical devices lags behind FDA market authorization. CMS has indicated that this lag may result, at least in part, from frequent underrepresentation of Medicare beneficiaries in the pivotal studies that support FDA marketing authorization determinations. In the notice, CMS states that “it is difficult for CMS to make an evidence-based decision on whether [a] device is reasonable and necessary” under the statutory standard for Medicare coverage if the device’s supporting clinical evidence does not adequately reflect the Medicare population. ²

Prior CMS efforts to address these concerns include the now-repealed 2021 Medicare Coverage of Innovative Technology (MCIT) final rule and the Transitional Coverage for Emerging Technologies (TCET) pathway established in 2024. CMS states in the notice that the “TCET pathway will be paused for new candidates upon publication of this notice with comment period as CMS focuses on the successful implementation of the RAPID coverage pathway.”³

The notice seeks input on several aspects of the proposed RAPID coverage pathway, such as eligibility criteria, procedural considerations and roles for participants, including manufacturers, FDA, CMS and the Agency for Healthcare Research and Quality (AHRQ).

Proposed eligible devices

CMS proposes that the RAPID coverage pathway would be available only for certain BDDs. Specifically, CMS proposes that eligible devices generally must be one of the following:

Presumptive Class II FDA BDDs participating in FDA’s Total Product Life Cycle Advisory Program (TAP) and planning to submit a de novo request to FDA.
Class III BDDs planning to submit a premarket approval (PMA) application, regardless of TAP participation.

CMS further proposes that, in either case, the device must be in the investigational device exemption (IDE) pre-submission stage, and the manufacturer must plan to conduct an IDE study that enrolls Medicare beneficiaries and evaluates clinical outcomes agreed upon by both FDA and CMS. In particular, the IDE study would be required to evaluate clinical outcomes that FDA determines are appropriate for the device and CMS confirms would provide evidence demonstrating that the device “improves health outcomes for Medicare beneficiaries.”⁴

CMS proposes that otherwise eligible devices would be ineligible for the RAPID coverage pathway if any of the following factors applied:

Based on the information available, there is evidence indicating the device will not fall under a Medicare benefit category.
The device is already the subject of a controlling Medicare NCD.
The device is not a separately payable device that could, if approved, be billed to Medicare.
The device is otherwise excluded from coverage through law or regulation.
The device is an in vitro diagnostic (IVD), such as a diagnostic laboratory test.⁵

On IVD products, CMS states that IVDs are a “highly specific area of coverage policy development,” and that the agency has historically delegated the review of many IVD products to specialized Medicare administrative contractors (MACs).⁶ CMS states its view that the majority of coverage determinations for IVDs that are BDDs “should continue to be determined by the MACs through existing pathways,” and that IVD products therefore “will not be accepted into the RAPID coverage pathway.” ⁷

Regarding the proposed criterion that eligible devices must be in the IDE pre-submission stage, CMS specifically solicits feedback on whether it should establish a temporary process under which devices that have already progressed beyond the IDE pre-submission stage and are currently being studied under an IDE could become eligible for the RAPID coverage pathway. CMS states that, as part of this potential process, CMS and FDA would assess whether ongoing IDE studies evaluate clinical health outcomes that both agencies “have agreed are appropriate to assess the health benefits to the Medicare beneficiary population,” or whether modifications to those studies would be needed to support such assessment.⁸ CMS is seeking input on whether such a process should be established and, if so, how long it should remain available.

Stakeholders with views on the proposed eligibility criteria for RAPID are encouraged to provide input to CMS through public comments.

Proposed key features of RAPID

As outlined in the notice, RAPID would be a voluntary pathway intended to provide manufacturers with “information on the specific health outcomes needed to support Medicare NCDs much earlier in the process,” before FDA market authorization, such that the clinical evidence generated to support FDA review could also support a Medicare coverage decision. ⁹

Key proposed features of the RAPID coverage pathway under the notice include:

Development stage coordination. FDA and CMS would work together, along with the manufacturer, during IDE pre-submission to agree on the clinical health outcomes the IDE study would evaluate. Those outcomes would be intended to support FDA review and provide evidence demonstrating that the device “improves health outcomes for Medicare beneficiaries” to support a CMS coverage determination.
Accelerated NCD timing. If the completed IDE study showed that the device improves the agreed-upon health outcomes for Medicare beneficiaries, CMS would issue a proposed NCD on the same day as FDA market authorization, with a final NCD to be issued as early as 60 days later for Class II devices and 90 days later for Class III devices. Additionally, CMS proposes “to prioritize the opening of RAPID NCDs over non-RAPID NCDs from the NCD Wait List” if CMS is unable to address the total volume of NCDs with its available resources at any given time.¹⁰ This proposal creates timing implications for both RAPID and non-RAPID NCDs.
Potential requirement for further evidence development. The notice states that CMS may issue proposed NCDs for the RAPID pathway under the Coverage with Evidence Development (CED) framework. While many NCDs involve determinations pursuant to Medicare’s “reasonable and necessary” coverage standard under section 1862(a)(1)(A) of the Social Security Act (SSA), CMS also has issued several NCDs under section 1862(a)(1)(E) of the SSA, which CMS describes as supporting the CED pathway under which “Medicare provides coverage for certain promising technologies that have limited supporting evidence.”¹¹ NCDs issued under the CED framework specify that Medicare coverage is available only in the context of CMS-approved clinical research studies, which CMS reviews in collaboration with AHRQ. For RAPID, CMS proposes that it may issue a proposed NCD under the CED framework if there is “insufficient evidence” to support Medicare coverage under SSA section 1862(a)(1)(A).¹² The notice indicates that the degree to which the device improves health outcomes and the relative risk of the device would determine whether further evidence development (i.e., CED) would be part of the NCD.¹³
Voluntary exit. CMS proposes that manufacturers may withdraw from the RAPID pathway at any point before a proposed NCD is issued, and that FDA and CMS also may determine that the RAPID pathway is no longer appropriate.

Proposed stages of the RAPID coverage pathway

CMS describes the RAPID coverage pathway as unfolding in three stages. Below is an overview of the proposed steps and roles of manufacturers, FDA and CMS at each stage:

Stage 1: IDE pre-submission

Manufacturer: Expresses interest in RAPID to FDA before IDE pre-submission and then participates in a RAPID kick-off meeting with FDA and CMS to discuss the proposed IDE study design.
FDA: Screens the device against RAPID eligibility criteria and consults with CMS on benefit category and coverage eligibility considerations. Participates in the kick-off meeting and provides formal written feedback on the IDE study protocol.
CMS: Conducts a preliminary benefit category analysis and consults with FDA. Participates in the kick-off meeting and provides written feedback on whether the proposed health outcomes would be sufficient to support a future NCD.

Stage 2: Formal IDE submission

Manufacturer: Submits the IDE application to FDA and addresses study design considerations identified by FDA and CMS. After FDA approves a revised protocol (if needed), submits the IDE protocol to CMS for approval.
FDA: Reviews the IDE application through its normal process. Issues a decision letter, including any study design considerations, and shares it with CMS.
CMS: Reviews the IDE protocol under its existing IDE review process. If approved, issues a letter confirming its intent to issue a proposed NCD concurrently with FDA market authorization.

Stage 3: Transition from IDE to coverage

Manufacturer: Conducts the IDE study and submits marketing application to FDA. If electing to proceed with RAPID, submits a formal NCD request cover letter to CMS.
FDA: Shares the IDE final study report with CMS. Reviews and authorizes (if approved) the marketing application.
CMS: On the day of FDA market authorization, posts a proposed NCD and opens a 30-day comment period. Targets a final NCD on the 60- or 90-day timeline described above, depending on the FDA class of the device. If CMS believes evidence gaps remain, CMS may issue the NCD under the CED framework. Throughout all proposed stages of the RAPID coverage pathway, CMS would communicate and coordinate with manufacturers, FDA and (for potential CED) AHRQ.

Considerations for stakeholders

RAPID represents CMS’s third attempt in five years to close the timing gap between FDA market authorization and Medicare coverage for innovative devices, following the now-repealed MCIT final rule and the now-paused TCET pathway. Unlike MCIT, which would have provided automatic, time-limited national coverage upon FDA market authorization without requiring Medicare-specific evidence, RAPID takes a fundamentally different approach: It requires manufacturers to build Medicare-relevant clinical outcomes into their IDE studies from the outset, coordinating with both FDA and CMS well before market authorization. This front-loaded evidence requirement means manufacturers that participate successfully may secure a final NCD within 60 to 90 days of FDA authorization, but it also demands a significantly earlier and more sustained investment in the CMS engagement process than prior pathways contemplated.

Several practical considerations stand out for manufacturers evaluating whether to participate:

Timing and development stage. Because RAPID eligibility is generally limited to devices still at the IDE pre-submission stage, manufacturers that have already progressed further in their IDE studies may face a narrow window, or none at all, to participate. Manufacturers should assess where their device programs currently stand and consider whether the potential temporary process for devices that have already progressed beyond IDE pre-submission could apply to their products. Companies with devices at early development stages should begin evaluating RAPID’s potential fit now, since the pathway requires engagement with both FDA and CMS before IDE submission.
IDE study design implications. RAPID requires IDE studies to evaluate clinical outcomes agreed upon by both FDA and CMS – specifically, outcomes that CMS confirms would demonstrate that the device “improves health outcomes for Medicare beneficiaries.” This dual-agency alignment requirement may necessitate adjustments to study populations, endpoints, study duration or sample sizes beyond what FDA alone would require. Manufacturers should factor in the additional time and cost of designing studies that satisfy both agencies’ expectations, including ensuring adequate enrollment of Medicare-eligible populations.
Comment opportunity. Because RAPID is still at the proposal stage, manufacturers and other stakeholders have a meaningful opportunity to shape the potential final pathway through comments due October 13, 2026. CMS has specifically requested feedback on several open questions, including whether to establish a temporary process for devices beyond the IDE pre-submission stage, how long such a process should remain available, and other aspects of the proposed eligibility criteria and procedures. Stakeholders are encouraged to submit detailed comments addressing the aspects of the proposal that affect their device programs and the broader policy questions CMS has raised.

Cooley’s life sciences and healthcare regulatory team closely monitors FDA and CMS regulatory developments and actively works with clients navigating FDA approval pathways, CMS coverage strategies, IDE study design and policy development opportunities. For assistance evaluating the RAPID coverage pathway or preparing comments on the notice, please contact the authors listed below.

Notes

91 Fed. Reg. 51710 (Aug. 11, 2026).
Id. at 51712.
Id. at 51718.
Id. at 51714.
Id.
Id.
Id. CMS adds that, “[i]n the rare case where manufacturers and CMS agree that an NCD is appropriate for an IVD product, manufacturers may submit an NCD request” under the regular NCD request process. Id.
Id. at 51715.
Id. at 51713–51714.
Id. at 51718.
Id. at 51711.
Id. at 51716.
Id. at 51714.

Legal Uncertainty Facing Energy Companies

Wed, 07 Oct 2026 16:04:24 Z

Mona Dajani, partner and co-chair of Cooley’s infrastructure, energy and real estate practice, was quoted in Politico’s Morning Energy newsletter on the potential implications of a tied court decision, noting that it would leave key legal questions unresolved and could result in inconsistent outcomes across jurisdictions. She added that ongoing uncertainty remains an important consideration for energy companies and investors when evaluating transactions, financing and long-term risk exposure.

Read the article (subscription required)

FTC Secures Landmark Robinson-Patman Act Settlement With Southern Glazer’s Wine and Spirits

Wed, 07 Oct 2026 07:00:00 Z

On October 2, 2026, the Federal Trade Commission (FTC) announced a settlement with Southern Glazer’s Wine and Spirits, the nation’s largest wine and spirits distributor, resolving the agency’s closely watched Robinson-Patman Act price discrimination suit. The settlement is the first successful conclusion of an FTC Robinson-Patman Act enforcement action in 26 years, but does not necessarily signal the agency’s intention to broadly apply the statute in similar instances.

Background

In December 2024, the FTC sued Southern Glazer’s in the US District Court for the Central District of California, alleging that the company had violated Section 2(a) of the Robinson-Patman Act by selling wine and spirits to small, independent retailers at prices drastically higher than the prices it charged large national and regional chains, such as Total Wine, Costco and Kroger. According to the FTC’s complaint, Southern generated approximately $26 billion in revenue from wine and spirits sales in 2023 – selling roughly one in three bottles of wine and spirits purchased in the United States – making it one of the 10 largest privately held companies in the country. The complaint alleged that, beginning at least in 2018, Southern routinely charged small, independent retailers significantly higher prices than larger retailers nearby for identical bottles of wine and spirits sold within overlapping time periods. Southern did this through large-volume quantity discounts, cumulative quantity discounts and scan rebates that were generally unavailable to independents and not justified by Southern’s actual costs of distribution.

This is fundamentally a legacy Biden-era case. The FTC’s vote to authorize the original 2024 suit passed 3 – 2 with then-Commissioner Andrew Ferguson and Commissioner Melissa Holyoak dissenting. Commissioner Alvaro Bedoya, joined by then-Chair Lina Khan and Commissioner Rebecca Kelly Slaughter, defended the action as the long-overdue revival of the 1936 statute to prevent large chains from using size-based leverage to extract secret discounts and rebates unavailable to smaller competitors, framing the case as a straightforward secondary-line claim. Ferguson dissented from the outset, writing that while the government does not have the power to suspend a law merely because it disagrees with the law’s underlying policy, the FTC nonetheless has an obligation to carefully choose how it will spend its limited resources.

Outcome

Under the terms of the proposed stipulated consent order, Southern will face defined limitations on its ability to charge small, independent retailers higher prices than it charges competing large retail chains, without admitting liability or wrongdoing. The order covers nearly all of Southern’s wine and spirits sales to the five largest chain retailers across 26 states, including California, Florida, New York, Texas and Washington, among others.

Instead of a blanket nondiscrimination rule, the consent decree sets up a compliance framework built around “Paired Transactions,” a sale by Southern to a top-five retailer by sales volume in a state made around the same time as a sale of a similar product to a nearby small, independent retailer with 75 or fewer locations:

A Paired Transaction becomes a “Discriminatory Paired Transaction” if the price gap exceeds a “Safe Harbor” threshold (state-specific operating costs plus a 2.5% margin).
Southern is considered in violation if excess payments to a given independent retailer add up to more than $5,000 within any rolling 12-month period.
Southern can cure a violation by paying the affected retailer 1.5x the excess amount.
If Southern does not cure, and the FTC later wins an enforcement action, Southern must pay the independent retailer double the aggregated price differentials.
An independent monitor, chosen jointly by the FTC and Southern, will oversee compliance for the order’s six-year term.

FTC Bureau of Competition Director Daniel Guarnera called the settlement “a significant milestone for the FTC in its enforcement of the Robinson-Patman Act,” adding that the agency “is committed to ensuring that all businesses, no matter their size, can compete on a fair and level playing field.”

Chairman Andrew Ferguson, on the other hand, has been blunt about his position on the case, stating he “disagreed with the Democrat Commissioners’ imprudent decision to tie up the Commission’s budget and staff for years to come,” and that he remained, “utterly baffled by [his] former colleagues’ decision to commit thousands of man-hours and millions of dollars of resources to a case addressing an issue that was not injuring American consumers.” Ferguson has maintained that the FTC “should exercise sound discretion to pursue only those Robinson-Patman Act cases where both retailers and consumers are injured by second-line price discrimination.” Commissioner Mark Meador has echoed that consumer harm focus, writing that alcohol distribution’s “unusually poor” regulatory regime “shape[s] pricing and discount practices in ways that make application of the Robinson-Patman Act particularly complicated and can produce pricing differences whose motivation and legal significance depend on state-specific regulatory requirements rather than straightforward evidence of competitive injury or consumer harm.” He instead supports focusing on instances where there is clear consumer harm “in a sector that more directly impacts the cost of living for American families, such as food and groceries.”

Why this matters

For suppliers and distributors operating tiered retail channels, several practical takeaways emerge:

The Southern Glazer’s settlement is significant, but is not necessarily a signal of a Robinson-Patman revival. Although the settlement is noteworthy, it does not signal a resurgence of Robinson-Patman Act enforcement. As the FTC’s first successful Robinson-Patman action in roughly a generation, the case confirms that the agency remains willing to use the statute when warranted. However, Ferguson and Meador unambiguously emphasized that enforcement should focus on cases involving clear consumer harm, limiting the circumstances where the act is likely to be deployed.
Discount and rebate justifications need contemporaneous support. The order requires Southern to retain documentation supporting any cost justification, meeting competition or changed market conditions defense for three years. Suppliers should assume the same evidentiary burden applies to them and should document, in real time, the cost basis for any pricing that favors larger customers.
Internal pricing governance is now an enforcement expectation. The order mandates a formal compliance program, designated compliance officer, mandatory training for commercial and revenue management staff, and confidential reporting channels. Companies with tiered retail channels should consider similar internal controls before the FTC or a private plaintiff comes calling.

Cooley Advised TechWolf BV on Agreement to be Acquired by SAP SE

Tue, 06 Oct 2026 17:42:00 Z

Cooley advised TechWolf BV, a leading AI work intelligence platform, on its agreement to be acquired by SAP SE, a global leader in enterprise applications and business AI. The deal is expected to close in Q4 2026, subject to customary closing conditions. Terms of the deal were not disclosed.

The transaction was announced publicly in this press release.

Kevin Cooper, Stephane Levy, Dannielle Collett, and Simon Trisk led the Cooley team advising TechWolf BV.

Stephanie Gentile, Len Jacoby, Aaron Pomeroy, Stella Sarma, Nicola Squire, Patrick Van Eeke, Mark Cornillez-Ty, Sharon Davidov, Sam Dodson, Dillon Anthony Jones, Jordan Landers, and Sanjay Reddy provided invaluable support.

Cooley previously advised TechWolf BV on its Series A financing.

Cooley Expands DC Litigation Practice With Former Federal Prosecutor

Tue, 06 Oct 2026 04:38:00 Z

WASHINGTON, DC – October 5, 2026 – Cooley today announced that Menno Goedman has joined the firm’s global litigation department in Washington, DC. Goedman joins a DC litigation practice that has added six partners since 2025, including Elizabeth Prelogar, Ray Tolentino, Ephraim McDowell, Janet Kim, Brian Nelson and Jessica Donlon, along with 15 special counsel and associates.

“Cooley has expanded its litigation practice in recent years by recruiting the best of the next generation, with an emphasis on former federal prosecutors,” said Ian Shapiro, partner and chair of Cooley’s global litigation department. “We are confident that Goedman, who prosecuted national security crimes in the Department of Justice’s National Security Division, also represents the best of DC’s next generation, and we are looking forward to his emergence as one of the cornerstones of our elite DC litigation practice.”

Goedman joins Cooley from DOJ’s National Security Division, where he investigated and prosecuted a variety of national security offenses, with an emphasis on sanctions and export controls. Previously, he worked at the Department of Treasury and clerked for Judge Josephine L. Staton of the US District Court for the Central District of California and Judge A. Wallace Tashima of the US Court of Appeals for the Ninth Circuit.

“Cooley has quickly joined the ranks of the most elite litigation practices in the country, with a strong presence in Washington, DC, and deep experience helping clients navigate complex issues at the intersection of technology, government enforcement and national security,” said Goedman. “I’m excited to bring my experience in the courtroom and at DOJ to help clients navigate their most consequential disputes and investigations, and to join such a talented team.”

Cooley’s global litigation department includes more than 500 lawyers in the US and Europe and is the leading litigation department for the representation of technology, life sciences and other innovative companies.

5 Supreme Court Cases To Watch This Fall

Mon, 05 Oct 2026 16:22:02 Z

Cooley partner Ephraim McDowell was quoted in Law360's preview of five US Supreme Court cases to watch this fall, discussing a challenge to Arizona voter registration requirements. McDowell said the case could have significant implications for voter registration in future election cycles because requiring documentary proof of citizenship could result in eligible voters having their registrations canceled.

Read the article (subscription required)

San Diego Cooley Office Settles for Gold

Fri, 02 Oct 2026 15:22:00 Z

Cooley partners Ken Rollins and Mazda Antia were quoted in a San Diego Business Journal article about the firm’s growth and activity in San Diego, including a surge in life sciences initial public offerings (IPO) and reverse mergers and Cooley’s role as an Official Legal Services Provider of the LA28 Olympic and Paralympic Games and Team USA. Rollins discussed the strength of the life sciences capital markets and the firm’s pipeline of IPO, reverse merger and M&A transactions, while Antia highlighted the alignment between Cooley’s community involvement and its LA28 partnership.

Read the article (subscription required)

Glynn Capital Joins Brown Advisory

Fri, 02 Oct 2026 05:05:00 Z

Palo Alto – October 1, 2026 – Cooley advised Glynn Capital, a San Francisco- and Menlo Park-based investment firm with more than 50 years of experience investing in technology companies, on its combination with Brown Advisory, an independent investment management and strategic advisory firm.

Lawyers Adam Bloom, Joanna Leung, Bernard Hatcher, Rachel Goddard, Katia MacNeill and Jamie Suk led the Cooley team advising Glynn Capital.

Cooley has advised Glynn since 1983.

The Legal 500 UK 2027 recognizes 20 Cooley Lawyers + 21 Practice Areas

Thu, 01 Oct 2026 16:43:00 Z

London, UK – October 1, 2026 –The Legal 500 UK 2027 has recognized 21 Cooley practice areas from the firm’s London office. Partners Rod Freeman and Angus Miln remain in The Legal 500 Hall of Fame, and 10 partners were recognized as Leading Lawyers, including co-partners in charge Claire Keast-Butler and James Maton, alongside partners Aaron Archer, Chris Coulter, Tom Epps, Caroline Hobson, Paula Holland, Ryan Naftulin, Frances Stocks Allen and Ali Ramadan. Ella Donnegan, Sascha Grimm, Nicola Squire and Claire Temple were named Next Generation Partners.

Special counsel Amy Collins, Tristan Lockwood and Juan Nascimbene, along with associate Ben Sharrock-Mason, were recognized as Leading Associates.

Read Cooley’s 2027 Legal 500 UK practice rankings.

Leading practices

Corporate and commercial – corporate tax
Corporate and commercial – equity capital markets – mid-large cap
Corporate and commercial – EU and competition +
Corporate and commercial – M&A: lower mid-market deals (£100m – £750m)
Corporate and commercial – venture capital +
Crime, fraud and licensing – fraud: civil
Crime, fraud and licensing – white collar crime (advice to individuals)
Dispute resolution – commercial litigation – premium
Dispute resolution – international arbitration
Dispute resolution – public international law
Employment – employee share schemes
Employment – employers +
Industry focus – life sciences and healthcare
Insurance – product liability: defendant
Technology, media and telecoms: media: digital & social content *
Risk advisory – data protection, privacy and cybersecurity
Risk advisory – regulatory investigations and corporate crime (advice to corporates)
Technology, media and telecoms – fintech: corporate and commercial
Technology, media and telecoms – fintech: regulatory
Technology, media and telecoms – intellectual property: patents (contentious and non-contentious)
Technology, media and telecoms – IT and telecoms

Indicates Tier 1 ranking
* indicates new ranking
+ indicates improved ranking

Armadin Raises $255.5 Million Series B

Thu, 01 Oct 2026 16:00:00 Z

Reston – October 1, 2026 – Cooley advised Armadin, an AI-native cybersecurity company building effective autonomous security, on its $255.5 million in Series B funding co-led by Andreessen Horowitz and Accel that brings the company's valuation to more than $2.5 billion. The round includes participation from new investors Bain Capital Ventures and Redpoint, as well as existing investors 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins and Menlo Ventures.

Lawyers Mike Lincoln, Eddie Sniezek and Ty Chung led the Cooley team advising Armadin.

Cooley previously advised Armadin on its $189.9 million Seed and Series A in March 2026.

Cooley Maintains Top Rankings in Global M&A and Private Equity

Thu, 01 Oct 2026 15:39:58 Z

Cooley’s global mergers and acquisitions and private equity practices were again recognized for top ranking positions in Q3 league tables from Bloomberg.* Despite the unpredictable market, Cooley continues to dominate in public and private deals around the world.

#1 for US and global life sciences M&A
#1 for US and global tech M&A
#3 for US and global M&A
#3 for US mid-market M&A
#3 for global mid-market M&A
#2 for US and global private equity deals

In 2026, Cooley handled transactions across a diverse range of industries while also maintaining its top position in technology and life sciences. The firm’s market-leading transactions include representing:

Since 2021, Cooley’s world-class transactional team has worked on 1,600+ M&A deals for an aggregate value of more than $750 billion – guiding top public and private companies, financial advisors and private equity sponsors in some of the market’s largest and most complex transactions. The M&A and PE groups include 180+ practitioners in major business and technology centers worldwide, representing all categories of participants in transactions.

* The Bloomberg platform data has not been published by Bloomberg.

Cooley Bolsters Securities Litigation Practice in New York

Thu, 01 Oct 2026 15:01:00 Z

New York – October 1, 2026 – Cooley today announced that Nicholas Caselli has joined the firm as a partner in its securities litigation + enforcement practice and global litigation department in New York. Caselli defends securities class actions, as well as shareholder derivative and M&A-related claims, including on behalf of technology and life sciences clients.

Cooley has long had one of the leading securities litigation practices on the West Coast, especially for the representation of tech and life sciences companies. Caselli’s recruitment is an important step toward establishing the preeminent next-generation securities litigation practice in New York.

“Nick has already been at the center of two of New York’s leading securities litigation practices in his still young career, and as soon as we met him, we were confident that he would emerge as one of the best of his generation. We are excited to build with him in New York,” said Ian Shapiro, chair of Cooley’s global litigation department and partner in charge of the New York office.

“Nick has strategically built his practice at the intersection of securities litigation, shareholder disputes and M&A, making him a natural fit for the needs of our growing client base,” said Patrick Gibbs, partner and leader of Cooley’s securities litigation + enforcement practice. “His experience handling complex matters in New York and Delaware, together with his ability to work alongside transactional teams before disputes arise, will be a tremendous asset as we continue to grow our East Coast capabilities.”

“Cooley’s world-class securities litigation practice, deep relationships with innovative companies and collaborative culture made the firm a natural choice for my next chapter,” said Caselli. “I look forward to working with my new colleagues to guide clients through their most complex shareholder disputes and help build on the practice’s growing presence in New York.”

Cooley’s global litigation department includes more than 500 lawyers in the US and Europe representing technology, life sciences and other innovative companies. Since 2025, Cooley has added more than two dozen elite lawyers to its litigation department throughout the US, including Elizabeth Prelogar, Raymond Tolentino, Ephraim McDowell, Brian Nelson, Janet Kim, Meredith Halama and Jessica Donlon in Washington, DC; Simona Agnolucci, Ben Hur, Jonathan Patchen, Eduardo Santacana, Joshua Anderson and Tiffany Lin in San Francisco; Michael Rome and Brian Klein in Los Angeles; Lyndsey Kruzer, Andrea Reid, Andrew Wilkins and John Rearick in Boston; and James Kim, Tejal Shah, Sean Quinn, Michael La Marca and now Caselli in New York.

Daily Journal Names Cooley Partner Among Top California Lawyers

Thu, 01 Oct 2026 06:47:00 Z

San Diego – September 30, 2026 – The Daily Journal recognized Cooley partner Michael Attanasio among its Top 100 Lawyers, an annual list celebrating leading lawyers in California whose work has made a significant impact on the legal profession and their clients.

In its profile, the publication highlighted Attanasio’s work as lead counsel for Jenner & Block in its challenge to an executive order that restricted the firm’s attorneys’ security clearances, access to federal buildings and work with federal contractors. Attanasio secured a temporary restraining order in March 2025, followed by a permanent injunction and summary judgment in April 2025.

The Daily Journal also noted that Attanasio was the only California attorney among counsel for the four law firms challenging similar orders to argue in district court on behalf of one of the targeted firms. Reflecting on his approach to high-profile litigation, Attanasio said, “Drown out the noise and do what’s best for the client.”

Read Attanasio’s profile (subscription required)

Varda Announces $251 Million Series D

Wed, 30 Sep 2026 13:59:00 Z

San Francisco – September 30, 2026 – Cooley advised Varda Space Industries, a microgravity-enabled life sciences company, on its $251 million Series D fundraising round, bringing the total amount of capital raised by the company to $598 million. The fundraise was led by Lux Capital and Natural Capital, with participation from Founders Fund, Khosla Ventures, Caffeinated Capital, General Catalyst, 8090 Industries, Giant Step and Also Capital.

Lawyers Peter Werner, Kevin Gibson, Joseph Kroon, Christopher Kimball, Emily Mok, Kevin King, Tim Nguyen and Michelle Geller led the Cooley team advising Varda.

Cooley Advised SoundThinking on Agreement to be Acquired by Transom Capital Group

Tue, 29 Sep 2026 18:53:28 Z

Cooley advised SoundThinking, a leading public safety technology company combining transformative solutions and strategic advisory services for law enforcement and civic leadership, on its agreement to be acquired by Transom Capital Group, an operationally focused middle-market private equity firm. Upon completion of the merger, Transom will commence a tender offer to acquire all outstanding shares of SoundThinking’s common stock for a purchase price of $8.00 per share in cash, payable at closing, plus one non-transferable CVR, which entitles each holder thereof to receive up to an additional $3.00 per share in cash, payable upon achievement of certain revenue milestones. SoundThinking’s shares will no longer trade on Nasdaq, and SoundThinking will become a privately held company.

The transaction was announced publicly in this press release.

William Sorabella, Steve Tonsfeldt, John-Paul Motley, Tracy Rubin, Ryan Genkin, and Su Lian Lu led the Cooley team advising SoundThinking.

Cooley previously advised SoundThinking on several private financings, its $30 million IPO in 2017, and its 2018 follow-on offering.

Snowflake Announces Upsized $3.75 Billion Convertible Senior Notes

Tue, 29 Sep 2026 18:28:00 Z

Palo Alto – September 29, 2026 – Cooley advised Snowflake (New York Stock Exchange: SNOW), the AI data cloud company, on its upsized private placement of $3.75 billion aggregate principal amount of convertible senior notes, consisting of $2 billion aggregate principal amount of 0% convertible senior notes due 2029 (2029 notes) and $1.75 billion aggregate principal amount of 0% convertible senior notes due 2031 (2031 notes). Snowflake also granted the initial purchasers of the notes options to purchase, within a 13-day period beginning on, and including, the date on which the notes are first issued, up to an additional $300 million aggregate principal amount of the 2029 notes and up to an additional $250 million aggregate principal amount of the 2031 notes.

Lawyers Jon Avina, Milson Yu, Mischi a Marca, Jason Savich, Kate Nichols, Timothy Nguyen, Shimeng Cheng, Samara Zaifman, Jayne Munger, Julia Gage, Maragret Barreto and Tucker Cochenour led the Cooley team advising Snowflake. Eileen Marshall, Timothy Shapiro and Calvin Lee provided tax support.

Cooley previously advised Snowflake on its $2.3 billion convertible senior notes offering in 2024 and $3.9 billion initial public offering in 2020.

Efficient Computer Announces $97 Million Series B

Tue, 29 Sep 2026 16:00:00 Z

Washington, DC – September 29, 2026 – Cooley advised Efficient Computer, the company building the world's most energy-efficient processors, on its more than $97 million Series B financing at a $650 million valuation, bringing its total funding raised to $173 million. The new round is led by TQ Ventures, with participation from Eclipse, Union Square Ventures, Giant Ventures, Triatomic Capital, TO Capital, TF Capital, Mana Ventures, Toyota Ventures, Overmatch and Borderless.

Lawyers Josh Holleman, Eddie Sniezek, Katherine King, Evan Burroughs and Elise Robinson led the Cooley team advising Efficient Computer, with support from Adam Ruttenberg.

Cooley previously advised Efficient Computer on its Series A in February 2026.

SciBrunch Announces Exclusive Global License Agreement With Merck

Tue, 29 Sep 2026 02:26:00 Z

Shanghai – September 28, 2026 – Cooley advised SciBrunch Therapeutics (SciBrunch), a clinical-stage biotechnology company driven by iterative innovation in small molecule oncology therapeutics, on its exclusive global license agreement with Merck (New York Stock Exchange: MRK) for SPR2015, an investigational preclinical oral KRAS G12D (ON) inhibitor, which has now closed.

Under the agreement, SciBrunch has granted Merck exclusive rights to develop, manufacture and commercialize SPR2015 worldwide. SciBrunch will receive an upfront payment of $400 million and is eligible to receive payments associated with the achievement of certain milestones related to development, commercialization and other activities across multiple indications. The total potential aggregate value of the transaction, including the upfront payment, is $2.13 billion.

Lawyers Yiming Liu, Geoffrey Spolyar and Zack Gong led the Cooley team advising SciBrunch, with invaluable support from Shawn Yu, Aaron Pomeroy, David Burns, Julia Brinton, Zhijing Yu, Andrew Epstein, Karen Tsai, Monica Xu, Lunga Su, Snow Yang, Amanda Pacheco and Asako Kubota.

SGX Needs to Boost Post-IPO Liquidity. Here’s How It Can Do It

Mon, 28 Sep 2026 15:21:00 Z

Cooley lawyers Tim Pitrelli and Steven Holm co-authored an article in The Business Times examining how Singapore Exchange (SGX) can strengthen post-initial public offering (IPO) liquidity as Singapore’s equity market gains momentum. The article examines two changes to unlock secondary market liquidity: expanding local equity lending and introducing flexible, milestone-driven lock-up structures.

Read the article on Business Times (subscription required)

Regulating AI Like a Doctor: FDA Floats Competency-Based Path for Generative AI-Enabled Devices

Mon, 28 Sep 2026 07:00:00 Z

On August 18, 2026, the US Food and Drug Administration (FDA) Center for Devices and Radiological Health (CDRH) released a discussion paper proposing new approaches to regulating medical devices enabled by generative artificial intelligence (genAI), and requesting stakeholder feedback, which must be submitted by October 19, 2026. The paper is not guidance, but it offers insight into how the agency is thinking about the unique risks and evidentiary challenges posed by genAI-enabled devices. The paper presents two main ideas: a two-axis framework for assessing risk and a “competency-based” model for premarket evaluation inspired by how human clinicians are evaluated and credentialed.

Background

CDRH has been concerned about genAI-enabled medical devices for some time. Following a November 2024 public meeting of its Digital Health Advisory Committee, CDRH identified two categories of regulatory challenges posed by these devices:

Challenges associated with applying a risk-based approach to classifying and determining regulatory requirements for genAI-enabled devices.
Challenges associated with determining the types of valid scientific evidence for FDA’s evaluation of the safety and effectiveness of such devices across the total product life cycle.

This discussion paper offers potential ideas to address these challenges and requests stakeholder feedback.

The two-axis framework

CDRH proposes organizing risk assessment for genAI-enabled software functions in a chart with the horizontal axis representing the degree and independence of the device’s activity and the vertical axis representing the severity of consequences if a user relies on an incorrect output. Risk increases moving from the lower left toward the upper right of the line chart. (See Figure 1)

Figure 1: FDA’s two-axis framework for risk

Within that framework, CDRH puts forth several specific factors that it suggests should shift a function’s risk classification, including, for example:

Measurement and signal processing functions. FDA claims that genAI-enabled in vitro diagnostic, measurement and signal processing functions raise increased concern as their outputs typically cannot be independently assessed by the user. Even though such functions do not direct users to perform an action (a function CDRH considers higher risk than simply providing nondirective information), CDRH proposes to treat them as higher risk because a user cannot identify and avoid relying on an incorrect result.
Patient-facing versus HCP-facing informational functions. CDRH also proposes to weigh whether informational functions delivered directly to patients should be treated as higher risk than the same functions delivered to healthcare professionals (HCPs), since FDA believes that HCPs are generally better positioned to interpret an output, recognize limitations, spot an error and avoid over-relying on it.

Interestingly, both of these considerations appear to come directly from concepts that are structural to FDA’s clinical decision support (CDS) software guidance. The CDS guidance’s nondevice carve-out excludes software that acquires, processes or analyzes signals from an in vitro diagnostic device or a signal acquisition system and requires devices meeting the carve-out to enable an HCP (explicitly not a patient or caregiver) to independently review the basis for a recommendation. CDRH draws that connection itself in the discussion paper, in a footnote where it notes that its concern about measurement and signal processing functions “seems consistent with the independent- review criterion of the clinical decision support exclusion.”¹ Despite criticism that the CDS guidance significantly narrows the statutory carve-out from the 21st Century Cures Act, it appears CDRH proposes to import some of the CDS guidance’s risk logic into a broader framework for genAI-enabled devices generally.²

CDRH also flags other factors it is considering, including how to treat “action-directing” versus “action-taking” functions – terms CDRH uses descriptively as part of its proposed risk framework rather than as terms with fixed regulatory definitions. CDRH has not defined these categories with precision and is specifically asking stakeholders to help refine the distinctions between them. Other factors under consideration include generalist HCP-facing functions versus specialist-facing ones, multi-turn conversations that migrate from informational to action-directing over time and care escalation functions. CDRH specifically requests feedback on this proposed risk framework.

Competency-based model for premarket evaluation

CDRH also previews a possible shift in how genAI-enabled devices could be evaluated by FDA before they are permitted to be marketed. Traditional software device evaluation has relied on testing across a representative sample of defined inputs and outputs. However, CDRH notes that this approach likely will not work for genAI-enabled devices as the range of possible inputs and outputs may be too large for such testing to be practical. Instead, citing recent academic papers that propose evaluating genAI more like a clinician than an unchanging product, CDRH is considering a two-part “competency-based” evaluation model, which includes device benchmarking and clinical confirmation. CDRH anticipates that the scope of benchmarking and the rigor of clinical confirmation would scale with the device’s position on the two-axis risk framework.

Device benchmarking. CDRH envisions device benchmarking as a scalable, nonclinical evaluation to assess whether the device, in its deployed configuration, demonstrates the clinical knowledge, analytic capabilities, safety behavior, communication and generalizability to support reasonable assurance of safety and effectiveness of the device for its intended use. CDRH proposes evaluating devices across categories of competencies, including safety (e.g., recognizing safety-critical situations and communicating uncertainty), clinical proficiency (e.g., clinical knowledge and analysis), generalizability (e.g., robustness, reliability and reproducibility) and additional agentic-specific competencies for agentic AI functions.
Clinical confirmation. CDRH also believes that device benchmarking alone may not fully establish how a genAI-enabled device will perform in actual clinical use, since such devices interact with users, workflows and patient populations in ways that testing may not capture. CDRH therefore contemplates an additional clinical confirmation step, noting that this would not necessarily require a prospective clinical study in every case. Instead, the type and rigor of evidence would be consistent with the device’s risk profile and could range from retrospective evaluation on real patient data to prospective clinical studies or randomized controlled trials.

This competency-based evaluation model would represent a significant departure from traditional premarket review, which has generally relied on testing a device against a defined set of inputs and comparing its outputs to a known standard, such as the paradigm underlying the 510(k) substantial equivalence framework. Under the competency-based approach, by contrast, evaluation would center on whether a device demonstrates proficiency across prespecified categories of clinical knowledge, safety behavior and real-world generalizability – an assessment framework modeled less on product testing and more on how human clinicians are credentialed.

The shift is consequential because it would move FDA toward a qualitative, multidimensional evaluation of device capability. If adopted, this model could fundamentally reshape the FDA’s marketing authorization policy for genAI-enabled devices, replacing conventional input-output testing with a credentialing-style assessment of device competency, paired with clinical evidence scaled to risk. Whether and how these proposals take shape can still be influenced by industry engagement during the comment period and beyond.

Postmarket monitoring

Through the introduction of the competency-based model, CDRH recognizes that the novel capabilities of genAI-enabled devices can make it difficult for premarket testing alone to fully capture device performance. CDRH states that it is therefore considering whether it may be appropriate to accept greater premarket uncertainty regarding a genAI-enabled device’s benefit-risk profile, and instead place greater reliance on postmarket monitoring. The discussion paper identifies a handful of potential approaches to postmarket monitoring that are intended to be proportionate to a device’s risk profile:

Periodic device benchmarking

The manufacturer would reassess the device against the same prespecified benchmarking thresholds used in the premarket evaluation, on a defined cadence and after defined triggering events, including changes to the underlying model or other components of the deployment architecture. This approach is conceptually similar to FDA’s existing Predetermined Change Control Plan (PCCP) framework, under which preauthorized modifications can be implemented without new premarket submissions.

Periodic sample-based clinician review. Qualified, independent clinician adjudicators would review samples of real-world inputs and outputs against prospectively defined criteria, sampled to reflect device encounters in actual use. Although the discussion paper contemplates the use of qualified independent third parties as clinical adjudicators and describes a general methodology for comparing device outputs against independent clinician assessments, it does not address the institutional infrastructure for this process – for example, how adjudicators would be credentialed, whether they would operate under FDA oversight or institutional review board supervision, or what contractual or governance arrangements would apply. These implementation details remain open questions, consistent with the paper’s discussion-only status.
Performance degradation monitoring. The manufacturer would monitor for drift resulting from changes in the input population, data environment or underlying model components.

CDRH also asks for feedback on whether machine-based supervisory agents could help facilitate some aspects of postmarket monitoring, effectively raising the concept of AI agents evaluating AI device functions. This is a notable step for the agency: There does not appear to be precedent for FDA endorsing machine-based oversight of regulated devices, even at the discussion stage, and the proposal underscores the extent to which genAI-enabled devices may require fundamentally different regulatory approaches. Additionally, CDRH proposes a “shared ecosystem responsibility” for postmarket oversight, noting that clinicians, healthcare institutions, payors, professional societies and other stakeholders each may have roles to play in the deployment, monitoring, reporting and ongoing evaluation of genAI-enabled devices.

This framing reflects a broader pattern in FDA’s current thinking: Rather than concentrating all oversight within the agency, FDA is increasingly exploring models that leverage external institutions and stakeholders. For example, FDA’s Expedited IND Pilot, announced on September 15, 2026, under the Department of Health and Human Services’ Operation TrialBlazer initiative, pairs drug sponsors with qualified research institutions to accelerate first-in-human clinical trial timelines through rolling investigational new drug (IND) review – a model that, while structurally different from CDRH’s postmarket vision, similarly relies on distributing regulatory functions across a network of qualified participants within the clinical trial ecosystem rather than handling them entirely within FDA. However, it is unclear under what authority FDA could compel such parties to engage with FDA on these issues.

Foundation model master files

Because many genAI-enabled devices are built on third-party foundation models, CDRH is also exploring whether the existing Device Master File program could be leveraged to improve the agency’s visibility into those underlying models. Specifically, CDRH seeks feedback on the feasibility of voluntary Foundation Model Master Files (MAFs), under which foundation model developers and platform providers could submit information on their models to FDA. These files would be held confidentially by FDA and could be referenced by device sponsors, with the file holder’s authorization, in support of individual premarket submissions. Importantly, CDRH emphasizes that submission of a Foundation Model MAF would not constitute authorization of the underlying model for any device intended use, and device sponsors would remain independently responsible for demonstrating the safety and effectiveness of their own devices.

The voluntary nature of this proposal raises an obvious question: Foundation model developers may have limited commercial incentive to disclose safety-relevant information to a regulator, particularly where doing so could expose limitations or failure modes. CDRH itself acknowledges this tension and asks commenters whether the program could be made sufficiently useful for premarket review given that participation would be optional. If adopted, however, Foundation Model MAFs could streamline premarket review by giving FDA reviewers a baseline understanding of the models underlying multiple device submissions, potentially reducing duplicative information requests and promoting more consistent review across devices built on the same foundation model.

Themes from public comments

Stakeholders filing comments to date have raised a few recurring points. Many commenters, including AI developers, health systems and individual physicians, argue that the two-axis framework should be supplemented with additional risk considerations – such as the detectability of an incorrect output, its reversibility and traceability to the underlying data or specific model – rather than relying on device activity and consequences alone. A similar group cautioned that postmarket monitoring is not an adequate substitute for premarket evidence where harm may be severe, fast-acting or irreversible, and several commenters urge CDRH to require sponsors to affirmatively state what failure modes a monitoring program can and cannot detect before any such trade-off is accepted. Some commenters questioned the feasibility and reliability of the Foundation Model MAFs, given that some models are continuously changing and updated hundreds of times a day. These comments, along with others addressing agentic AI oversight, human-in-the-loop design and foundation model change management, suggest that industry feedback may be helpful and ultimately shape CDRH’s eventual approach.

Practical considerations

As this is a discussion paper, not guidance, CDRH does not propose any new regulatory policy concerning the marketing authorization process or evidentiary requirements at this stage. However, the paper offers a meaningful preview of the agency’s thinking, and stakeholders should not underestimate its significance, particularly given the novelty of its proposals. CDRH discussion papers have historically foreshadowed the agency’s regulatory direction, and stakeholders who engage early in this process will be better positioned to shape the framework before it solidifies into formal policy, guidance for industry or regulation. Companies developing, deploying or investing in genAI-enabled medical devices should consider several near-term actions:

Submit comments by the October 19, 2026, deadline. The open feedback period is one of the most direct ways for stakeholders to influence CDRH’s regulatory approach to genAI-enabled products. Comments submitted through regulations.gov during this window carry particular weight, as CDRH has specifically requested input on its proposed risk framework, competency-based evaluation model and postmarket monitoring approaches. Companies should consider engaging individually or through industry associations.
Map existing and pipeline products against the two-axis framework. Even though the framework is not yet final, companies should begin assessing where their genAI-enabled devices fall along CDRH’s proposed risk axes – degree of device activity and severity of consequences from incorrect outputs. This exercise can identify products that may face heightened scrutiny and help prioritize regulatory strategy and resource allocation accordingly.
Evaluate evidence generation strategies. The competency-based evaluation model, if adopted, would provide guidance for companies to demonstrate device proficiency across defined competency categories rather than relying solely on traditional input-output testing. Companies should assess whether their current clinical evidence and testing infrastructure can support device benchmarking and clinical confirmation at the rigor CDRH envisions.
Review foundation model supply chain arrangements. CDRH’s proposed Foundation Model Master File program, coupled with its emphasis on deployment architecture and model change management, underscores the importance of contractual and operational visibility into third-party foundation models. Companies that rely on third-party models should evaluate whether their existing agreements provide sufficient access to the safety, performance and change-management information that CDRH may expect device sponsors to possess or reference.
Prepare for expanded postmarket obligations. CDRH’s discussion of periodic benchmarking, sample-based clinician review and performance degradation monitoring signals a potentially significant expansion of ongoing compliance obligations for marketed genAI-enabled devices. Companies should consider how these proposals would affect their quality systems, postmarket surveillance capabilities and operational costs.

Cooley’s life sciences and healthcare regulatory team will continue to monitor CDRH’s approach to genAI-enabled devices and is available to discuss how this discussion paper may affect product roadmaps, regulatory strategies or premarket submission planning. We also can assist in preparing a comment letter to FDA in response to the proposals outlined in this paper.

Notes

Discussion paper at 11 n.17 (noting that genAI-enabled measurement and signal processing functions raise concerns “seem[ing] consistent with the independent-review criterion of the clinical decision support exclusion”).
For more information regarding FDA’s CDS guidance, read Cooley’s January 2026 client alert.

The Law of Neural Data Licensing: The State Law Landscape and the De-Identification Question

Mon, 28 Sep 2026 07:00:00 Z

Over the past few years, one of the more visible trends among neurotech companies has been the emergence of neural data licensing as a business model. Companies collect neural data – sometimes from consumer wearables, sometimes from participants in clinical or research studies – and then license that data to third parties, such as developers of “brain foundation models” and other neuroscience companies. What began as an incidental use of research datasets has, in some quarters, become a revenue thesis: “Brain-data-as-a-service” providers now standardize and license neural datasets for others to train large-scale “mental models.” That commercial arc has the potential to intersect with efforts by states to give consumers more control over their personal data.

Five states have laws that make it unlawful or practically impossible to license neural data because they either almost prohibit it (Connecticut, Delaware and Vermont), or they require the consent of the individual whose neural data is to be sold (Colorado and Montana). Since in many cases, companies that hold neural data do not know what states the individuals reside in, licensing out neural data can be prohibitive.

In addition to state laws that prohibit or require consent for the licensing out of neural data, there are additional states that require companies that license out neural data to register as data brokers, which carry a host of operational and legal burdens. Six states run stand-alone data broker registration regimes: California, Oregon, Texas, Vermont, Connecticut and New Jersey. A seventh state, Nevada, regulates a narrower set of data brokers without requiring registration with the state, but affording individuals an ability to opt out of their data being sold or licensed.

Each of the states that regulate the licensing of neural data has different definitions of neural data and different scopes of applicability. Each of the registration laws has its own definition of who is a “data broker,” what kind of data triggers the registration requirement and what thresholds and exemptions apply.

Four structural models of data broker laws are now in play.

Model 1: California

California’s long-standing data broker law defines “data broker” as a business that knowingly collects and sells to third parties “the personal information of a consumer with whom the business does not have a direct relationship.” The law applies to a broad definition of “personal information” – any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

The law classifies neural data as a category of “sensitive personal information,” which is a subset of personal information under the law. The definitional path is short: Neural data that is identifiable to an individual is sensitive personal information; sensitive personal information is personal information; and personal information triggers the data broker regime. As a result, selling identifiable neural data about individuals with whom the business has no direct relationship falls within California’s data broker regime, even when the neural data is transferred without accompanying identifiers – unless the neural data has been de-identified to the California Consumer Privacy Act’s (CCPA) exacting standard, in which case it is excluded from “personal information” and out of scope of the law. Whether neural data can meet that de-identification standard is a threshold question discussed later in this article.

The operational obligations are substantial. For example, registered data brokers must:

Post a privacy policy that contains certain disclosures and offers certain consumer rights.
Pay a $6,000 annual registration fee (increased to $9,500 in 2027), plus payment processing fees, during the January 1 – 31 registration period.
Create and maintain a Delete Request and Opt-Out Platform (DROP) account, download the CPPA’s consumer deletion list at least every 45 calendar days, and delete the consumer’s personal information (including deletion by service providers and contractors) upon match.
Process every deletion request received during the previous access session and report a response code back to the DROP (“Record deleted,” “Record opted out of sale,” “Record exempted” or “Record not found”) at each subsequent access.
Make enhanced disclosures during registration, including whether the data broker has shared for purposes of cross context behavioral advertising, or sold data to specific recipient categories, in the past year and identifying the most common types of personal information collected.

The CCPA regulations also refine the “direct relationship” question in a way that matters for neurotech companies: For the data broker law not to apply, a consumer must have intentionally interacted with the business to access, purchase, use, request or obtain information about the business’s products or services. Collecting data “directly from the consumer” does not, by itself, create a direct relationship if the consumer’s intent to interact with the business is missing – a distinction that matters for research-participant and clinical-trial datasets that later flow into licensing arrangements. The California law affords data brokers some exceptions from consumers’ deletion rights.

Model 2: Connecticut, Oregon and Vermont – Enumerated ‘brokered personal data’

Three states – Connecticut, Oregon and Vermont – apply to a specifically enumerated list of “brokered” personal data information. The list varies in the details, but the shape is consistent: name; address; date of birth; place of birth; mother’s maiden name; unique biometric data used to identify or authenticate the consumer; the name or address of a member of the consumer’s immediate family or household; Social Security or other government-issued identification number; and a catch-all for “other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty” (Connecticut and Vermont), or “can reasonably be associated with the individual” (Oregon).

Neural data is not one of the enumerated categories in any of these three statutes. It is pulled into these regimes only in three specific circumstances:

Bundling with enumerated identifiers. The license package also contains one or more of the enumerated identifiers (name, address, date of birth, Social Security number or the like) alongside the neural data.
Biometric identification or authentication. The neural data is itself being used by the licensor or licensee to identify or authenticate the consumer, bringing it under the “unique biometric data” prong. This prong requires an actual identification or authentication use – not merely that the data could theoretically be used that way. Neurotech companies whose license value proposition is training AI, not identifying users, are typically outside this prong. However, the Oregon law leaves a possibility that biometric information need not be used to identify an individual in order to be covered by the Oregon data broker law.
The identifiability catch-all. The neural data itself, alone or in combination with other data, would allow a reasonable person to identify the consumer with reasonable certainty (Connecticut/Vermont) or can reasonably be associated with the individual (Oregon). This is where the de-identification question lands.

The registration and mechanics vary across these three states. Oregon has required registration since January 1, 2024, with a $600 annual fee paid through the Oregon Division of Financial Regulation, an opt-out disclosure requirement and no state-run deletion mechanism. Vermont has required registration since January 1, 2019 – the first-in-the-nation data broker registration law – with a $100 annual filing to the secretary of state, security-program requirements and enforcement by the Vermont attorney general. Connecticut’s new regime turns on January 1, 2027; the Commissioner must stand up the state’s accessible deletion mechanism by July 1, 2028, and data brokers must begin honoring deletion requests received through it by October 1, 2028; annual public transparency statements begin July 1, 2029; and the first triennial independent audits must be completed by July 1, 2031.

In Connecticut and Vermont, separate laws, if they apply to a business, prohibit the sale of neural data absent the consent of the individuals whose neural data is to be sold. If these laws apply to a business, and they do not have the requisite consent, they cannot license neural data, and therefore the data broker registration requirement becomes moot.

Model 3: The Texas outlier – A revenue-based test

Texas takes a structurally different approach. The Texas Data Broker Act defines “data broker” as a business entity that collects, processes or transfers personal data that the business entity did not collect directly from the individual to whom the data is linked or linkable. “Personal data” for these purposes is broad and includes information linked or reasonably linkable to an identified or identifiable individual.

But Texas layers a materiality test on top of the definition. The law applies only to a business that, in a 12-month period, derives more than 50% of its revenue directly from processing or transferring personal data not collected by the data broker directly from the individuals to whom the data pertains, or any amount of revenue directly from processing or transferring the personal data of more than 50,000 individuals. Registration is a $300 filing with the Texas secretary of state. Obligations include a website notice identifying the business as a data broker, a comprehensive information security program, and civil penalties of $100 per day, capped at $10,000 per year, plus unpaid registration fees for noncompliance.

The practical implication for neurotech companies: Texas structurally protects businesses whose principal revenue is from selling another product or service, even where they engage in some downstream neural data licensing. The Texas law applies to pure-play “data-as-a-service” licensors of identifiable neural data and businesses with sizeable licensed-out populations. Texas also expressly exempts genuinely de-identified data, on essentially the CCPA-style standard: reasonable technical measures to prevent re-identification, a public commitment not to re-identify and contractual downstream controls.

Model 4: New Jersey – Highest fees in the nation and a novel ‘data collector’ concept

New Jersey enacted its data broker law on June 30, 2026 – introduced, passed and signed within a 48-hour window – making it the sixth state with a stand-alone data broker registration regime and, by a wide margin, the most expensive and structurally most disruptive. Unlike every other state’s data broker law, the New Jersey law regulates not only “data brokers” (the traditional definition) but a novel second category called “data collectors” – first-party businesses that sell or license their own customers’ personal data to data brokers. The law also imposes a categorical prohibition on the sale or licensing of “sensitive data,” which took effect immediately upon enactment. But this ban does not apply to neural data, unless it is swept into the prohibition where the neural data reveals mental or physical health condition, treatment or diagnosis of an individual, or where the neural data is processed for the purpose of biometrically identifying an individual. Enforcement rests with the New Jersey attorney general through the Division of Consumer Affairs, and the law contains exceptions that apply in certain circumstances.

Within days of enactment, however, the law drew immediate backlash over its unusually high fees, severe penalties and novel coverage of “data collectors.” A senior official from the administration of Gov. Mikie Sherrill confirmed to the press that the state would not enforce the law until the legislature fixes “certain defects that have come to light,” and, on July 10, 2026, the Division of Consumer Affairs issued a public alert stating that covered data brokers and data collectors will not be required to register or pay any registration fees until the registry launches in spring 2027. The sensitive data sale prohibition, by contrast, has not been paused and remains enforceable now, although that ban does not expressly apply to neural data.

The “data collector” category is the structural novelty. A “data broker” is defined much as in other states – an entity that knowingly collects or purchases the personal data of consumers with whom it has no direct relationship, and sells or licenses that data to third parties. A “data collector,” by contrast, has no analog in any other state’s data broker statute. A data collector is a business that has a direct relationship with the consumer (the individual is or was a customer, subscriber, research subject or similar counterparty) but sells or licenses those consumers’ personal data to a data broker downstream. A consumer neurotech company (for example, a wearable manufacturer that sells or licenses its own users’ neural data downstream to a data broker) is a data collector under New Jersey law, and it is subject to the same registration, fee, disclosure and sensitive data sale prohibition obligations as a traditional broker.

Registration fees are graduated based on the number of New Jersey residents whose personal data is sold or licensed: $5,000 for 100,000 residents or fewer; $10,000 for 100,001 to 499,999; $100,000 for 500,000 to 999,999; $500,000 for 1,000,000 to 1,499,999; $750,000 for 1,500,000 to 2,499,999; $1,000,000 for 2,500,000 to 4,499,999; and $1,500,000 for 4.5 million or more. These are the highest data broker registration fees enacted by any state – the top tier alone is 250 times California’s $9,500 2027 fee. Failure to register or pay the fee is a civil penalty of $2,500 per day; failure to submit or update required disclosures is the same. The law separately bans the sale, offer for sale or licensing of “sensitive data,” carrying a civil penalty of $50,000 per record.

The shared thread: The ‘direct relationship’ carve-out

Most of the state data broker regimes turn on the presence or absence of a direct relationship between the business and the individual whose data is at issue. Under California, Connecticut, Oregon, Texas and Vermont, if the neurotech company sits at the source – the individual is (or was) a customer, a research subject under contract, an investor, a donor or in a similar direct relationship – the business is not a data broker when it licenses out that data. New Jersey is the outlier because of its additional category of “data collector.” As discussed above, New Jersey’s “data collector” category closes the direct relationship exception for any first-party neurotech company that sells or licenses personal data to a downstream data broker. Whether the New Jersey law applies to a business that has a relationship with the individuals whose data is being licensed depends on what the licensee does with the data downstream. Therefore, diligencing (and contractually constraining) the recipient's own resale and relicensing conduct is central to the New Jersey analysis.

State restrictions on sale of neural data

In addition to state data broker registration requirements and consumer opt-out rights, two states (Colorado and Montana) have separate laws that, if they apply, prohibit the sale of neural data of their state residents absent consent from the individuals whose neural data is to be sold, or impose such restrictions on the sale of neural data that it is impractical even with consent (Vermont, Delaware and Connecticut).

Colorado and Connecticut

The Colorado and Connecticut laws apply to essentially any business that sells or licenses out neural data.

Vermont

The Vermont law only applies to businesses that conduct business in Vermont or produce products or services that are targeted to residents of Vermont, and control or process the personal data of 35,000 or more Vermont residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the sensitive data (including neural data) of 3,000 or more Vermont residents, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or offer for sale in trade or commerce the personal data of 3,000 or more Vermont residents

Many businesses that wish to license neural data will likely not be covered by the Vermont law because they do not have a consumer-facing business and do not have a business presence in Vermont or do business with Vermont entities.

Delaware

The Delaware law applies to businesses that conduct business in Delaware or produce products or services that are targeted to residents of Delaware, and control or process the personal data of 10,000 or more Delaware residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the personal data of 5000 or more Delaware residents, and derive more than 20% of their gross revenue from the sale of personal information; or acquired personal data from another entity that is covered by the law

Some businesses that wish to license neural data will not be covered by the Delaware law because they do not have a consumer-facing business and do not have a business presence in Delaware or do business with Delaware entities.

Montana

The Montana law applies to entities that either offer consumer genetic testing products or services directly to a consumer or that collect, use or analyze genetic data. Many businesses that wish to license neural data will likely not be covered by the Montana law because they are not in the genetic testing business.

If neural data is health or biometric information

Neural data might possibly be considered health information if an individual’s health information can be derived from the neural data. Neural data might possibly be considered biometric information if an individual’s identity can be derived from the neural data. If neural data is considered health information or biometric information under applicable laws, additional legal protections are afforded to such data. These additional laws would further regulate data licensing, including by imposing requirements in some additional states to obtain consent before selling or licensing such data.

Federal regulation of the sale of health information

The Federal Trade Commission (FTC) has taken actions against businesses that have sold health information to adtech companies and sensitive location information to third parties. The FTC has reasoned that consumers were not told about the sale and not given a method to decide whether their data would be included in the sale, and thus this practice was an unfair trade practice under federal consumer protection law. To date, the FTC has not applied the same rule to neural data, but it is conceivable that it would if faced with the question.

The federal Health Insurance Portability and Accountability Act (HIPAA) and the Food and Drug Administration regulations on research studies apply to neural data depending on the context in which it is collected – and the nature of the business that has collected it. If these federal laws apply, the state laws do not, but the federal laws come with their own compliance burdens. Businesses that have a choice should architect their way of doing business to either operate under HIPAA or the state laws depending on their preferred regulatory regime.

Two threshold questions: ‘For free’ licensing and revenue/volume gates

Before turning to the de-identification question, two questions of statutory scope cut across every one of the state regimes and are worth flagging together.

1. Does licensing data for free take you out of the regimes?

For most of the state data broker regimes, no. A purported “free” license usually does not remove the arrangement from scope. California defines “sale” broadly to include “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating” a consumer’s personal information to a third party “for monetary or other valuable consideration.” California courts and the state attorney general have consistently interpreted “other valuable consideration” through the lens of California’s general contract law concept of consideration – any bargained-for benefit conferred on the transferor, whether or not money changes hands. In-kind exchanges of neural data for services, joint research outputs, model access or reciprocal datasets are therefore likely to qualify as a “sale.” Connecticut takes a similar approach, defining “license” as granting access to or distributing personal data “in exchange for consideration” – the Connecticut statute expressly contemplates nonmonetary consideration. Vermont and Oregon both use “sells or licenses” without a narrower monetary limitation, and the market has consistently read those terms to reach nonmonetary bargained-for exchanges as well.

Texas is broader still. Its data broker definition captures any business entity that “collects, processes, or transfers” personal data it did not collect directly from the individual. “Transfer” does not require consideration at all, so even a genuinely gratuitous handoff of neural data to a third party can trigger the Texas regime (subject to Texas revenue and volume thresholds, discussed next). New Jersey uses “sells or licenses” without a defined monetary limit, and “licenses” in this context is likely to be read as encompassing noncash arrangements.

The one narrow off-ramp that runs through all of these regimes is a true one-way transfer of data with no benefit flowing back to the transferor – for example, a pure charitable donation of a research dataset to an academic institution with no reciprocal services, no access rights, no attribution and no other consideration. Companies should not assume that framing a license as “no fee” or “complimentary” removes it from scope.

2. Do the state data broker laws apply only to businesses with a certain amount of revenue or volume of data?

The answer depends materially on the state.

California. The data broker regime imports the CCPA’s definition of “business,” which itself has thresholds – in general terms, annual gross revenue in excess of $26,625,000; buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information. A neurotech company below all three thresholds is not a “business,” and therefore not a “data broker,” under the California regime. That said, the 100,000-consumer prong is easy to trip for consumer-facing neurotech, and the 50%-of-revenue prong bites hard for pure-play neural data licensors.
Connecticut, New Jersey, Oregon and Vermont. No revenue or data-volume thresholds.
Texas. Subject to the 50%-of-revenue and 50,000-individual thresholds described above in Model 3.

The upshot: Outside of Texas (and the narrower California “business” threshold), state data broker regimes are not size-gated. A small neurotech company licensing neural data of persons with whom it has no direct relationship can be a data broker, subject to the full compliance stack, in Connecticut, Oregon, Vermont and New Jersey. And in New Jersey, even a first-party neurotech company is regulated as a data collector regardless of size.

The de-identification question

Under every one of these regimes, data that is not identifiable to a specific person, or that has been genuinely de-identified, is out of scope. The California law excludes de-identified data from “personal information;” Connecticut’s law excludes de-identified data from “personal data;” Vermont and Oregon exclude de-identified data through parallel mechanisms; and Texas has an explicit de-identification exception. The statutory standard is broadly similar across the states: The data must not be reasonably capable of being linked to an identifiable individual, and the controller must take reasonable technical measures to prevent linkage, publicly commit not to re-identify and contractually bind recipients to the same standard.

The threshold legal question for neurotech companies pursuing a licensing model is therefore whether their neural data can be de-identified to the applicable legal standard. That question is not settled. Reasonable technical experts disagree. What follows is the best case for each position.

The argument that neural data can be de-identified (and data laws therefore do not apply)

The strongest argument that neural data can be adequately de-identified runs through a simple fingerprint analogy: A fingerprint lifted from a crime scene identifies no one on its own. It becomes identifying only when a fingerprint database exists and the lifted print can be matched against it. Neural signatures work the same way. A neural signal “lifted” from an anonymized dataset can identify a specific individual only where a reference database exists that ties known individuals to their neural signatures. That kind of reference database does not exist today for the general population, and in most licensing scenarios it does not exist for the licensed-out population either. Where the reference set does not exist, the neural signal cannot be linked to any particular person as a matter of fact, regardless of how unique it is in theory. If the reference set does exist, but is not accessible to the entity that holds the neural data, then the neural data is not identifiable from that entity’s perspective.

The statutory standards support this reading. Connecticut requires that the data “cannot reasonably be used to infer information about, or otherwise be linked to,” an identifiable individual. The CCPA requires that the data “cannot reasonably be used” to identify or associate with a consumer. Both standards are grounded in reasonableness, and reasonableness is calibrated to the state of the world today, not to speculative future capabilities. If linking a neural signal to a person requires access to a reference dataset that no one has built for the population in question, the linkage is not reasonably available, and the data satisfies the statutory de-identification test.

The technical picture also cuts more finely than the skeptics allow. Neural signatures are not stable in the way that traditional biometrics are. A fingerprint is essentially fixed for life; a neural signature varies with sleep, mood, attention, age, medication and disease state. The high identification accuracy rates in the research literature are typically achieved within a single session and cohort, on high-fidelity recordings, using algorithms tuned to the specific data. Licensed-out neural datasets can be downsampled, aggregated, cropped to short windows or transformed into derived features that discard much of the individuating detail.

In practice, de-identification measures can combine several techniques at once: removing hidden identifying tags from files (metadata scrubbing), reporting group-level figures instead of individual records (aggregation), adding small amounts of random “static” to obscure exact values (statistical noise), ensuring each described group is large enough that no one person stands out (k-anonymity-style controls), and dropping unusually rare records that would be recognizable on their own (outlier suppression). And where the underlying data is already coarse to begin with – for instance, a summary index (such as an attention or workload score) rather than a raw, moment-by-moment brain signal – the remaining risk of identifying a person can be substantially lower, and in some cases may fall below what the applicable law counts as personal or neural data.

The statutory de-identification standard also depends on business controls that neurotech companies can and do implement. Public commitments not to re-identify, contractual undertakings from downstream recipients, technical safeguards against linkage and monitoring for compliance are all feasible in commercial licensing arrangements. Where those controls are in place and the underlying data is not intrinsically identifying to the population in question, it can be said that the data satisfies the statutory de-identification test, or that it was not identifiable to start. In short, the de-identification off-ramp is available for neural data – it just requires a defensible technical basis and disciplined contractual architecture, not a blanket assumption.

The arguments that neural data cannot be de-identified (and data laws therefore apply)

The identifiability skeptics rest on a growing body of neuroscience research suggesting that neural signatures function as biometric fingerprints. A widely-cited 2015 fMRI study identified individuals from their whole-brain functional connectivity patterns with 93 – 94% accuracy in cohorts drawn from the Human Connectome Project (Finn et al., Functional Connectome Fingerprinting: Identifying Individuals Using Patterns of Brain Connectivity, 18 Nature Neuroscience 1664 (2015)). Each target scan was matched to the most similar entry in a database of prior scans from the same subjects, so the result speaks to the risk of linking a new scan to an existing record rather than to identification from a neural recording alone.

A 2014 EEG study achieved 100% accuracy in matching people to their brain recordings by looking at how different parts of the scalp “talked to” one another at specific frequencies, rather than at any single sensor on their own (La Rocca et al., Human Brain Distinctiveness Based on EEG Spectral Coherence Connectivity, 61 IEEE Transactions on Biomedical Engineering 2406 (2014)). As with the fMRI work described above, that accuracy was measured against a closed reference set – each new recording was matched to the most similar entry in a database of prior recordings from the same people – so the result speaks to the risk of linking a new scan to an existing record rather than to identifying a stranger from a brain recording alone. Later reviews of the EEG-identification literature report similar or slightly lower accuracy figures, typically in the high-80s to high-90s, across a range of methods and datasets.

And identification does not require long recordings. A 2021 MEG study reported that just thirty seconds of resting-state brain activity was enough to correctly pick a participant out of a closed cohort roughly 84% of the time – compared with about 95% when longer segments were used (da Silva Castanheira et al., Brief Segments of Neurophysiological Activity Enable Individual Differentiation, 12 Nature Communications 5713 (2021)).

There is also a distinct identifiability pathway that has nothing to do with neural fingerprinting. In speech and communication brain-computer interfaces (BCIs), the decoded output is not a signal signature but the user’s own words. Everyday speech and messaging routinely surface autobiographical detail – the speaker’s own name, references to family members, an employer or workplace, a medical diagnosis, or other personal facts – that identifies the person on the face of the transcript, without any comparison to a reference dataset. For that class of neural product, the identifying information is embedded in the content itself.

That distinction – between recognizing someone by the pattern of their brain activity and identifying them from what they said – is one instance of a broader point that the current debate tends to skip past: Not all “neural data” is the same thing, and different forms of it carry very different re-identification risk. A raw recording taken directly from the electrodes; a set of summary measurements calculated from that recording (for example, how much activity is present in different frequency bands, or how strongly different brain regions move together); the trained software model that translates brain activity into speech, movement or a category label; the decoded output itself (the actual text, speech or cursor movement the system produces); and a high-level conclusion drawn from the data (for example, a single “alertness” or “focus” score) each sit at a different point on the identifiability scale, even when they all come from the same recording session. What is enough to strip identifying information out of an alertness score will not be enough for a raw recording, and the reverse is equally true. The same regulated term – “neural data” – is doing very different work as the information moves through these stages, and any workable de-identification analysis has to look at the specific form at issue, not just at the category label.

The intrinsic uniqueness of neural data has three consequences under the statutory de-identification tests. First, small datasets are trivially re-identifiable within their own populations: A neurotech company holding neural recordings from 200 research subjects may be able to associate neural data with specific individuals without any external reference. Second, reference datasets are actively being built. Large-scale consumer neurotech products, invasive BCI companies and academic-industrial collaborations are generating neural datasets at scale, and open science initiatives are publishing sizable reference corpora, which means that even a “bare” neural sample that is not identifying today may be identifiable tomorrow through comparison to a growing reference base. Third, neural data reveals sensitive attributes – cognitive state, health conditions, emotional response profiles – that themselves can be linked with other data to re-identify a specific person, especially in small populations with distinctive clinical characteristics.

Finally, the regulatory apparatus is unusually demanding on the de-identification side. It requires reasonable technical measures to prevent re-identification, a public commitment not to re-identify, contractual downstream controls that flow those obligations to every recipient and ongoing monitoring of the recipient’s compliance. Neural data licensing arrangements need to be designed to meet those requirements in practice, particularly the downstream contractual and monitoring components. On the other hand, under the California law for example, if data de-identification has rid a business of any of the personal identifiers that consumers can use to request data brokers to delete their data, such as email addresses and phone numbers, the data broker will be hard-pressed to delete data even in the face of a deletion request, possibly making it impossible for the business to comply with the law.

Where this lands

Reasonable minds will continue to differ, and the answer for any particular licensing arrangement is fact specific. It depends on the type of neural data – identification accuracies vary meaningfully across modalities, and EEG, fMRI, MEG and fNIRS each carry different identifiability profiles even before considering feature engineering, so the answer for a raw EEG recording is not the answer for a downsampled fMRI feature vector. It also depends on the amount of neural data per subject. The size and distinctiveness of the licensed-out population, the availability of a reference dataset that could support linkage, and the technical and contractual architecture the licensor puts around the data round out the analysis. What is clear is that a blanket “we’ll de-identify” strategy is not a substitute for the analysis. Companies pursuing a de-identification path should pressure-test it with both technical experts and privacy counsel – dataset by dataset, modality by modality and duration by duration – and paper the required public commitments, contractual controls and monitoring practices before treating the licensed data as out of scope.

A note on the parallel state consumer privacy law regimes

Separate from the state data broker registration laws discussed above, the sibling comprehensive state consumer privacy laws in 23 states will apply independently to any business that qualifies as a “controller” of neural data, and meets the triggering metrics of the law, meaning a business that (alone or jointly with others) determines the purposes and means of processing that neural data. “Processing” in each of those statutes is defined broadly to include the collection, use, storage, disclosure, sale and licensing of personal data, so licensing neural data downstream is a processing activity that a controller performs. Controllers of neural data are subject to notice, consent, purpose-limitation, minimization, sensitive-data opt-in and data protection assessment obligations under those laws (subject to the state-by-state applicability thresholds), regardless of whether the business is also a “data broker” under the state’s data broker regime. In short, a neurotech company that stays below a data broker regime’s coverage line can still be a controller of neural data subject to the parallel privacy law’s substantive obligations.

Practical takeaways for neurotech companies

Map your data flows against each state’s definitional model. Identify every neural dataset your company licenses, sells or grants access to, and separate them into datasets about individuals with whom you have a direct contractual or similar relationship and datasets about individuals with whom you do not. Also, identify the states of residence of the individuals whose neural data is to be licensed, so that the applicable laws’ requirements can be met.
Do not rely on de-identification as an off-ramp without stress-testing it. Confirm the type of neural data you are licensing, the size and distinctiveness of the licensed-out population, whether a reference dataset exists (or is plausibly being built) that could support linkage, and whether your technical and contractual controls meet the applicable statutory standards. Paper the public commitments and downstream contractual undertakings the statutes require.
Choose your regulatory regime. If your business has a choice between HIPAA and the state data law regime, examine both carefully, choose which regime best meets your data needs, and architect your way of doing business to fit into, and comply with, your preferred regulatory regime.

Law Firms Vie for Tech Talent in AI Race

Fri, 25 Sep 2026 16:44:00 Z

Cooley chief innovation officer David Wang was quoted in Reuters about the firm’s push to recruit technology talent as law firms ramp up their AI capabilities. Wang highlighted Cooley AI, a firm-owned AI company developing technology that addresses complex legal challenge.

Read the article (subscription required)

Earendil Labs Announces Research Collaboration With Genentech

Fri, 25 Sep 2026 04:40:00 Z

Shanghai – September 24, 2026 – Cooley advised Earendil Labs, an artificial intelligence-powered biotechnology company advancing next-generation biologics, on its research collaboration with Genentech, a member of the Roche Group, to discover and develop multiple therapeutic bispecific antibody programs in oncology.

As part of the Agreement, Earendil Labs will receive a $55 million upfront payment, with the total potential value of the collaboration, including upfront, development, regulatory and sales milestone payments in excess of $1.5 billion. Earendil Labs is also eligible to receive tiered royalties on net product sales.

Lawyers Yiming Liu, Geoffrey Spolyar and Zack Gong led the Cooley team advising Earendil Labs, with support from Shawn Yu and Zhijing Yu.

Cooley previously advised Earendil Labs on its strategic collaboration with Sanofi in January 2026 and its exclusive license agreement with Sanofi in April 2025.

DOL Finalizes Rescission of EO 11246 Affirmative Action Rules, Narrows Section 503, Updates VEVRAA Thresholds

Thu, 24 Sep 2026 07:00:00 Z

On August 21, 2026, the Department of Labor (DOL) published three final rules in the Federal Register modifying federal contractors’ affirmative action obligations: formally rescinding the implementing regulations for Executive Order (EO) 11246, following EO 11246’s rescission last year; narrowing Section 503 of the Rehabilitation Act of 1973 to align with applicable law and recent EOs; and making technical changes to the Vietnam Era Veterans’ Readjustment Assistance Act (VEVRAA), including updating jurisdictional thresholds.

Rescission of EO 11246 implementing regulations – effective October 26, 2026

EO 11246 has long required covered contractors to maintain written affirmative action programs (AAPs) addressing race- and sex-based criteria. Following EO 11246’s rescission in January 2025, the DOL now formally rescinded the implementing regulations for EO 11246, which include placement goal and utilization analysis requirements for nonconstruction contractors. The agency cited additional rationales for the rescission, including eliminating legal vulnerabilities, improving efficiency of the government contracting process, decreasing employer burden and aligning the regulations with recent EOs.

Section 503 regulations modifications – effective September 21, 2026

The rule makes the following key changes to contractors’ disability affirmative action obligations under Section 503 of the Rehabilitation Act:

Eliminates the requirement that contractors invite applicants and employees to self-identify their disability status.
Rescinds the 7% utilization goal for individuals with disabilities and the corresponding utilization analyses.
Updates the Section 503 coverage threshold from $15,000 to $20,000 for inflation.
Removes references to EO 11246 and adds administrative procedures at 41 CFR Part 60-30, effective December 21, 2026.

The DOL stated the modifications fulfill EO 14219’s mandate to rescind regulations not authorized by clear statutory authority. The agency noted that the disability self-identification requirement and utilization goal were inconsistent with the Americans with Disabilities Act (ADA), and that the utilization analysis requirements were “now unworkable” given their dependence on the revoked EO 11246.

Importantly, the rule does not change reasonable accommodation requirements or the obligation to develop and maintain an AAP as to individuals with disabilities or protected veterans. Nondiscrimination provisions also remain intact, along with outreach requirements (Subpart C), complaint procedures (Subpart D) and most recordkeeping requirements.

VEVRAA regulations revisions – effective September 21, 2026

The VEVRAA revisions are modest. They remove cross-references to EO 11246, relocate administrative enforcement procedures to 41 CFR Part 60-300, and codify the coverage threshold increase from $150,000 to $200,000 (which had already been implemented in October 2025).

Next steps

The three rules have different effective dates and should be tracked accordingly. By September 21, 2026, contractors should discontinue use of the CC-305 disability self-identification form and review policies and HR systems for compliance with remaining disability affirmative action obligations. By October 26, 2026, contractors should retire any remaining race- and sex-based AAP obligations. Contractors should also consult employment counsel regarding previously collected self-identification data and remain mindful that Title VII, the ADA, and applicable state and local antidiscrimination laws continue in full force. VEVRAA obligations remain largely unchanged.

If you have any questions about these developments, please reach out to a member of the Cooley employment team.

USDA Disclosure Rule Could Snag Energy Project Deals

Thu, 24 Sep 2026 03:49:00 Z

Mona Dajani, partner and co-chair of Cooley’s infrastructure, real estate and energy practice, was quoted in a Law360 article on how proposed US Department of Agriculture foreign ownership disclosure requirements could increase due diligence and compliance considerations for energy infrastructure projects. Dajani noted that foreign ownership analysis could shift from a specialized issue in certain transactions to a routine part of diligence from the earliest stages of project development.

Read the article (subscription required)

Numeral Raises $100 Million Series C

Wed, 23 Sep 2026 17:45:00 Z

San Francisco – September 23, 2026 – Cooley advised Numeral, the AI-powered sales tax compliance platform, on its $100 million Series C, led by Insight Partners, with participation from Salesforce Ventures, Geodesic, Benchmark, Mayfield, FCVC, Y Combinator and Uncork. Numeral will use the funding to accelerate product development, expand its offering for industries including software, manufacturing, distribution and wholesale, and grow its team.

Lawyers Peter Werner, Mariah Kitchin and Joe Honeycutt led the Cooley team advising Numeral.

Cooley Bolsters Congressional Investigations Practice With Veteran Republican Capitol Hill Counsel

Wed, 23 Sep 2026 17:26:00 Z

WASHINGTON, DC – September 23, 2026 – Cooley today announced that Jessica Donlon joined the firm as a partner in its congressional investigations practice and global litigation department in Washington, DC.

Donlon’s arrival further strengthens Cooley’s Chambers-ranked bipartisan congressional investigations practice, deepening its firsthand congressional experience and ability to counsel clients through high-stakes oversight matters. She brings more than 15 years at the highest levels of congressional oversight and investigations, including senior leadership roles with the House committees on Energy and Commerce and Oversight and Government Reform, as well as the White House Office of Management and Budget (OMB).

“Since Susanne arrived in 2024, she has catapulted Cooley’s congressional investigations practice to the top of the market,” said Ian Shapiro, partner and chair of the firm’s global litigation department. “Now, as she reunites across the aisle with Donlon, few, if any, firms will have as much experience at the center of congressional oversight over the last 15 years. We are excited to deploy Donlon, Grooms and the rest of their team in the service of Cooley’s innovative clients.”

Donlon joins the firm from the US House of Representatives, where she served as general counsel to the House Energy and Commerce Committee under Chairman Brett Guthrie, and previously served as general counsel and deputy staff director to the House Oversight and Government Reform Committee under Chairman James Comer. She also served as deputy general counsel for oversight at the White House OMB, where she managed the administration’s response to congressional requests, briefings and hearings.

“Navigating congressional scrutiny requires sound judgment, credibility and a deep understanding of the people and institutions that drive decisions in Washington,” said Susanne Sachsman Grooms, partner and chair of Cooley’s congressional investigations practice. “Having worked alongside Jessica for many years, I know that her impeccable reputation and long-standing relationships across the Hill and throughout DC will be invaluable as we help clients anticipate and navigate the new oversight dynamics that could emerge following the midterm elections. We are very excited to have our clients benefit from Jessica’s extensive experience on the Hill and at OMB and the breadth of perspective that she brings to our team.”

“Cooley is the natural choice for my move into private practice,” said Donlon. “The firm advises many of the most innovative companies and industries increasingly at the center of congressional attention, and I’m excited to bring my experience to those clients while working alongside Grooms and other exceptional colleagues in the congressional investigations practice and across the global litigation department.”

Cooley’s congressional investigations practice counsels companies and individuals through their most sensitive and high-profile matters involving significant business and reputational risk. Its bipartisan team brings deep experience with the principal investigative committees in both chambers of Congress and under leadership from both parties. The team has successfully handled numerous investigations across major industries for public companies, privately held businesses, individuals and other entities facing congressional oversight. Donlon will join a team that includes numerous practitioners with deep experience on the Hill, including Heather Sawyer, Janet Kim, Sean Quinn and Vince Sampson.

Cooley’s global litigation department includes more than 500 lawyers in the US and Europe representing technology, life sciences and other innovative companies. Since 2025, Cooley has added numerous elite, next-generation lawyers to its litigation department throughout the US, including Elizabeth Prelogar, Raymond Tolentino, Ephraim McDowell, Brian Nelson, Janet Kim and Meredith Halama in DC; Simona Agnolucci, Ben Hur, Jonathan Patchen, Eduardo Santacana, Joshua Anderson and Tiffany Lin in San Francisco; Michael Rome and Brian Klein in Los Angeles; Lyndsey Kruzer, Andrea Reid, Andrew Wilkins and John Rearick in Boston; and James Kim, Tejal Shah, Sean Quinn and Michael La Marca in New York.