News Briefs

23x5 Trading Is Almost Here: Practical Considerations for Public Companies

Wed, 11 Nov 2026 05:02:00 Z

As a reminder, US equity markets are moving toward 23-hour, five-day-a-week trading, beginning in early December. The Securities and Exchange Commission (SEC) has approved rule changes permitting several national securities exchanges – including Nasdaq, NYSE Arca, Cboe EDGX – to expand their trading hours, adding overnight trading from 9:00 pm to 4:00 am ET. Because these venues can trade public company equities regardless of the company’s primary listing exchange, this change will affect all public companies with securities listed on a national securities exchange. A public company’s shares may trade overnight even if its primary listing exchange is closed.

The change is significant from a market structure perspective, but the exchanges have designed their frameworks to preserve many familiar market conventions and protections. Based on what we are hearing generally from major investment banks, exchanges and public companies, the launch of 23x5 trading is best viewed as one step in a longer evolution toward increasingly continuous US equity trading, rather than a cliff that requires an immediate reset of customary public company practices. Those practices are more likely to evolve if and when overnight trading develops meaningful volume, liquidity and institutional participation. For now, most companies are adopting an approach of careful observation, rather than making significant substantive changes to practices or policies.

What ‘overnight trading’ means

Beginning Sunday, December 6, at 9:00 pm ET, Nasdaq plans to add a new “Night Session” from 9:00 pm to 4:00 am ET. Certain other exchanges are scheduled to operate substantially similar overnight sessions. This means that market participants will be able to trade equities from 9:00 pm through 8:00 pm the following day, with a one-hour operational pause from 8:00 pm to 9:00 pm.

Based on the Nasdaq model and definitions, which are similar to those of the other participating exchanges, the Night Session extends the exchange’s existing pre-market session from 4:00 am to 9:30 am, and post-market session from 4:00 pm to 8:00 pm. The existing pre- and after-market hours, together with the new Night Session, will comprise what Nasdaq calls its Extended Hours. Importantly, the existing 9:30 am to 4:00 pm period will remain Nasdaq’s regular market hours. The one-hour pause from 8:00 pm to 9:00 pm will allow for system maintenance, corporate-action processing, clearing and settlement functions, and transition to the next trade date.

Overnight trading will not affect:

The “regular” or “core” market hours/trading session, which remains 9:30 am to 4:00 pm ET.
For Nasdaq-listed securities, Nasdaq’s opening and closing crosses remain at 9:30 am and 4:00 pm, respectively. More broadly, extended trading does not change the role of the primary listing market in establishing a security’s official closing price.
The T+1 settlement cycle, which remains in effect and runs from the assigned trade date. Trades executed from 9:00 pm through 11:59 pm are assigned the next calendar day’s trade date, while trades from midnight through 8:00 pm receive the current calendar day’s trade date.

As noted above, overnight sessions are not limited to securities listed on the participating exchanges: National Market System (NMS) stocks may trade on exchanges other than their primary listing market. For example, the New York Stock Exchange (NYSE) is not currently scheduled to add an overnight session, but NYSE-listed stocks may trade overnight on other exchanges, and NYSE-listed companies must comply with rules that NYSE is implementing to accommodate 23x5 trading.

The launch of 23x5 trading also does not itself change public companies’ disclosure or reporting obligations. Regulation FD, Form 8-K requirements and other existing disclosure requirements continue to apply.

Watch the market

We expect market behavior, rather than the technical availability of overnight trading, to drive changes in public company practice over time. For most companies, overnight trading is unlikely to immediately become a meaningful market. SEC staff data indicate that existing overnight trading accounts for less than 1% of total NMS stock volume and is highly concentrated in a relatively small number of securities. Market participants also have identified thinner order books, wider spreads and potentially greater volatility as considerations as exchange-based overnight trading develops. Institutional participation, in particular, is expected to develop over time, rather than creating significant volume in the near term.

If significant volume and institutional liquidity migrate overnight, either for the market as a whole or for a particular company, companies and their advisors may eventually reconsider when material information is released, how confidentially marketed and overnight offerings are executed, how insider-trading controls operate and how documents define concepts such as a “Trading Day,” VWAP (volume-weighted average price) or regular trading hours. At least initially, however, we do not expect most customary practices to change solely because overnight exchange trading becomes available.

What should public companies do now?

Some companies are making minor changes to insider trading policies, employee communications or trading plans to introduce “for avoidance of doubt” language around regular trading hours. More broadly, companies should review policies, documents and procedures that use trading-day or market-hour concepts and confirm that escalation and exchange-coordination processes continue to work as intended. There are a few areas to monitor for potential changes to practice:

Material announcements and procedures

Information released later in the evening may now encounter a live exchange market. For the reasons discussed above, we expect most companies to continue following established practices while overnight trading patterns develop. Companies should, however, confirm that internal escalation procedures remain workable, and that appropriate legal, investor relations and primary listing exchange contacts are current for significant developments that may arise outside regular business hours. This may be particularly relevant when a major marketwide or company-specific development is expected to affect overnight trading volume, or if the company begins to experience heightened trading volume domestically or from international investors.

Corporate actions

National exchanges – even those that are not operating overnight – are building procedures to ensure the market remains orderly during extended hours. Under Nasdaq Rule 4120 and similar rules at other exchanges, companies contemplating corporate actions – including trading symbol changes, CUSIP changes, certain dividends with an aggregate per-share value equal to at least 25% of the security’s official closing price, forward and reverse stock splits, de-SPACs, mergers and other changes – should be aware that specified actions will trigger a mandatory overnight trading halt. Companies should continue to coordinate with their primary listing exchange on notifications, but also recognize that the timing and mechanics now need to accommodate an overnight market and related procedures.

When a halt is triggered, the primary listing market will initiate it before overnight trading begins, and exchanges that otherwise could trade the stock overnight honor the halt until trading resumes on the primary listing market. The halt framework is designed to ensure adequate time to process the changes before trading begins the next day.

Capital markets documents and practices

We expect investment banks to continue evaluating whether – and how – extended trading hours affect execution practices for block trades, confidentially marketed offerings and other transactions. Based on current discussions, we do not expect 23x5 trading – by itself – to displace customary transaction-execution practices. That assessment could change if overnight liquidity becomes sufficiently deep to matter to pricing and bookbuilding.

Overnight marketed offerings have historically been structured around a period when the underlying stock is not trading on US exchanges. A meaningful overnight market could eventually affect assumptions around confidentiality, pricing and transaction execution. At launch, however, the existence of exchange trading at 2:00 am will not necessarily make the overnight market a useful reference point for an institutional bookbuild. Extended trading hours also do not change T+1 settlement; settlement continues to run from the assigned trade date.

Equity incentive plan administration

For many public-company equity incentive plans, the principal issue is likely to be the effect, if any, on a plan’s definition or use of “fair market value.” Many plans define fair market value by reference to a security’s closing price on the applicable trading date, or the most recently preceding trading date if the relevant date is not itself a trading day. Because official closing prices remain tied to the regular-hours close, the move to 23x5 trading may have little practical effect on definitions drafted that way.

A definition tied expressly to the applicable exchange’s official closing price may continue to work as intended, while language referring more generically to the “close of trading,” “end of the trading day” or similar concepts deserves a closer look. Depending on the plan language, no action may be necessary; where clarification is warranted, a formal interpretation by the plan administrator may be sufficient in many cases, rather than a plan amendment. Whether any ambiguity can be addressed through an administrator interpretation or instead warrants an amendment will depend on the plan language, delegated authority and other applicable considerations and should be evaluated with counsel.

Questions for the longer term

The SEC’s September 2026 Roundtable on Preparations for 24-Hour Trading highlighted a number of issues that may become more important if overnight trading develops meaningful volume and liquidity. Several of the questions were raised by individual commissioners and do not represent SEC positions or new issuer requirements. Among them:

Issuer disclosure practices. Commissioner Hester Peirce asked whether issuers that traditionally make filings and announce earnings or other material developments before or after core hours may ultimately need to change that behavior as overnight trading develops.
EDGAR hours. EDGAR accepts transmissions from 6:00 am to 10:00 pm ET on business days, but most live submissions after 5:30 pm receive the next business day’s filing date and are not disseminated until the next business day, subject to specified exceptions. Chairman Paul Atkins invited feedback on how expanded trading may affect public companies’ execution of corporate actions and their obligations to disseminate material information and make SEC filings. No change to EDGAR hours or issuer filing obligations has been announced.
Potential issuer guidance or relief. Commissioner Peirce asked whether the SEC should provide guidance or relief to address burdens that extended trading hours may create for issuers, particularly smaller companies.
Overnight monitoring. Commissioner Peirce also raised the practical question of whether issuers should monitor overnight trading in their securities in the event of extreme price movements, which would implicate staffing, escalation and surveillance practices. The SEC has not prescribed a new issuer obligation.
Market quality and investor protection. Commissioners and roundtable participants raised questions about liquidity, spreads, volatility, best execution, resiliency, staffing and surveillance in an overnight market, and whether additional SEC or Financial Industry Regulatory Authority (FINRA) guidance would be appropriate.
Liquidity and capital formation. Market participants and regulators identified impacts on liquidity and capital formation as potential “day 2” issues as trading expands, which reinforces that the December 6 launch of 23x5 trading marks an evolution of market structure rather than an end-state.

The near-term takeaway

We think 23x5 is best viewed as part of an ongoing market evolution. Absent meaningful changes in overnight volume, liquidity and institutional participation, established practices around disclosure, insider trading and capital markets transactions are likely to continue largely as they do today in the near term. The immediate task is more targeted: Companies should understand that their shares may trade overnight, and confirm that policies, documents and procedures continue to work as intended.

FCC Advances US Cyber Trust Mark Program, Labeling and Certification Requirements

Wed, 11 Nov 2026 04:11:00 Z

The Federal Communications Commission (FCC) is taking new steps to implement its US Cyber Trust Mark program for consumer Internet of Things (IoT) products. On October 27, 2026, the FCC released a Public Notice seeking comment on proposed requirements for displaying the Cyber Trust Mark, renewing product certifications and monitoring certified products after they enter the market.

FCC Chairman Brendan Carr also announced that Commissioner Olivia Trusty would lead the program’s rollout and implementation. These announcements signal renewed momentum for the program and Trusty has signaled that the Cyber Trust Mark could begin appearing on consumer products within a year. However, the FCC still must finalize its requirements before the program can become operational.

As discussed in our March 2024 client alert, the program will allow eligible consumer IoT products that meet baseline cybersecurity requirements to display the Cyber Trust Mark. The mark will be accompanied by a QR code directing consumers to information about the product’s security features. The goal is to help consumers make more informed purchasing decisions and encourage manufacturers to prioritize cybersecurity.

Proposed labeling requirements

The FCC is seeking comment on the design and placement of the Cyber Trust Mark, including how manufacturers should display the label on product packaging and online retail platforms. The FCC proposes adopting labeling recommendations based in part on industry-developed standards. Under the proposal, the physical label would include both the Cyber Trust Mark and a scannable QR code. The FCC is also considering smaller label formats for products with less packaging space.

The FCC seeks comment on how to provide manufacturers with flexibility while maintaining a consistent and recognizable label for consumers. The Public Notice also addresses how the Cyber Trust Mark could appear in online stores, product catalogs and advertising materials. These requirements could be particularly relevant for manufacturers that sell products through third-party retailers.

The FCC also is considering additional information that consumers would be able to access through the QR code. The proposed cybersecurity information page, sometimes called a “cyber nutrition label,” would provide information about a product’s security features and support period. The FCC proposes requiring disclosure of whether a product has camera, audio or location-tracking capabilities. The FCC also seeks comment on presenting the information in English and Spanish and making it accessible to consumers using assistive technologies.

Certification renewal proposal

The Public Notice also proposes requirements for maintaining certification after a product receives authorization to display the Cyber Trust Mark. Although the program is voluntary, participating manufacturers would have ongoing responsibilities to demonstrate that their products continue to meet applicable cybersecurity standards.

The FCC proposes requiring manufacturers to renew their certifications every three years rather than the five-year period recommended by industry stakeholders. The FCC expressed concern that a longer renewal period might not adequately account for evolving cybersecurity threats. Under the FCC’s proposal, manufacturers would need to submit renewal applications at least 90 days before their certifications expire. Cybersecurity Label Administrators (CLAs), which are responsible for reviewing applications and authorizing use of the mark, would have 90 days to complete their evaluations.

These proposals suggest that manufacturers seeking certification may need to plan for continued testing and documentation throughout a product’s life cycle for products that remain on the market for extended periods, rather than treating certification as a one-time process.

Ensuring post-market compliance

The FCC is also considering procedures to ensure that products displaying the Cyber Trust Mark continue to comply with program requirements after entering the market. The Public Notice addresses post-market surveillance by CLAs, including product sampling and independent testing. The FCC proposes that surveillance testing be conducted by a recognized CyberLAB or CLA-operated laboratory rather than a manufacturer’s in-house laboratory.

The FCC also seeks comment on additional reviews following significant cybersecurity incidents. Under the proposed approach, the FCC could initiate a surveillance evaluation in response to a major cyber event affecting consumer IoT products. The Public Notice further addresses procedures for handling complaints and responding when certified products no longer meet program requirements. Potential consequences could include termination of a product’s authorization to display the Cyber Trust Mark and removal of the mark from affected products or marketing materials.

Next steps

The Consumer Technology Association (CTA) and the program’s new Lead Administrator (ioXt Alliance) have proposed technical standards for the Cyber Trust Mark and IoT Cybersecurity Labeling Programs. The FCC is expected to seek comment on technical cybersecurity requirements and testing procedures in the coming months.

Manufacturers of eligible consumer products should continue monitoring the proceeding as the FCC develops the program's final requirements. Companies considering participation in the program may want to begin evaluating which products would be appropriate for certification, and whether their existing cybersecurity testing and software support practices would satisfy the proposed requirements.

Comments on the Public Notice will be due 30 days after publication in the Federal Register, with reply comments due 45 days after publication.

If you are interested in submitting comments on this proceeding or have any questions about the US Cyber Trust Mark program and its potential implications, please contact Cooley attorneys Christy Burrow, Henry Wendel, J.G. Harrington and Giselle Valdez.

Ninth Circuit Leaves SB 253 Scope 1 and 2 Reporting in Place, Blocks Scope 3 and SB 261

Tue, 10 Nov 2026 08:00:00 Z

On November 9, 2026, the US Court of Appeals for the Ninth Circuit significantly narrowed California’s climate disclosure regime in its decision addressing challenges to Senate Bill 253 (greenhouse gas emissions reporting) and Senate Bill 261 (climate-related financial risk reporting). The court left SB 253’s Scope 1 and 2 reporting requirements in place but held that SB 253’s Scope 3 reporting requirement and SB 261 are likely unconstitutional under the First Amendment, and that preliminary injunctive relief is warranted as to those requirements.

For companies subject to these laws, the key implications are:

SB 253 Scope 1 and 2 reporting remains on track. The court affirmed the denial of a preliminary injunction against these requirements. Accordingly, the California Air Resources Board’s November 10, 2026, first-year reporting deadline remains in effect. Companies subject to SB 253 should proceed with their planned Scope 1 and 2 submissions.

SB 253 Scope 3 reporting is likely to be enjoined. The court held that the requirement, which was scheduled to begin in 2027, is likely unconstitutional, and that preliminary injunctive relief is warranted. On remand, the district court must determine whether the Scope 3 provisions are severable from the remainder of SB 253 before entering appropriate relief. If the district court enjoins SB 253 Scope 3 reporting, companies will not be required to make these disclosures absent a change on further review.

SB 261 remains enjoined. The court likewise held that SB 261’s disclosure requirements are likely unconstitutional, and that preliminary injunctive relief is warranted. Accordingly, companies are not expected to be required to comply with SB 261 absent a change on further review.

The litigation is not over, and California may seek rehearing or US Supreme Court review. For now, companies should continue complying with SB 253’s Scope 1 and 2 reporting requirements. SB 253 Scope 3 reporting and SB 261 are not expected to become enforceable absent a change on further review, although the district court’s severability determination could affect the future status of SB 253’s remaining requirements.

Cooley’s ESG and sustainability advisory attorneys are available to discuss these requirements. Reach out to your existing Cooley contact or email Cooley’s ESG and sustainability advisory team.

Garden State Opens Employee Separation Reporting Portal

Wed, 04 Nov 2026 08:00:00 Z

New Jersey’s Department of Labor and Workforce Development (NJDOL) has activated an online portal requiring employers to electronically report employee separations and information required to determine unemployment benefit eligibility. The portal implements a law that took effect in July 2023. Below, we outline the key aspects of this new requirement.

Who must report and when

All New Jersey employers, regardless of size, must use the portal to report every employee separation – including layoffs, terminations, resignations and retirements – whether or not the employee is expected to seek unemployment benefits. Employers must submit separation information within seven days of the separation date and should not wait for a former employee to file an unemployment claim before reporting. Employers conducting mass layoffs may report up to 1,000 separations in a single submission. Employers must register for portal access through the NJDOL; those using a third-party administrator for payroll should register for access and then grant access rights to that administrator.

Consequences of noncompliance

If an employer fails to submit separation information within the required timeframe, the NJDOL will issue a determination based on the available information. The employer will receive the determination and appeal rights by mail and must file any appeal within seven days of receipt; otherwise, the determination becomes final. Employers also face penalties for willful failure to furnish reports.

Separately, employers must continue providing departing employees with the BC-10 form (Instructions for Claiming Unemployment Benefits) but are not required to submit a copy to the NJDOL.

Claims process

Once a claim is filed, the claimant will receive a secure link to an online fact-finding application. The employer’s separation response will be shown to the claimant as part of that process. If follow-up is required, an examiner may contact the employer by email or phone, and the employer will have two business days to respond with any requested information.

Action steps

Employers with New Jersey operations or employees should:

Register for the portal. Register for access to the NJDOL separation reporting portal. If using a third-party administrator, the NJDOL advises employers to register for employer access first, then grant access rights to the third-party administrator.
Update offboarding procedures. Integrate portal submissions into separation and termination workflows to meet the seven-day filing window.
Train relevant personnel. Ensure individuals processing separations are familiar with the portal’s data fields and filing requirements.

If you have any questions about the requirement or how to comply, please contact your Cooley employment lawyer or one of the lawyers listed below.

Connecticut’s AI Rules Take Shape: What Employers and Developers Need to Know

Tue, 03 Nov 2026 16:13:57 Z

On May 27, 2026, Connecticut Gov. Ned Lamont signed SB 5 (Public Act No. 26-15), a sweeping AI law with new obligations for employers that use AI in employment decisions and for the developers that build those tools. This alert summarizes SB 5’s key employment-related provisions and outlines practical next steps. It does not address SB 5’s other provisions, such as those regulating subscription-based AI providers, AI companion products and synthetic digital content.

What tools are covered?

Coverage under SB 5 turns on three definitions:

Automated employment-related decision technology (AEDT): Any technology that processes personal data and uses computation to generate an output (e.g., a prediction, recommendation, ranking or score) that is a “substantial factor” used to make or materially influence an “employment-related decision.” Excluded are word processing, spreadsheet, database and similar software that does not make or materially influence such decisions; systems used only incidentally to a decision; and purely descriptive, diagnostic or statistical information not relied upon in a decision.
Substantial factor: Any factor, including a constraint, ranking, score, recommendation or classification, that meaningfully alters the outcome of an employment-related decision concerning an individual in Connecticut.
Employment-related decision: Any decision, based on an individual’s personal data, to hire, promote, discipline, discharge, renew employment, select for training or apprenticeship, or otherwise affect tenure or the terms, privileges or conditions of employment. Excluded are decisions resulting in nonmaterial changes to job tasks, responsibilities, hours, or assignments and decisions concerning workplace health and safety, scheduling and planning, or productivity monitoring.

Notably, the “materially influence” standard appears broader than New York City’s AEDT law, which covers only tools that “substantially assist or replace discretionary decision making,” and may reach tools that merely inform a human decision-maker.

Employers’ disclosure and notice obligations beginning October 1, 2027

These obligations apply to “deployers”: any person doing business in Connecticut that deploys an AEDT in the state. Unfortunately, SB 5 defines neither phrase, leaving unclear whether the obligations reach out-of-state employers with Connecticut-based remote workers or applicants, or Connecticut applicants for out-of-state roles. Until further clarity emerges, multistate employers may wish to take a conservative approach and assume coverage.

Disclosure of AEDT interactions

Employers must disclose in plain language to employees and applicants in Connecticut when they are interacting with an AEDT (e.g., an AI chatbot or automated interview platform), unless that would be obvious to a reasonable person.

Pre-decision written notice to employees and applicants

Before using an AEDT to make, or as a substantial factor in making, an employment-related decision about an employee or applicant in Connecticut, employers must provide that individual a written notice disclosing:

That the employer has deployed an AEDT.
The purpose of the AEDT and the nature of the employment-related decision.
The trade name of the AEDT.
The categories of the individual’s personal data the AEDT will analyze or process, and how that data will be assessed in reaching a decision.
The sources of that personal data.
The employer’s contact information.

Employers and developers need not disclose trade secrets or other legally protected information, but must notify the affected person if information is being withheld and why.

Enforcement

These requirements (and the developer obligations below) are enforceable solely by the Connecticut attorney general under the Connecticut Unfair Trade Practices Act (CUTPA); there is no private right of action. For violations through December 31, 2027, the attorney general may provide notice and a 60-day cure period before bringing an action if the violation is curable.

Developers’ obligations beginning October 1, 2027

SB 5 also covers developers: any person doing business in Connecticut that “develops, or intentionally and substantially modifies,” an AEDT advertised, marketed, configured, contracted for, sold or licensed to materially influence employment-related decisions. Developers must give employers all information needed to meet their disclosure and notice obligations, and the parties may agree by binding contract that the developer will assume specified obligations.

Colorado’s SB 26-189 imposes a similar information-sharing requirement. And because modifying a tool can trigger developer status, employers that heavily customize third-party tools should consider whether they could be treated as developers.

Use of AI is no defense to discrimination claims (effective October 1, 2026)

SB 5 amends the Connecticut Fair Employment Practices Act (CFEPA) to provide that use of an AEDT is not a defense to a discrimination claim, building on Attorney General William Tong’s February 2026 memo confirming that existing anti-discrimination laws apply to AI-driven decisions. Although anti-bias testing is not required, the Connecticut Commission on Human Rights and Opportunities (CHRO) or a court may consider evidence of such testing or “similar proactive efforts,” including their quality, efficacy, recency, scope, results and the employer’s response. As we reported in our September 2025 alert, California’s Civil Rights Council regulations, effective October 1, 2025, contain nearly identical language.

New AI disclosure for layoff notices (effective October 1, 2026)

Following New York’s lead, SB 5 requires employers that serve a federal Worker Adjustment and Retraining Notification (WARN) Act notice on the Connecticut Department of Labor to disclose, in a form the labor commissioner prescribes, whether the layoffs relate to the employer’s use of AI or “another technological change” (an undefined term). As we noted in a February 2025 alert, New York Gov. Kathy Hochul proposed a similar requirement. AI is defined more broadly than AEDT, as “any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs … that can influence physical or virtual environments.” The requirement is disclosure only, but employers should carefully consider how they characterize the reasons for a reduction in force.

Other notable provisions

SB 5 also includes two other provisions of note for AI developers:

Frontier developer whistleblower protections. “Frontier developers” (generally, those training foundation models using more than 10²⁶ integer or floating-point operations) may not adopt or enforce rules, policies or contracts permitting retaliation against employees for protected whistleblowing, including reports that the developer’s activities pose a specific and substantial danger to public health or safety due to a “catastrophic risk.” By January 1, 2027, “large frontier developers” (those with more than $500 million in annual gross revenues, including affiliates) must also establish an anonymous internal reporting process for covered employees. All frontier developers must notify covered employees of their rights. Violations carry civil penalties of up to $1,000 each, enforced by the attorney general.
AI regulatory sandbox. Effective July 1, 2027, the commissioner of economic and community development must develop a plan for an AI regulatory sandbox allowing applicants to temporarily test innovative products or services under reduced regulatory requirements, with legislative recommendations due by January 1, 2028. The concept is similar to Texas’s sandbox under the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), discussed in our September 2025 alert.

Next steps for employers and developers

Although the AEDT requirements begin October 1, 2027, the CFEPA amendment and WARN disclosure are already in effect. Employers and developers should consider the following steps now:

Inventory AI tools. Employers should identify automated tools used in employment decisions and assess which may qualify as AEDTs, including tools that only inform a human decision-maker. Developers should identify products advertised, marketed or licensed for employment decisions that may qualify as AEDTs.
Review vendor contracts. Employers should confirm vendors will supply the information needed for required disclosures and notices and consider allocating those obligations by contract, along with audit rights, indemnities and cooperation obligations. Developers should decide whether to assume any employer obligations, clearly document any such allocation and identify information they may withhold as trade secrets.
Develop disclosure and notice templates. Employers should prepare plain-language AEDT interaction disclosures and tool-specific pre-decision notices that include each required element. Developers should prepare standardized documentation describing each tool’s purpose, the personal data it processes, the data’s sources and how it is assessed, so customers can readily complete their notices.
Commission or review anti-bias testing. Employers should confirm their tools have been tested for bias, document the results and remediate any disparities identified. Because employers may rely on such testing to defend discrimination claims, developers should expect customers to request testing results and consider how to share them. Given California’s nearly identical standard, a single well-designed testing program may support compliance in both states.
Update WARN notice procedures. Employers should promptly add the AI-related disclosure to their WARN Act checklists and forms and watch for the labor commissioner’s prescribed form.
Train relevant internal teams. Employers’ human resources, talent acquisition and other relevant teams should understand that relying on AI does not insulate employment decisions from discrimination claims. Developers’ product, sales and marketing teams should understand that how a tool is marketed or licensed can determine whether SB 5 applies.
Assess whistleblower obligations. Potential frontier developers should review policies and agreements for compliance with the anti-retaliation provisions and implement required employee notices; large frontier developers must also have an anonymous internal reporting process in place by January 1, 2027.

Bottom line

SB 5 adds Connecticut to a growing list of jurisdictions regulating AI in employment, with requirements that overlap with, but differ from, those in California, Colorado, Illinois and New York City. Multistate employers should build compliance programs that meet the most demanding requirements while accounting for state-specific differences. We will continue to monitor developments in this area.

Employers and developers with questions regarding the use of AI tools should contact their Cooley employment lawyer or one of the lawyers listed below.

Still Not Dead: Delaware Supreme Court Keeps Verisk-AccuLynx Deal Alive

Thu, 29 Oct 2026 07:00:00 Z

The Verisk-AccuLynx deal lives on. On October 23, 2026, the Delaware Supreme Court affirmed the Court of Chancery’s August post-trial decision holding that Verisk Analytics could not terminate its $2.35 billion agreement to acquire AccuLynx after the Federal Trade Commission (FTC) review extended beyond the outside date. Verisk must continue pursuing antitrust clearance and – if the FTC approves the transaction and the other closing conditions are satisfied – close the deal.

The brief affirmance adds appellate weight – but no new legal analysis – to the Chancery Court’s contract-based ruling. That ruling turned on language barring termination where a party’s “other willful conduct” was the primary cause of a failed closing condition. The Court of Chancery read “willful conduct” to mean voluntary, intentional conduct, not only conduct intended to breach the agreement or derail closing.

What general counsel, boards and management teams should take away

Put post-signing business decisions on a deal-risk escalation path. Voluntary commercial conduct – even if not intended to breach the agreement or derail closing – may affect antitrust review and contractual termination rights.
Match governance to the regulatory clock. Management and deal teams should promptly elevate changes involving customers, competitors, integrations, pricing, product access or agency communications, and boards should receive clear updates as outside dates approach.
Negotiate termination blockers as operating rules, not boilerplate. The wording of “willful conduct,” causation standards and exceptions to outside-date termination rights can determine whether a party remains bound after the deadline.
Assume specific performance provisions may have real bite. A court may require a buyer to keep pursuing clearance and to close if approval and other conditions are satisfied, rather than allowing the buyer to pay damages and walk away.

The transaction is not guaranteed to close; it remains subject to FTC review and customary closing conditions. But the Delaware Supreme Court’s affirmance makes the warning harder to bury. Ordinary post-signing conduct can keep a deal from being laid to rest – and can keep the buyer bound beyond the outside date.

Read the full analysis

Space Bureau Announces Milestone and Surety Bond Transition Procedures

Tue, 27 Oct 2026 07:00:00 Z

On October 7, 2026, the Federal Communication Commission’s Space Bureau announced transition procedures for space station licensees and market access grantees ahead of the effective date of its recently adopted Part 100 rules, which modify space station surety bond and milestone requirements. Formal adoption of the new rules still requires Federal Register publication and implementation of relevant software changes to handle the revised rules. The Space Bureau will announce the effective date of the new Part 100 rules in a forthcoming public notice.

Before the effective date, current licensees and market access grantees that would not be subject to bond requirements under the new rules – GSO (Geostationary/ Geosynchronous Orbit) systems and NGSO (Non-Geostationary Satellite Orbit) systems not authorized under a processing round – may request to be relieved immediately (upon approval) of the current bond requirements by filing a letter request in the International Communications Filing System (ICFS). Additionally, such licensees and grantees may seek to replace the current milestone deadlines with the more lenient deadlines established in the new Part 100 rules.

Current licensees and market access grantees that were authorized under a processing round (and thus still subject to bond requirements under the new rules) may elect to replace their current bond with a new surety bond sized under the new deescalating bond formula, which would take effect on the effective date of the new rules. Such licensees and market access grantees must notify the Space Bureau of their election within one year of the effective date, or the relevant surety bond requirements would remain in force for the rest of the system’s license term. Licensees and market access grantees subject to processing rounds do not have applicable new milestone deadlines.

The Space Bureau will review and approve requests on a rolling basis. To be eligible for either of the above options, a licensee or grantee must meet all of the following:

Be in compliance with all current milestone and surety bond terms.
Not have a pending request for a milestone waiver.
Not have received a waiver of the milestone rules.

The public notice recommends that filing parties provide a courtesy copy to Brandon Padgett, acting associate division chief of the Satellite Programs and Policy Division at the Space Bureau, with any filing.

Current applicants may include the certifications described above as part of a pending application, or as a supplement to an already-filed application, to support a waiver request of the bond and/or milestone obligation in the event the pending application is granted prior to the effective date. All applications authorized after the effective date will be automatically subject to the Part 100 milestone and bond rules.

If you are interested in learning more about the new Part 100 rules and transition requirements, please reach out to the Cooley team.

Treasury Proposes Sweeping Expansion of US Outbound Investment Restrictions Under COINS Act

Tue, 27 Oct 2026 07:00:00 Z

On October 22, 2026, the US Department of the Treasury (Treasury) proposed a sweeping expansion of the US Outbound Investment Security Program (OISP), implementing the Comprehensive Outbound Investment National Security (COINS) Act and marking the most significant tightening yet of restrictions on US capital flowing to China, Russia and other foreign adversaries. The notice of proposed rulemaking (NPRM) would broaden the list of “countries of concern,” add new covered technology sectors and impose an outright ban on covered transactions involving super intelligence (SI) systems (formerly artificial intelligence), specified biotechnologies and key semiconductor technologies, including photonics.

Comments on the NPRM are due December 7, 2026, and the COINS Act requires Treasury to finalize implementing regulations by March 13, 2027.

Key takeaways

Coverage would expand beyond China

The existing OISP applies only to the People’s Republic of China (PRC), including Hong Kong and Macau. The proposed rule would expand “country of concern” to also include Cuba, Iran, North Korea, Russia and Venezuela under the regime of Nicolás Maduro Moros.

This expansion matters well beyond the countries themselves: OISP restrictions reach not just entities based in a country of concern, but any person who is a citizen or permanent resident of one. As a result, companies located elsewhere – including in the United States – can still fall within scope if they are majority owned or controlled by a covered foreign person.

Biotechnology would become a new prohibited technology sector

Perhaps the most significant sectoral expansion is biotechnology, where specified activities would be prohibited outright rather than merely notifiable. Covered activities are:

Development, engineering or use of a biological system (or any component) to modify, enhance, produce or control specified agents or toxins, energetic precursors or materials, functional materials, pharmaceutical compounds or biofuels.
Brain-computer interfaces.
Specified biomanufacturing equipment.
Biological sequencing technologies.
Certain flow cytometers, cell sorters and mass-spectrometry instruments.
Computational and bioinformatics tools.
Hardware, robotics or software used for automated scientific discovery or experimentation, including laboratory automation and cloud-lab infrastructure.

Notably, “pharmaceutical compounds” expressly includes vaccines, cell and gene therapies, monoclonal antibodies, and other recombinant therapeutic proteins. If the final rule is adopted as currently drafted, it would prohibit all investments by US persons in covered foreign persons engaged in the biotechnology activities described above. Given the potential impact on public health and commercial activity, Treasury has specifically requested comments on this scope.

‘Artificial intelligence’ becomes ‘super intelligence’ – and the restrictions get broader

Beyond the terminology shift from “AI system” to “super intelligence” or “SI system,” the NPRM would jettison the current tiered structure – which splits covered AI transactions into prohibited or notifiable categories – along with the existing compute-training thresholds used to trigger coverage. In their place, the proposed rule would prohibit all covered national security transactions involving the development of SI systems.

The definition of “SI system” would also expand to expressly capture systems that generate content or enhance or extend the capability of a third-party model, including agentic harnesses, embodied SI systems, industrial or humanoid robots, autonomous vehicles and unmanned systems.

High-performance computing, supercomputing and hypersonics become covered technology sectors

The COINS Act added high-performance computing, supercomputing and hypersonic systems as statutory technology areas. The NPRM defines this expansion as follows:

High-performance computing and supercomputing – The NPRM would retain existing restrictions on specified supercomputers and add a new notification requirement for developing or producing high-bandwidth, low-latency interconnects used in high-performance computing.

Hypersonics – The proposal would prohibit investments in the development or production of hypersonic systems, qualifying propulsion systems, specified high-temperature and stealth materials, testing infrastructure, and certain digital-twin and digital-thread technologies. Other sensors, guidance and control equipment, software, and materials capable of use in hypersonic systems would generally be subject to notification rather than prohibition.

Photonics named a prohibited semiconductor technology

The NPRM also materially expands the semiconductor and microelectronics provisions. Most notably, Treasury proposes to designate the development or production of any photonic integrated circuit as prohibited technology, expressly including optical components, co-packaged optics and silicon-photonics integration.

Photonics also intersects with the NPRM’s high-performance computing and supercomputing provisions: Treasury notes that photonic integrated circuits – including optical components, co-packaged optics and silicon-photonics integration – are increasingly relevant to advanced computing infrastructure.

The semiconductor provisions would also expand in other respects, including additional restrictions on radiation-hardened integrated circuits, high-bandwidth memory, compound-semiconductor integrated circuits and additional advanced semiconductor equipment.

Addition of new exceptions to prohibitions and notification requirements

The NPRM adds new exceptions to covered national security transactions, including:

De minimis exception – A transaction that would otherwise be notifiable is excepted where neither the value of the transaction nor the funds or other consideration provided to the relevant covered foreign person or joint venture exceeds $50,000 in the aggregate over the preceding 12 months.
Secondary transactions – Transactions secondary to a covered national security transaction are also excepted, including, without limitation, certain contractual arrangements, bank lending, processing, clearing, or sending of payments by a bank, and underwriting services.

New diligence factor added

Treasury would retain the existing “knowledge” standard, under which a US person can be deemed to know facts it could have identified through reasonable, diligent inquiry. The NPRM adds one new diligence factor: whether the US person appropriately considered any information Treasury made available before the transaction closed, including any Treasury assessment that the relevant covered foreign person may be engaged in a notifiable or prohibited technology.

As a practical matter, US persons subject to the regulations continue to bear primary responsibility for determining whether a transaction is prohibited, notifiable or outside the scope of the regulations.

Introduction of a nonbinding feedback process for difficult transactions

The NPRM proposes a new process allowing a person with a direct financial interest in an actual, prospective transaction to seek confidential, nonbinding feedback – or anonymized public guidance – on whether the transaction would be prohibited.

The mechanism could prove useful for transactions raising difficult technical classification questions, but it is not a formal clearance process. Treasury would have discretion whether to respond, and any feedback would not constitute an authorization, license, exemption or waiver, nor otherwise bind Treasury.

What investors and companies should do now

The NPRM is only a notice of a proposed rulemaking and is not a final regulation; it does not yet change substantive obligations under the existing OISP, which Treasury will continue to enforce until the final rule takes effect.

Still, the proposal’s scope – particularly its expansion into biotechnology, photonics, SI, hypersonics and additional countries – means investors and companies should begin assessing how the new framework could affect their activities and diligence processes. Those with particular concerns about the breadth or technical parameters of the proposed definitions should consider submitting comments to Treasury by December 7, 2026.

If you have questions about the NPRM or how it may affect your business, or would like help submitting comments to Treasury, please contact a member of the Cooley team listed below.

FCC to Vote on International Section 214 Overhaul: What Authorization Holders Need to Know

Mon, 26 Oct 2026 16:51:31 Z

The Federal Communications Commission (FCC) will vote on October 29, 2026, on a draft Report and Order and Further Notice of Proposed Rulemaking in the Evolving Risks proceeding (IB Docket No. 23-119). The draft, circulated October 8, is not final FCC action and may change.¹

Status, Sunshine period and effective dates

The item is not final FCC action and remains subject to change. The proceeding is permit-but-disclose. The FCC is expected to release the Sunshine Agenda for the October 29 meeting on October 22, 2026; under the FCC’s rules, presentations to decision-makers on the item are prohibited beginning the day after that release – October 23, 2026 – and remain prohibited until the FCC releases the text of the adopted item.²

If adopted, the rules would take effect 60 days after Federal Register publication, except that the amendments to sections 63.18, 63.19, 63.21 and 63.24 – which contain nearly all of the new obligations – and the one-time collection take effect only after the Office of Management and Budget (OMB) completes Paperwork Reduction Act review. The Office of International Affairs (OIA) will announce those dates and the collection deadline. Pending applications need not be amended, but grants will be conditioned on the new rules, and applicants must certify acceptance of the routine conditions within 30 days of the effective date. Unless noted, this alert describes what the FCC “would” adopt; Further Notice items remain proposals only.

Key deadlines

Obligation	Who	Deadline (from effective date unless noted)
Certify acceptance of amended conditions; cyber and Covered List certifications	Applicants pending on effective date	30 days
Certify future cybersecurity compliance	Existing holders	30 days
Submit one-time information collection	Existing holders	No fewer than 30 days after the collection’s effective date (OIA to announce)
Implement cybersecurity program	Existing holders	One year
Report whether service has commenced	Existing holders	One year
Commence service; file notification	New grants	One year from grant of authorization; 30 days after commencement
Submit cybersecurity implementation certification	New grants	30 days after commencement
Submit new cross border facility notification	Facilities-based holders	30 days after commencement
Submit material change notification	All holders	30 days after material change
Submit discontinuance notification and surrender	All holders	30 days after three months without international service

What to do now

Inventory all authorizations, confirm a 2023 – 2024 response was filed, and consider surrendering unused or duplicative authorizations before the new deadline.
Confirm service status under each authorization.
Begin assembling cross-border facilities data (or wholesale provider data for resellers) and 5% ownership and control information, and review investor confidentiality commitments.
Screen vendors and managed service providers for Covered List and foreign adversary³ linkage, and lock procurement against additions of either.
Document a written cybersecurity program consistent with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Cybersecurity & Infrastructure Security Agency (CISA) Cybersecurity Performance Goals (CPGs) or Center for Internet Security (CIS) Controls.
Review adjudicated compliance history against the five character categories.
Stand up a 30-day material change process and update discontinuance notice templates.
Consider filing comments on the Further Notice proposals; comments will be due 30 days after Federal Register publication of the adopted item.

New application requirements (§ 63.18(r)–(w))

These requirements would apply to applications for new authority, modification, assignment and transfer of control, and (in part) to pro forma notifications.

Cross-border facilities (§ 63.18(r)). For each cross-border facility – including data centers, points of presence (PoPs) or private interconnection points with ingress/egress switches or routers – facilities-based applicants would provide location and ownership details, IP prefixes and autonomous system numbers (ASNs), principal equipment information (including any foreign adversary or Covered List entity links), services provided, and any foreign adversary-linked physical or remote access. Resale-only applicants would identify wholesale/intermediary providers and any underlying mobile network operator (MNO). Pending applications must be amended within 30 days of any change. The information is presumptively confidential but may be shared with Team Telecom, the Department of Justice, Department of Homeland Security and Department of Defense, and reporting such facilities may trigger Team Telecom referral.
Five percent ownership (§ 63.18(h)). The disclosure threshold drops from 10% to 5% of direct or indirect equity and/or voting interests. Interests of 5%-to-under-10% held through a US publicly traded company need not be identified unless the public company has actual knowledge, measured by its share register, insider holdings, Schedules 13D/13G and Form 13F data, periodic-report beneficial ownership tables and information known “by whatever source.” The exception is limited to US publicly traded companies; there is no exception for passive or insulated interests or for private companies. The information would not be treated as presumptively confidential. The 10% foreign ownership trigger for routine Team Telecom referral is retained, but 5% information may inform the FCC’s discretion to refer any application.
Services and geographic markets (§ 63.18(s)). Applicants would disclose current and planned services, customer types, facilities versus resale and markets served. Planned information is confidential; current information is not.
Third-party service providers (§ 63.18(t)). Applicants would disclose whether they use any foreign adversary-controlled or Covered List entity, or any entity with network/ systems/communications/records access from a foreign adversary country, for managed services (“a complete, end-to-end communications solution”) supporting Section 214 operations. This is not confidential, and the FCC expects generally to refer such applications to Team Telecom. An applicant unable to confirm the information at filing must request a waiver and file status updates every 30 days.
Cybersecurity certification (§ 63.18(u)). Applicants would certify adherence to baseline cybersecurity practices structured according to an established risk management framework and incorporating an internationally recognized set of best practices. A program built on the NIST CSF incorporating CISA’s Cross-Sector Cybersecurity Performance Goals or the CIS Controls presumptively complies and, if reduced to writing, also satisfies the 5G Fund and other USF cybersecurity rules.
Covered List certification (§ 63.18(v)). Applicants would certify they will not use or add Covered List equipment or services for Section 214 service; modification, assignment and transfer applicants certify none will be added. The certification is limited to Covered List entries based on producer/provider determinations (e.g., named manufacturers and service providers) and does not reach the production location-based entries added since December 2025.
Character certification (§ 63.18(w)). Applicants would certify, as to adjudicated matters only, whether they:

Materially violated the Communications Act where the violation was not remediated by consent decree or compliance plan, resulted in loss of a license or authorization, or was found intentional.
Committed national security-related violations, including Covered List violations.
Made materially false statements or committed fraud concerning national security or the Communications Act.
Were adjudicated for such conduct by another US agency.
Materially breached an authorization condition, including a mitigation agreement, subject to the same three qualifiers as item (1).

Applicants would also certify service on the secretaries of defense and state and affected governors; assignors and transferors would disclose any International Signaling Point Codes (ISPCs) and whether they are part of the transaction.

New routine conditions (§§ 63.19, 63.21)

Commence service within one year. New holders must commence service within one year of grant and file a certified International Communications Filing System (ICFS) notification within 30 days of commencement identifying the date and services; failure to commence or notify, absent a waiver, is grounds for revocation. Authorizations associated with a common carrier submarine cable instead follow the three-year cable landing license timeline. Existing holders must notify within one year of the effective date whether they have commenced service, and if not, an alternative timeframe – or surrender.
Permanent discontinuance. Three consecutive months without service requires surrender and an ICFS notification within 30 days; discontinuing service without a prior waiver is grounds for revocation. Customer notices must identify the holder, date, affected areas/routes and services, and a copy must be submitted to ICFS.
Cross-border facility notifications. Facilities-based holders must notify the FCC within 30 days of commencing service in any new cross-border facility or with a new underlying provider.
Cybersecurity. New holders implement the program by commencement of service and certify within 30 days; existing holders implement within one year of the effective date and certify within 30 days of the effective date that they will.
Covered List. New holders may not use or add Covered List equipment or services (producer/provider-based entries); existing holders may not add them, though existing equipment need not be removed.
Material change reporting. All holders must notify the FCC within 30 days of a material change to previously submitted information or certifications, including changes to cross-border facilities, new 5% interest holders, new services or markets, third-party providers or certifications. OIA decides materiality.
Enforcement. Noncompliance with any reporting requirement is grounds for revocation and/or termination, and the FCC may review any authorization at any time.

One-time information collection

Every existing holder would file the same cross-border facilities, ownership, services/markets, third-party provider, cybersecurity, Covered List, and character disclosures and certifications described above, plus a list of all its authorizations explaining why it needs more than one. The FCC “strongly encourage[s]” surrendering duplicative authorizations; holders that surrender everything before the deadline need not respond. Information must be current as of 30 days before filing; the deadline is no fewer than 30 days after the collection’s effective date. Holders certify accuracy under a “substantial due diligence” (not strict liability) standard; noncompliance exposes holders to forfeitures and revocation.

Revocation of 2023 – 2024 nonresponders

Holders that did not respond to the 2023 Evolving Risks Order collection would be presumed to be no longer operating. OIA would publish a Federal Register list giving holders 30 days to respond or surrender, then 15 more days before revocation. Late responders are not subject to these procedures. Reinstatement nunc pro tunc could be sought within six months on good cause.

Further Notice proposals

None of the following is adopted; each would require a further order.

Presumptive disqualifying conditions (proposed § 63.27). Applicants that are foreign adversary-controlled, on the Covered List, or previously denied or revoked on national security grounds (and the affiliates and subsidiaries of any such revoked or denied entity); applicants with foreign adversary financing, strategic partnerships or mergers affecting Section 214 operations; and applicants with foreign adversary-linked senior officials – rebuttable only by clear and convincing evidence.
Indefeasible right of use (IRU), capacity lease, dark fiber and spectrum arrangements. A proposed condition barring new or extended arrangements giving foreign adversary-controlled, Covered List or previously revoked entities ownership, control, management authority or meaningful operational control over a holder’s network; contractual flow-down to customers and downstream customers; a filing within 60 days of commencing service and annually listing all such arrangements with copies of the agreements (confidential); and a one-time certification from existing holders within 60 days.
Foreign adversary-produced equipment and services. No use by new applicants, and no addition by any holder, of equipment or services “produced (including any major stage of the process … including manufacturing, assembly, design, and development) or provided by” foreign adversary-controlled or Covered List entities; existing holders would certify current use within 60 days.
Third-party service providers. A prohibition on foreign adversary-linked providers under a broadened definition reaching any third party whose services – including network operations center (NOC), maintenance, billing, customer support, security, IT, cloud and data center services – could give it access to principal equipment, domestic communications, lawful US process or customer records.
Cyber and physical security risk management plans signed by a senior officer and producible on request, with two-year record retention; incident reporting within 72 (or 48) hours; and mandatory cyber hygiene measures.
Other: prohibiting access by foreign adversary-linked personnel; disclosing all facility locations; prior approval before serving a foreign adversary country; concurrent Team Telecom filings for mitigation-agreement holders; codified modification rules (§ 63.26); and broad interagency information sharing (§ 63.30).

Notes

Review of International Section 214 Authorizations to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Policy Risks; Amendment of the Schedule of Application Fees Set Forth in Sections 1.1102 through 1.1109 of the Commission’s Rules, IB Docket No. 23-119, MD Docket No. 23-134, Report and Order and Further Notice of Proposed Rulemaking, FCC-CIRC 2610-05 (circulated Oct. 8, 2026) (Draft Order). The document “has been circulated for tentative consideration by the Commission at its October 29, 2026, open meeting,” remains “subject to change,” and “does not constitute any official action by the Commission.” Id. at 1 n.*.
47 CFR § 1.1203(a)–(b); Draft Order at 1 n.* (Sunshine Agenda “is typically released a week prior to the Commission’s meeting”). The FCC released the tentative agenda for the October 29, 2026, open meeting on October 8, 2026; as of October 21, 2026, no Sunshine notice had been released.
“Foreign adversary,” “foreign adversary country” and “owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary” are defined in 47 CFR § 1.70001(e)–(g) by reference to the Department of Commerce’s determinations in 15 CFR § 791.4. Currently, the following are identified as foreign adversaries: China (including the Hong Kong and Macau Special Administrative Regions), Cuba, Iran, North Korea, Russia and the Maduro Regime. 15 CFR § 791.4(a).

If you would like to discuss these requirements, prepare for the one-time collection or participate in the comment process, please contact one of the Cooley lawyers listed below.

This alert is based solely on the circulated draft of FCC-CIRC 2610-05 released October 8, 2026, which remains subject to change before FCC’s October 29, 2026, vote.

FCC to Vote on International Section 214 Overhaul: What Investors Need to Know

Mon, 26 Oct 2026 07:00:00 Z

The US Federal Communications Commission (FCC) will vote on October 29, 2026, on a draft Report and Order and Further Notice of Proposed Rulemaking that would rewrite certain rules, as well as propose additional revisions, for international section 214 authorizations – the FCC authority required to provide common carrier telecommunications service between the US and foreign points. The draft, circulated October 8, is not final and may change.¹

Implications for investors

Any fund, co-investor, limited partner, or other entity or person that is attributed a direct or indirect equity or voting interest of 5% or more would be identified in a public FCC filing unless the interest flows through a US public company without actual knowledge of such interest; existing holders would supply the same information in the one-time collection; and a “new 5% interest holder that is known by the authorization holder in the ordinary course of business” is a material change requiring notice to the FCC within 30 days. Confidentiality terms in partnership agreements and side letters should be reviewed accordingly; one commenter noted such agreements would need “to be modified in order for disclosure to be allowed.”

Practical considerations

Diligence: Confirm the target holds an authorization, responded in 2023 – 2024, is providing service under each authorization, and whether it uses Covered List equipment, foreign adversary-linked providers or cross-border facilities.
Cap table: Map every direct and indirect equity or voting interest of 5% or more and identify any that flow through a US public company; while equity is calculated on a pass-through basis, the FCC has complicated rules on calculating voting interests, particularly with respect to limited partners and members of limited liability companies.
Investor confidentiality: Review fund documents and side letters for restrictions on disclosing investor identities.
Foreign adversary exposure: Identify any foreign adversary-linked holder with a 10% or greater interest, financing or partnership with a foreign adversary-controlled entity, or senior official working from a foreign adversary country.
Deal documents: Allocate responsibility for the one-time collection, the certifications, the one-year commencement condition and 30-day notices between signing and closing.
Advocacy: Comments on the Further Notice are due 30 days after Federal Register publication. The FCC specifically requests “data and quantitative analysis” on availability, bottlenecks and price effects.

Status

Currently, the item is a circulated draft in IB Docket No. 23-119 and MD Docket No. 23-134 and “does not constitute any official action by the Commission.” If adopted, most rules would take effect 60 days after Federal Register publication, but the amendments to several rules and the one-time collection would await OMB Paperwork Reduction Act review, with the Office of International Affairs (OIA) to announce those dates. This alert describes what the FCC “would” do if it adopts the draft. Further Notice items are proposals only.

The 5% ownership threshold

Current Section 63.18(h)(1) requires disclosure of holders of “ten percent or more of the equity interests and/or voting interests, or a controlling interest” in new, modification, assignment, transfer-of-control and pro forma filings. The draft would lower that threshold to “five percent or more” and continue to require the name, address, citizenship, principal business and percentage interests for each such interest holder. Indirect interests will continue to be calculated under the attribution rules in Section 63.18(h)(1)(i)–(ii), which calculate equity on a pass-through basis but calculate voting interests using complicated attribution calculations that are not straight pass-through, particularly with respect to limited partners and members of limited liability companies. The 10% foreign ownership trigger for routine Team Telecom referral is retained, but 5% information may inform the FCC’s discretion to refer any application.

The exception. An applicant need not identify 5%-to-less-than-10% interests “held directly or indirectly in the applicant through a U.S. publicly traded company, or if the applicant itself is a U.S. publicly traded company, unless the U.S. publicly traded company has actual knowledge of such interest holders.” A public company “has or should have actual knowledge, in the exercise of due diligence,” of holders shown in its share register, insider holdings, Schedules 13D and 13G and Form 13F data, beneficial ownership tables in periodic reports, and information actually known “by whatever source.” The applicant and the public company must review Schedules 13D/13G and monitor institutional ownership sources. Despite support from commenters, the FCC is not adopting exceptions for passive or insulated investors, privately held companies, or non-US publicly traded companies.

One-time information collection. All existing international Section 214 authorization holders would submit information regarding 5% ownership and control. The deadline would be no fewer than 30 days after the collection’s effective date, and noncompliance risks forfeitures and revocation. Holders that surrender all authorizations before the deadline need not respond.

Other application and one-time information collection requirements

Applications and a one-time information collection for existing authorization holders must provide new information and certifications, the most relevant of which to investors is (see companion alert for international Section 214 authorization holders for additional details):

Character certification. Certification of whether the applicant (likely extending to affiliates) has been adjudicated for material Communications Act violations, national security-related violations or false statements, or materially breached an authorization condition.

Certain other new disclosures in applications may result in referral to Team Telecom.

Material changes will need to be reported

Authorization holders will need to report material changes to previously provided information within 30 days of the change. While OIA will decide what is material, the FCC has indicated that new 5% interest holders are material and will need to be reported.

Other continuing obligations and related matters

In addition to submitting filings regarding material changes, authorization holders will be subject to other continuing obligations regarding cybersecurity, Covered List equipment and services, and utilization of the authorization. (See companion alert for international Section 214 authorization holders for additional details.) OIA will publish a list of holders that did not respond to the 2023 Evolving Risks Order and who may be subject to revocation.

Further Notice proposes to disqualify certain applicants

Following a comment period and further order, the FCC proposes to presumptively disqualify:

Applicants (including affiliates and subsidiaries) that are “owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary,” on the Covered List, or previously denied or revoked on national security grounds.
Applicants with existing or planned foreign adversary financing, strategic partnerships or mergers.
Applicants whose senior officials are foreign adversary-linked or work from a foreign adversary country.

Each is rebuttable only by “clear and convincing evidence.”

The Further Notice has other proposals that are addressed in our companion alert for international Section 214 authorization holders. Comments are due 30 days after Federal Register publication and replies after 60 days.

Notes

Review of International Section 214 Authorizations to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Policy Risks; Amendment of the Schedule of Application Fees Set Forth in Sections 1.1102 through 1.1109 of the Commission’s Rules, IB Docket No. 23-119, MD Docket No. 23-134, Report and Order and Further Notice of Proposed Rulemaking, FCC-CIRC 2610-05 (circulated Oct. 8, 2026) (Draft Order). The document “has been circulated for tentative consideration by the Commission at its October 29, 2026, open meeting,” remains “subject to change” and “does not constitute any official action by the Commission.” Id. at 1 n.*.

If you would like to discuss how these rules may affect a current or prospective investment, or participate in the Further Notice’s comment process, please contact one of the Cooley lawyers listed below.

This alert is based solely on the circulated draft of FCC-CIRC 2610-05, released October 8, 2026, which remains subject to change before the FCC’s October 29, 2026, vote.

SEC Delivers Welcome Relief by Modernizing Equity Compensation Registration

Tue, 20 Oct 2026 07:00:00 Z

On October 15, 2026, the Securities and Exchange Commission (SEC) issued several new and revised Corporation Finance Interpretations (CFIs) addressing various matters related to equity compensation registration and reporting. The CFIs represent welcome relief and signal SEC attention to and receptivity toward issuer concerns around historical SEC positions that complicated equity compensation securities law compliance. The CFIs are the result of engagement between the Joint Committee on Employee Benefits (JCEB) and the SEC, in which Cooley actively participated alongside peer firms.

Two particularly important new CFIs under Section 271 of the Securities Act Rules CFIs (Rule 701 – Exemption for Offers and Sales of Securities Pursuant to Certain Compensatory Benefit Plans and Contracts Relating to Compensation) address historically problematic issues arising in the M&A and/or initial public offering (IPO) context.

Pre-IPO exemption to S-8 pipeline

New CFI 271.28 provides that, if prior to an IPO an issuer relied on an exemption from registration under the Securities Act (e.g., Rule 701, Regulation D or Section 4(a)(2)) to grant compensatory awards, the shares underlying those awards may be registered on Form S-8. This new position dramatically expands the ability of issuers to register shares issuable under pre-IPO awards and, in turn, facilitates grantees’ ability to sell those shares following the IPO. Specifically, this new interpretation should eliminate many of the technical resale and stock plan platform issues that historically arose for restricted stock and restricted stock units (RSUs) granted within one year of an IPO or that vested upon an IPO, including the need in some cases to rely on a resale Form S-8.

Exemption covering acquired former service provider awards

New CFI 271.29 provides that, where an issuer acquires another entity and assumes equity awards previously issued by that target company, Form S-8 and Rule 701 are available to the acquiror not only with respect to current target service providers (as has always been the case) but also with respect to former service providers of target (i.e., grantees whose service terminated before the acquisition). This new position dramatically simplifies registration of awards held by former service providers – a process that has been a perennial source of consternation in the M&A context. Essentially the same relief is repeated in revised CFI 126.14 under the Securities Act Forms CFIs (Form S-8).

S-8 relief for pre-vest filing of restricted stock/RSUs

Another significant development is expansion of the existing relief for the timing of S-8 filings that previously applied only to stock options. Under prior guidance, most recently set out in a CFI under Section 126 of the Securities Act Forms CFIs (Form S-8), the SEC treated the filing of a Form S-8 in respect of a stock option as timely where the S-8 was filed before exercise of the option, regardless of the grant timing. CFI 126.47 expands the relief previously applicable to options to provide that filing of S-8 will be treated as timely in respect of restricted stock and restricted stock units if the filing is made before the awards vest, regardless of grant timing, as long as the company was also eligible to use Form S-8 on the date of grant. This new CFI provides an additional benefit: Companies will no longer need to register additional shares on Form S-8 to account for forfeited shares of restricted stock and shares underlying forfeited RSUs that return to the plan pool and become available for grants of new awards.

Registration fee calculation streamlining

Two new CFIs and one revised CFI apply to the payment of registration fees and will reduce costs and administrative burdens imposed upon issuers.

Pursuant to new CFI 240.19 under Section 240 of the Securities Act Rules (Rule 457 – Computation of Fee), an issuer may rely on Securities Act Rule 457(o) to calculate the amount of the fee for offerings under a defined contribution plan, using an aggregate dollar amount rather than specifying number of shares.
Pursuant to new CFI 126.46 under the Securities Act Forms CFIs (Form S-8), where an issuer registered on Form S-8 the offer and sale of securities with vesting conditions and paid the associated filing fees, SEC staff will not object if the issuer applies the filing fees associated with the securities underlying forfeited awards to the registration of future offers and sales under the Form S-8.
In a somewhat similar vein, CFI 126.19 under the Securities Act Forms CFIs (Form S-8) in respect of share counting under 401(k) plans has been revised to provide that shares no longer need be counted on a “gross” basis, where each purchase reduces the amount of shares available under the S-8, and instead may be counted on a “net” basis, such that, for example, where shares are sold under the plan by one participant and purchased by another participant, only the original acquisition reduces the number of shares available under the S-8. This new guidance effectively legitimizes an approach that we expect is already taken by a considerable number of issuers.

Form 4 filing time zone timing

Finally, a new CFI under Section 135 of the Exchange Act Section 16 and Related Rules and Forms CFIs (Form 4) clarifies the application of the Form 4 filing timing requirements where, as is increasingly common in our global economy, the underlying transaction is effected by a reporting person on a foreign exchange in a non-US jurisdiction. Exchange Act Rule 16a-3(g)(1) requires a Form 4 to be filed before the end of the second business day following the day on which the subject transaction has been executed. CFI 135.05 makes clear that the two-day deadline is calculated beginning with the date in the time zone where the transaction was executed. And so, for example, where a reporting person sells shares on August 25, 2026, at 9:00 am local time (when it is Monday August 24, 2026, in US Eastern Time), the reporting person must make the filing before an August 27, 2026, EDGAR filing deadline based on US ET, such that the Form 4 filing deadline is 10:00 pm US ET on August 27, 2026.

* * *

These new and revised CFIs should benefit issuers by resolving a few complication-causing wrinkles around equity award registration/exemption in the IPO and M&A contexts, reducing administrative burden in fee calculation, and reconciling historical guidance to updated award types and global market practicalities.

Cooley’s compensation and benefits and corporate governance and securities regulation attorneys are available to discuss these issues. Reach out to your existing Cooley contact or email one of the contacts below.

California SB 253: November 10 Reporting Deadline Approaching

Wed, 14 Oct 2026 07:00:00 Z

The first reporting deadline under California’s Climate Corporate Data Accountability Act (SB 253) is approaching. The California Air Resources Board (CARB) has established November 10, 2026, as the initial reporting deadline under SB 253. SB 253 generally applies to US-organized public and private companies doing business in California with more than $1 billion in total annual revenue. Under CARB’s proposed implementing regulations, the $1 billion revenue threshold is determined using the lower of the entity’s gross receipts for its two most recently completed fiscal years.

For this initial reporting year, CARB has provided flexibility for covered companies to submit one of the following:

Scope 1 and Scope 2 emissions disclosures: Companies may report Scope 1 and Scope 2 emissions data for their prior fiscal year based on information they already had or were collecting when CARB issued its December 5, 2024, enforcement notice. Acceptable submissions include an existing annual or sustainability report containing Scope 1 and Scope 2 emissions data, information previously reported under a voluntary or other regulatory program, or data submitted using CARB’s reporting template. For 2026, CARB will accept submissions without third-party assurance.
Statement of nonreporting: For the initial reporting year, CARB has provided flexibility in implementing SB 253, including permitting companies to satisfy their initial reporting obligations through existing emissions disclosures and requesting a statement of nonreporting from companies that were not collecting nor planning to collect Scope 1 and Scope 2 emissions data as of December 5, 2024. Instead, CARB requests a statement on company letterhead confirming those circumstances and stating that the company is not submitting an emissions report.

Companies may submit emissions reports or statements of nonreporting through CARB’s voluntary reporting platform or by email to climatedisclosure@arb.ca.gov. Scope 3 emissions reporting does not begin until 2027.

Covered companies should evaluate whether they are subject to SB 253, confirm their reporting obligations and prepare any required submissions ahead of the November 10 deadline.

Litigation challenging SB 253 remains pending, but its reporting requirements have not been stayed. Separately, enforcement of California’s companion Climate-Related Financial Risk Act (SB 261) remains stayed by the US Court of Appeals for the Ninth Circuit pending appeal.

Cooley’s ESG and sustainability advisory attorneys are available to discuss these requirements. Reach out to your existing Cooley contact or email Cooley’s ESG and sustainability advisory team.

Recent Circuit Court Decisions Coalesce on Scope of LP Self-Employment Tax Exception

Tue, 13 Oct 2026 07:00:00 Z

The long saga of who is a limited partner for purposes of the limited partner exception may finally be inching towards a resolution, with two circuit courts recently converging on similar definitions, both of which make it difficult for taxpayers engaged in management activities to claim the exception.

On August 12, 2026, the US Court of Appeals for the Fifth Circuit ruled that a partner who plays “no significant role in managing or running a business” is a “limited partner” for purposes of the limited partner exception to self-employment taxes described in Internal Revenue Code (IRC) Section 1402(a)(13).¹ In doing so, the Fifth Circuit withdrew its January 2026 opinion in Sirius Solutions, L.L.L.P. v. Comm’r,² which previously defined a “limited partner” for this purpose as a partner with limited liability.

Ruling on the same issue, on September 17, 2026, the US Court of Appeals for the Second Circuit similarly defined a limited partner for purposes of the exception as a partner that has limited liability and “who does not run, manage, or otherwise exert control or managerial authority over the partnership.”³

Limited partner exception

As discussed this December 2023 client alert, the IRC imposes a tax on the self-employment income of individuals, including gross income derived from any trade or business, less allowable deductions attributable to such trade or business, plus the distributive share (whether or not distributed) of income or loss from any trade or business carried on by a partnership of which such individual is a member. However, IRC Section 1402(a)(13) provides an exception for “the distributive share of any item of income or loss of a limited partner, as such,” other than guaranteed payments for services provided to or on behalf of the partnership.

Judicial interpretation of ‘limited partner’

The first decision in a series of cases at the Tax Court involving the limited partner exception was the Tax Court’s November 2023 decision in Soroban Capital Partners LP v. Comm’r.⁴ In Soroban, the Tax Court held that state law limited partners are not per se entitled to the limited partner exception under IRC Section 1402(a)(13). The Tax Court concluded that a functional analysis must instead be applied to determine whether a partner is a “passive investor” entitled to the limited partner exception. In decisions after Soroban, the Tax Court has consistently opined that a functional analysis should be applied – including in Denham Capital Management v. Comm’r⁵ and Sirius Solutions L.L.L.P. v. Comm’r.⁶ Denham has an appeal pending in the First Circuit.

On January 16, 2026, in the appeal for Sirius Solutions, the Fifth Circuit held that the term “limited partner” means a partner who, under state limited partnership law, has limited liability status in a limited partnership (the prior opinion). The government petitioned the Fifth Circuit for rehearing en banc. The Fifth Circuit denied the petition, but on August 12, 2026, the Fifth Circuit withdrew its prior opinion, defined a “limited partner” consistent with its “ordinary public meaning,” at the time of the statutory enactment, and rejected both the Fifth Circuit’s own “limited liability” test and the Tax Court’s “functional analysis” test. The opinion does not clearly describe when participation becomes “significant,” which, similar to the “functional analysis” test, leaves the application of the standard dependent on the partner’s functions and authority. The Fifth Circuit vacated the Tax Court’s decision and remanded the case using the revised reading of the term “limited partner” for purposes of IRC Section 1402(a)(13).

In the appeal for Soroban, the Second Circuit adopted a comparable standard to the Fifth Circuit in Sirius Solutions, concluding that a limited partner is a partner with limited liability who does not run, manage, or otherwise exert control or managerial authority over the partnership. The Second Circuit noted the Fifth Circuit’s holding in Sirius Solutions and said that to the extent that the Fifth Circuit held that “a limited partner may provide some services to the partnership, we do not disagree … [s]o long as the activities in question do not constitute controlling, managing or running the business, a partner may play a role in the partnership and still qualify as ‘limited.’”

While both the Second Circuit and the Fifth Circuit permit limited partners to provide services to the partnership, the “significant participation” standard adopted by the Fifth Circuit in Sirius Solutions is potentially more taxpayer-friendly than the standard adopted by the Second Circuit in Soroban. Both standards are less taxpayer-friendly than the Fifth Circuit’s withdrawn January 2026 opinion and indicate a narrowing limited partner exception. In response to the revised Fifth Circuit standard, the Department of Justice argued in a letter to the First Circuit (in Denham) that under the definition applied by the Fifth Circuit, the First Circuit should uphold the decision of the Tax Court.

Partners of investment managers claiming the limited partner exception should continue to monitor developments in the various circuit courts and continue to assess the application of the exception to their particular situations.

Notes

K Alain, L.L.L.P. v. Commissioner, No. 24-60240, slip op. (5th Cir. Aug. 12, 2026) (per curiam).
165 F.4th 374 (5th Cir. 2026).
Soroban Capital Partners LP v. Commissioner, No. 25-2079, slip op. (2d Cir. Sept. 17, 2026).
Soroban Capital Partners LP v. Commissioner, 161 T.C. 310 (2023).
T.C. Memo. 2024-114.
Docket Nos. 11587-20 and 30118-21 (T.C. Feb. 20, 2024).

New York Enacts New Personnel Record Access Law, With Amendments Expected

Tue, 13 Oct 2026 07:00:00 Z

New York became the latest state to enact a personnel record access law, granting employees a statutory right to access personnel records beginning November 8, 2026. Below we summarize key new obligations and compliance steps for employers.

Scope of covered records

Explicitly modeled after the Massachusetts Personnel Record Law, S3460 requires employers to grant current and former employees access to their personnel files. The law broadly defines a “personnel record” as any record kept by the employer that is, has been or may be used to affect the employee’s qualifications for employment, promotion, transfer, additional compensation or disciplinary action. The definition expressly includes, without limitation, the following information about the employee:

Name, address and date of birth
Job title and description
Rate of pay and other compensation
Starting date Job applications, resumes and other forms of employment inquiry
Performance evaluations (including self-evaluations and written warnings)
List of probationary periods
Signed waivers
Termination notices
“Any other documents relating to disciplinary action”

Employers must retain the complete personnel record without deletion or expungement from the date of employment to three years after termination. Notably, the definition of “personnel record” extends to records kept by a third party with a contractual agreement with the employer to keep or supply such records on the employer’s behalf, such as professional employer organizations (PEOs) or payroll vendors. However, the definition excludes information “of a personal nature” about another person other than the employee if disclosure would constitute an invasion of privacy.

Right to access

Employees may submit a written request for a copy of their personnel record, which the employer must provide at no cost within five business days. Employers need not honor more than two requests per calendar year, but a review triggered by a “negative information” notice (described below) does not count toward this cap.

Negative information notice

Employers must notify an employee within 10 days of placement in their employee’s personnel record any information “to the extent that the information is, has been used or may be used, to negatively affect the employee’s qualification for employment, promotion, transfer, additional compensation or the possibility that the employee will be subject to disciplinary action.” The law does not specify the form of notice or further define “negative information.”

Right to respond and correct

If an employee disagrees with any information in their record, including but not limited to “negative information,” the employee and employer may mutually agree to remove or correct it. Absent agreement, the employee may submit a written statement explaining their position, and such statement must become part of the personnel record, appropriately retained, and included whenever the disputed information is transmitted to a third party. Employees may also seek expungement (through collective bargaining, judicial process or “other personnel procedures”) of information the employer knew or should have known to be false.

Enforcement and penalties

The attorney general will enforce the law, with fines of $500 to $2,500 per violation. Employers are also prohibited from retaliating against employees who exercise their rights under the law, including by threatening or making immigration status-related reports against the employee or their family or household members.

Amendments likely

In signing the law, Gov. Kathy Hochul acknowledged its ambiguities and stated she has reached an agreement with the New York Legislature to address them in the upcoming legislative session. Two areas were specifically flagged for clarification:

Confirming that employers are not required to create a personnel file or generate new documents beyond what they currently maintain.
Clarifying that personnel records are limited to records or documents actually used to determine an employee’s qualifications for hiring, retention, promotion, transfer, additional compensation or discipline.

Next steps

To prepare to comply, employers should consider the following steps:

Review existing personnel record policies. Review current practices for personnel record access and contents, and modify them as needed to comply with the new law. Confirm that retention practices meet the three-year post-termination minimum, keeping in mind that other state or federal laws may require longer retention periods.
Establish a request protocol. Build a process for receiving and responding to personnel record requests within five business days, including a designated point of contact. Employers that use a PEO or third party to maintain personnel records should ensure they have immediate access to those records to meet this deadline.
Establish a notice protocol. Because the law does not define whether “negative information” extends beyond formal discipline to informal records, the notice trigger could be interpreted broadly. Employers should establish criteria for identifying “negative information” and a process for issuing timely notice to employees.
Train human resources and management teams. Train HR and management on the law’s access, notice, response and anti-retaliation requirements. Managers should be especially aware of the tight turnaround between creating a personnel record with “negative information” and notifying the employee, and should coordinate with HR to ensure compliance. Accurate documentation of performance and disciplinary decisions remains critical, as undisclosed issues may be harder to rely on later if the required notice was never given.
Stay tuned for amendments. Watch for legislative developments when the legislature reconvenes in January 2027, and be prepared to adjust compliance procedures accordingly.

If you have questions about these laws or how to comply, please contact the Cooley employment team or one of the lawyers listed below.

Electronics Manufacturers May Need to Use Different Test Labs

Tue, 13 Oct 2026 07:00:00 Z

The Federal Communications Commission (FCC) will vote on a Third Report and Order and Third Further Notice of Proposed Rulemaking on October 29 that will require device testing, certification and accreditation to occur in the US or countries that have entered into reciprocal agreements with the US. If approved, the measures will take effect on December 1, 2028. This Third Report and Order builds on rules the FCC has already adopted and is actively enforcing: The FCC already prohibits recognition of test labs and telecommunication certification bodies (TCBs) that are owned by, controlled by or subject to the direction of certain federally identified “prohibited entities,” and has already withdrawn recognition from numerous test labs on that basis.

Limiting recognition of test labs and telecommunications certification bodies

The FCC will vote on rules to limit recognition of test labs to those located in the US and reciprocal economies – i.e., the territory of an economy with which the US has entered into reciprocal treatment through a Mutual Recognition Agreement (MRA) or other comparable reciprocal trade agreement. The prohibition on recognizing non-MRA test labs will be applied to applications received on or after December 1, 2028, and will not affect equipment authorizations granted or applications received before that date. The FCC’s Office of Engineering and Technology (OET) will publish and regularly update the list of countries with reciprocal agreements. The FCC has declined to adopt a waiver process or case-by-case exceptions for test labs in nonreciprocal economies, so manufacturers should not expect case-by-case relief from the December 1, 2028, cutoff.

The FCC recognizes that five out of six radio frequency devices are tested in nonreciprocal countries, and that the incremental costs of complying with the rules will significantly outweigh the quantifiable benefits. These rule changes will impose additional costs for manufacturers. Nevertheless, the FCC finds that the national security benefits justify these increased costs.

Extension of limitations to testing and certifying within nonreciprocal economies

The new rules would not only prohibit test labs, TCBs and laboratory accreditation bodies from being located in a nonreciprocal economy, but also prohibit conducting any “covered activity” in such locations. For TCBs, covered activities include application evaluation, technical review, certification decisions, grant or dismissal, and FCC-required post-market surveillance. For a test lab, covered activities include test setup and operation, required measurements, technical analysis of results, and preparation or approval of the test report. For accreditation bodies, covered activities include the assessment, technical evaluation and decision to accredit a laboratory for a scope used to obtain FCC recognition.

The rules would not extend to pre-compliance or research and development testing that is not FCC-recognized testing and is not relied on in a certification application. An entity that has employees working remotely from a nonreciprocal economy may not perform the substantive covered tasks, but the entity would not lose recognition for simply having unrelated business in the nonreciprocal economy.

Third Further Notice of Proposed Rulemaking

The FCC proposes rules on whether it should also adopt a requirement to utilize the Legal Entity Identifier (LEI) to properly identify test labs, TCBs and laboratory accreditation bodies in its equipment authorization program. The FCC also seeks comment on other proposals to strengthen the integrity of its equipment authorization program, including extending the new rules to prohibit recognition of any entity owned by, controlled by or subject to the jurisdiction or direction of a nonreciprocal economy – a proposal that, if adopted, could reach US-based or reciprocal-economy test labs with foreign ownership or investment ties, not just labs located abroad. The FCC also asks whether equipment authorized through the Supplier’s Declaration of Conformity process should be tested by recognized or accredited laboratories. This last issue could significantly increase the costs of testing these products.

Comments on the Third Further Notice of Proposed Rulemaking will be due 30 days after Federal Register publication, with reply comments due 60 days after publication.

If you are interested in learning more about the new rules or participating in the comment process, please reach out to one of the Cooley lawyers listed below.

UK Consumer Protection Regime – Lessons From the First Investigations by the UK’s Competition and Consumer Regulator

Fri, 09 Oct 2026 16:00:00 Z

In April 2025, new consumer protection measures under the Digital Markets, Competition and Consumers Act 2024 (DMCCA) came into force. This ushered in a new and significantly enhanced consumer protection enforcement regime administered by the UK Competition and Markets Authority (CMA) which has now been in force for almost 18 months and has not wasted any time in flexing its enforcement muscles. In that period, and across several sectors, the CMA has opened investigations into 19 businesses, issued more than 100 advisory letters, imposed fines of close to £6.2 million and ordered over £1.95 million in consumer redress. Further, the CMA shows no signs of stopping.

In this alert, we discuss key lessons which can be drawn from the first round of investigations and comment on what businesses should expect from the CMA going forward.

The CMA’s new powers

The DMCCA introduced new direct consumer enforcement powers and updated and expanded existing consumer protection prohibitions. Each of these developments is significant in its own right, and we summarised them in our April 2025 alert. Importantly, the CMA is now able to conduct investigations and issue infringement decisions without recourse to the court system (which is now only engaged in the event of an appeal against a CMA decision by the undertaking involved), and notably, is able to impose very significant fines.

As well as introducing a new enforcement approach, the DMCCA also updated the UK’s consumer law powers with various amendments and new prohibitions designed to better reflect the digital economy. As a result, the CMA’s stated current enforcement priorities have targeted three areas: fake reviews, drip pricing and online choice architecture.

Key lessons from recent investigations

The CMA is pursuing significant and aggressive enforcement and is actively monitoring businesses operating in the UK. The CMA has opened investigations into 19 businesses in just under a year across a wide range of sectors, including travel, ticketing, driving schools, gyms, parking, fashion, homeware and technology. In addition, the CMA has issued approximately 160 advisory and warning letters and approximately 50 information notices. At least three of these advisory letters are known to have since led to investigations. The CMA is clearly investing resource in delivering on its promise to act with pace.

It is also evident that the CMA is actively monitoring businesses. With the relevant conduct in most cases being publicly visible online, this is a relatively straightforward task for the CMA, which has developed its own sophisticated data tools allowing it to monitor and screen a wide variety of business practices. Businesses should take note that an advisory letter from the CMA is to be taken seriously and could lead to enforcement action if the CMA identifies through its monitoring that the issues identified have not been swiftly addressed. Key lesson: Businesses would be well advised to investigate quickly (under privilege) when warning letters are received, as prompt action to establish whether or not there is any wrongdoing, and consequential rectification can mitigate risk and level of enforcement.

Getting it wrong leads to meaningful fines and consumer redress is a key feature of the enforcement matrix. Out of the 19 investigations opened, three have concluded via the CMA’s settlement route. The CMA’s settlement procedure offers a reduction in the fine of up to 40% in exchange for an admission of liability and full cooperation. Notwithstanding this discount, fines have run into the millions of pounds and, in each case, the settlement included a consumer redress scheme to refund those affected by the relevant conduct.

The AA and BSM Driving Schools: Redress of £760,000 to affected learner drivers and a total fine of £4.2 million for engaging in drip pricing. The CMA’s investigation found that, between April and December 2025, more than 80,000 learner drivers were not shown the total price upfront when booking driving lessons online, as a mandatory booking fee was only included later in the booking process.
Marks Electrical: Redress of £600,000 to affected consumers and a fine of £720,000 in relation to online choice architecture where consumers were automatically opted in to certain services without their consent.
StubHub UK: Redress of £590,000 to affected consumers and a fine of £889,200 in relation to failing to include mandatory fees in the price of tickets shown at the beginning of the sales process (‘drip pricing’).

In addition, in February 2026, the CMA imposed a £473,000 penalty on Euro Car Parks for failure to respond to an information request. This was the first procedural penalty under the new regime and was imposed before the CMA had opened a formal investigation into the company. While the penalty remains under appeal, the CMA has since opened a full investigation into Euro Car Parks to examine whether its practices at petrol stations and its wider appeals process are in breach of UK consumer protection law. Key lesson: The CMA is open to settling these matters, but the reality is that it is not settlement in the way that companies might be used to in ordinary commercial litigation. It is highly procedural, involves an open admission of liability and the settled fines still remain notable.

Consumer enforcement takes priority. The CMA’s enthusiasm to use its new powers is matched by the current government’s focus on cost of living and doorstep issues. As a result, the CMA is now seemingly prioritising consumer over competition law enforcement. In its 2026 annual plan (which we wrote about in April 2026), the CMA indicated that this would be the case. This objective has been supported by aggressive enforcement in practice and significant investment in expanding the consumer enforcement team. To date, the CMA has launched only two antitrust investigations using its powers under the Competition Act 1998 (CA98) during 2026, which stands in stark contrast to the 19 consumer law investigations launched by the CMA since November 2025. Key lesson: Your commercial practices are under the spotlight, and proactive compliance should be seen as a key risk mitigation tool.

The CMA is investigating a broad array of practices. Whilst most cases opened to date fall within its priority areas (fake reviews, drip pricing and online choice architecture), the CMA is also looking at a broader range of consumer protection issues. Other investigations include whether early cancellation fees are unfair and misleading, changes to subscription terms and conditions, time-limited promotional offers and unfair fees. Key lesson: All businesses selling goods and services to consumers should consider themselves in scope.

Being small is no defence. The CMA is not focused only on the largest businesses or any particular sector. Its enforcement targets span a wide range of sectors and business sizes ranging from large US technology companies to smaller UK businesses and small and medium-sized enterprises (SMEs). Key lesson: Compliance matters regardless of size.

Quick resolutions and high case throughput. The CMA has been explicit that it will aim to conduct investigations with pace, prioritising cases that establish precedent and create a deterrent effect in order to promote both business confidence and consumer trust. So far, it seems to be delivering on its promise.

In contrast, a recent UK High Court judgment brought to a close a four-year enforcement case against Emma Matratzen GmbH (Emma Sleep) conducted under the CMA’s previous enforcement powers. The case principally concerned the use of recommended retail prices (RRPs) and ‘was’ pricing and regularity of promotions. While Emma Sleep settled and/or admitted certain elements of the case, the CMA lost on the ratio between products Emma Sleep had to sell at full price versus those it could sell at a discount, with the High Court finding that the CMA’s approach to reference pricing was unjustified and unworkable. The case is, for the time being, damaging to the CMA’s ability to pursue reference pricing breaches and it is to be expected that the CMA will seek to close cases by way of settlement to avoid other cases moving to protracted appeals with the risk of unhelpful precedents. Key lesson: If you are involved in an investigation, you can expect matters to move much more quickly than traditional court proceedings.

Greater CMA focus on consumer protection is consistent with other regulators and a global approach to compliance is recommended. In general, we see heightened and similar activity by consumer regulators in other jurisdictions, focusing largely on the companies’ online activities. In particular, certain of the UK’s new provisions are similar to Section 5 of the , which bans business practices that cause harm to, or are likely to mislead, consumers, supplemented by narrower federal statutes such as the Restore Online Shoppers’ Confidence Act (ROSCA) for subscription/negative-option features, which we have written about here. Whilst the FTC, unlike the CMA, does not have direct enforcement powers, consumer law compliance programmes for international businesses – particularly those with common online interfaces and promotional mechanics – should be developed from a global viewpoint.

We are also anticipating an enhanced regime in the EU where the Digital Fairness Act will look to build upon the existing consumer protection measures around unfair commercial practices, and, similar to the DMCCA, look to bring them up to date with the digital economy. Whilst no draft legislative text has been tabled as yet, when it does appear, it is anticipated that it will cover dark patterns, addictive design, personalised decision-making and pricing, influencer marketing, protection of minors and vulnerable consumers, and will enhance current enforcement measures. Key lesson: This is a global issue, and businesses will need to look at compliance top down and bottom up.

Looking ahead – Future enforcement priorities and next steps

The CMA has signalled that in year two of its enforcement of the DMCCA, which we are now in, it will focus its enforcement efforts on the following areas:

Subscription contracts: New rules around subscription contracts are expected to come into force in January 2027 as part of the government’s series of ‘everyday fixes’ to help UK consumers with the cost of living, with guidance to be issued around a similar time. Businesses will need to provide clearer information upfront, regular reminders and an easier exit. The CMA expects businesses to comply with the new rules as and when they come into force. We anticipate that the CMA is already actively monitoring businesses now with a view to launching investigations as soon as the new powers come into force.
Price transparency: Businesses are advised not to use ‘dripped’ or unlawful partitioned pricing. Any claims in relation to discounts must be true and not misleading.
Fake reviews: The CMA expects businesses to have “robust policies” in place, so reviews give consumers a good and honest indication of what others are saying (and businesses are expected to enforce and implement these policies)
Terms in contracts with consumers: Businesses should review their terms against the CMA’s revised guidance to ensure their terms are fair and transparent. This is especially relevant if contracts impose exit fees on consumers.
The use of AI, including agents: Specific focus is also placed on how businesses use AI, including AI agents. We wrote about this in March 2026.

These developments are set against a wider legislative picture whereby the UK government is expected to launch a consultation in the autumn of 2026 to assess whether false or misleading “was” prices and RRPs should be added to the list of automatically banned practices under the DMCCA. These practices are currently not on the list of practices that are always considered unfair in the DMCCA. Instead, they require an assessment of whether the prices are misleading and have caused a consumer to take a transactional decision that they would not have otherwise taken, but given the adverse ruling in the Emma Sleep case, we may see these practices added to the list.

Whilst enforcement action is ramping up, the impact for current or prospective defendants of investigations remains to be seen – particularly, whether we will see follow-on damages actions and/or if the government chooses to expand the opt-out class action regime to cover consumer law breaches in the same way as it applies to the competition regime.

Overall, compliance with consumer protection regimes is a multidisciplinary effort requiring coordination from legal, engineering, marketing and audit against increasingly complex and fragmented international laws and regulations. Businesses are advised to review compliance for each step of the consumer’s journey – from marketing through to post-sale services – and assess compliance from a global viewpoint.

The Cooley team continues to monitor these developments closely. If you would like to speak to someone about your compliance with UK or global consumer protection regimes, please contact a member of the Cooley team listed below.

CMA Fines Individual Employees for Concealing Evidence During Dawn Raid

Fri, 09 Oct 2026 13:50:03 Z

On 24 September 2026, the UK Competition and Markets Authority (CMA) published decisions imposing financial penalties for concealing evidence during a dawn raid on a senior employee (£20,000), an office manager (£5,000) and their employer, M&J Group Construction & Roofing (£25,000).

These are the first civil penalties imposed by the CMA directly against individuals for concealing evidence during a dawn raid. This is a significant development and represents a warning to individuals that failing to cooperate with the CMA during a dawn raid can have significant personal consequences (not just consequences for their employer).

They follow the £473,000 fine imposed on Euro Car Parks by the CMA for failing to respond to an information notice issued under its consumer law enforcement powers earlier this year, and represent further evidence that the CMA will not tolerate any interference with their investigatory powers.

What happened?

On 10 December 2024, the CMA attended M&J’s premises with a warrant to conduct a search as part of an investigation into suspected bid-rigging in the supply of roofing and construction services. Upon arrival, it provided the usual warnings not to obstruct the inspection, conceal or destroy documents, or provide false or misleading information.

Despite these warnings, Barry Pirrie (M&J’s estimating director) instructed Tracey Woods (the office manager) to remove a work mobile phone and paperwork from the premises, which she did shortly after the CMA’s arrival at 8:35 am. Pirrie then repeatedly told the CMA that he had no work mobile phone.

At around 4:00 pm the same day, M&J’s external lawyers handed the concealed materials over to the CMA. The CMA later found that these materials contained a significant amount of evidence relevant to the underlying bid-rigging investigation, including evidence of Pirrie’s direct involvement in that conduct.

The penalty imposed

The CMA has the power to impose a financial penalty of up to £30,000[1] on any “person” (which includes both companies and individuals) who, without reasonable excuse, fails to comply with a requirement imposed under section 28 (search under a tribunal warrant).

In this case, the CMA concluded that the following fines were appropriate:

Pirrie – £20,000
Woods – £5,000
M&J – £25,000

In each case – although the fine was below the statutory maximum – it was significant, and in the case of Pirrie and M&J near the top end of the available fining range. This reflects how seriously the CMA views this conduct. The CMA cited the following factors in support of its decision to impose fines of this magnitude:

Adverse impact on the investigation – given the risk that potentially incriminating evidence could have been lost or tampered with once it left the CMA’s control
Significant and flagrant conduct – removal of materials; Pirrie’s false statements were intentional, not merely negligent
Seniority and personal advantage – Pirrie, as a department head reporting directly to the CEO with 10 to 15 direct reports, was found to have sought a personal advantage by concealing evidence of his own involvement in the underlying bid-rigging
Diversion of CMA resources – officers had to pause the search to track the movement of staff and materials, review CCTV, search a vehicle and interview witnesses
Need for deterrence – including in respect of junior employees following instructions
In respect of Woods, her more junior, administrative role, her lack of involvement in the underlying bid-rigging conduct, her lack of premeditation, and her personal financial circumstances all reduced her penalty relative to Pirrie’s; despite these mitigating factors, the CMA concluded that a financial penalty was merited which serves as a cautionary tale that even junior employees are acting on the directions of their superiors can be found liable.

How does this compare with the CMA’s wider approach to inspections?

Although this is the first time the CMA has imposed financial penalties on individuals for failing to comply with a dawn raid, this is not the first time the CMA has imposed a penalty on a company in those circumstances. In 2019, the same £25,000 penalty was imposed on Fender when an employee removed multiple notebooks from the premises during a dawn raid.[2]

The CMA is not alone in taking a strict approach to noncompliance. At the European Union level, the European Commission’s IFF decision (Case AT.40882) reflects a similar approach. There, a senior employee deleted WhatsApp messages during a dawn raid and failed to disclose the deletion. As with M&J, the European Commission treated the conduct as a serious intentional obstruction – the same factors (seniority, intent and post-discovery conduct) featured prominently in the penalty assessment which resulted in a fine of €15.9 million being imposed on the company involved.

Practical steps companies should consider to mitigate risk in the event of a dawn raid

The M&J financial penalties further demonstrate the importance of ensuring that protocols are in place for how to manage a dawn raid and that staff have received appropriate training to minimise the risk both to those individuals and to the business as a whole.

We recommend that all companies take the following steps to mitigate risk in the event that they are targeted by a dawn raid:

Pressure-test dawn raid protocols before, not during, an inspection and ensure that appropriate dawn raid training has been carried out. In particular, it is important that all staff are aware that a dawn raid should be taken seriously. Failure to comply can have consequences not just for the company but also for them on a personal level.
Ensure that document retention procedures are available and have been rehearsed and can be swiftly and effectively implemented in the event of a dawn raid.
Keep a record of devices held by employees that are used for work purposes.

How Cooley can help

The first hour of a dawn raid can determine the outcome of any enforcement action. Cooley helps clients stress-test dawn raid protocols, train key personnel and navigate inspection-related risks before they become enforcement issues.

[1] This conduct occurred in December 2024 but note that – since 1 January 2025 – the CMA’s fining power has been expanded to allow the CMA to exceed the £30,000 cap in respect of companies provided the fine does not exceed 1% of turnover. The CMA also has the power to impose a daily fine for ongoing noncompliance but that did not apply in this case as the concealed documents were concealed on the same day.

[2] Fender Musical Instruments Europe Ltd (Case 50565-3, 20 March 2019).

SEC Report on Climate Action 100+ Signals Broader Scrutiny of Coordinated Shareholder Voting

Fri, 09 Oct 2026 07:00:00 Z

On October 7, 2026, the Securities and Exchange Commission (SEC) issued a report of investigation under Section 21(a) of the Securities Exchange Act of 1934 addressing the activities of Climate Action 100+ (CA100) and certain of its members in connection with the 2021 contested director election at ExxonMobil.

The SEC determined not to pursue an enforcement action based on the conduct known to it at this time and made no findings of violations. The report is nevertheless a significant warning to institutional investors and other shareholders that coordinated engagement, including voting activity, even if organized through an intermediary, may implicate beneficial ownership reporting requirements under Sections 13(d) and 13(g).

The report also comes amid broader regulatory pressure on coordinated shareholder voting and the proxy voting ecosystem. One important question to watch is whether the SEC applies similar theories to proxy advisory firms, particularly given the White House's December 2025 executive order expressly directing the SEC to analyze whether proxy advisers may serve as vehicles through which investment advisers coordinate their voting decisions and form a “group” under Sections 13(d) and 13(g). That question is especially timely given the SEC’s ongoing subpoena-enforcement action against ISS seeking data relating to its proxy recommendations and votes.

Key takeaways

No enforcement action, but a clear warning. The SEC’s investigation raised serious concerns, and the SEC used the report to provide guidance for investors participating in similar organizations. Coordinated action prompted by an intermediary’s pressure on members to align regarding the acquisition, holding, disposition or voting of securities may provide circumstantial evidence of an agreement or understanding sufficient to create a “group” as determined under Sections 13(d)(3) and 13(g)(3).
Disclaimers alone are not enough. Investors may reserve independent voting discretion and disclaim “group” status, but the SEC emphasized that actual conduct controls. At the same time, parallel voting, ordinary-course communications, independent voting decisions and passive receipt of an activist solicitation do not, standing alone, establish a “group.”
Schedule 13G eligibility presents a separate risk. Even if investors have not formed a “group,” a qualified institutional investor or passive investor holding more than 5% may lose eligibility to report on Schedule 13G if its activities have the purpose or effect of changing or influencing control of the issuer. The report suggests that this analysis can extend beyond a director contest to coordinated efforts targeting specific management or policy outcomes.
Proxy advisers are a natural area to watch. The report repeatedly focuses on intermediaries that organize investors around shared objectives and voting outcomes. That framework closely tracks the December 2025 executive order, which specifically directed the SEC to consider whether a proxy adviser can facilitate coordination among investment advisers sufficient to create a “group” as determined under Sections 13(d)(3) and 13(g)(3).

What happened at ExxonMobil?

CA100 is an investor coalition organized around climate-related engagement with designated public companies. According to the report, CA100 identified focus companies, designated lead investors to engage with those companies, and developed a process for “flagging” shareholder proposals – and, ultimately, director elections for member support.

ExxonMobil became a particular focus. Following disputes over climate-related shareholder proposals, CA100 participants developed a strategy that contemplated a “board refresh.” In 2021, Engine No. 1 launched a proxy contest seeking to elect four directors to ExxonMobil’s board. CA100 subsequently changed its procedures to permit the flagging of director elections and flagged the ExxonMobil vote. The SEC examined communications and interactions among CA100, Ceres, Engine No. 1 and institutional investors, including BlackRock and State Street, in considering whether investors’ activities reflected coordinated voting rather than independent decision-making.

The SEC ultimately did not bring an enforcement action. But it concluded that coordinated activities of this type may provide circumstantial evidence of an implied agreement to act together, particularly where an intermediary seeks to align investors’ votes, applies pressure to investors whose voting does not align with the coalition’s objectives or otherwise facilitates collective action directed at a particular issuer.

Two distinct beneficial ownership issues

The report emphasizes that “group” formation and Schedule 13G eligibility are separate inquiries.

First, two or more investors can form a “group” under Sections 13(d)(3) and 13(g)(3) through an express or implied agreement, arrangement, understanding or concerted action concerning the acquisition, holding, disposition or voting of securities. If the “group” collectively beneficially owns more than 5% of a covered class, beneficial ownership reporting obligations may arise. Formation of a “group” is a facts-and-circumstances inquiry and can be established through circumstantial evidence; a written agreement is not required.

Second, a qualified institutional investor or passive investor generally may use Schedule 13G only if the securities were not acquired or held with the purpose or effect of changing or influencing control of the issuer. Participation in an organization focused on replacing directors is an obvious area of concern, but the report goes further: Even absent a board refresh campaign, membership coupled with commitments and actions aimed at specific management or policy outcomes may call Schedule 13G eligibility into question.

The report also flags potential consequences from intermediary funding arrangements. In appropriate circumstances, funding routed through an intermediary could raise issues under Rule 13d-3(b)’s anti-evasion provision, which permits beneficial ownership to be imputed where an arrangement is used to circumvent the reporting requirements of Sections 13(d) or 13(g). The SEC did not find such an arrangement with respect to Engine No. 1, but expressly warned that intermediaries cannot be used to shield coordinated activity and influence from disclosure requirements imposed by the beneficial ownership reporting requirements under Sections 13(d) and 13(g).

Separately, the report flagged whether funding channeled through CA100 or Ceres to support Engine No. 1’s solicitation could have made BlackRock or other contributing CA100 members “participants” in that solicitation under Schedule 14A, a status that itself would trigger disclosure obligations under the proxy rules. The report found no evidence of direct funding to CA100 by the asset managers investigated, noting only routine membership dues paid to its investor network, but did not take a view on whether this exposed those members to participant disclosure obligations under Schedule 14A.

What to watch: Could proxy advisers be next?

The report may be most consequential for what comes next. Its focus on organizations that act as hubs for coordinated shareholder engagement overlaps directly with ongoing scrutiny of ISS, Glass Lewis and the broader proxy voting ecosystem.

In December 2025, the White House directed the SEC to analyze specifically whether a proxy adviser can serve as a vehicle through which investment advisers coordinate and augment their voting decisions and thereby form a “group” under Sections 13(d)(3) and 13(g)(3). The executive order also directed the SEC to scrutinize proxy adviser recommendations under the anti-fraud rules, consider additional transparency and registration requirements, and examine investment advisers’ reliance on proxy advice.

The report does not address proxy advisers, and ordinary use of a common proxy adviser does not necessarily mean that investors have agreed to act together. Indeed, the SEC’s emphasis on actual coordination, rather than mere parallel conduct or independently reached voting decisions, is an important limitation on the theory.

Still, the report gives the SEC a detailed analytical framework for examining intermediary-facilitated voting coordination at a time when the administration has already directed it to investigate substantially the same issue in the proxy adviser context. How, and whether, the SEC connects those dots will be an important development to watch heading into the 2027 proxy season.

For public companies, one practical consequence may be more guarded investor engagement. Only last month, SEC staff issued new corporation finance interpretations (CFIs) clarifying that an investor does not, without more, lose Schedule 13G eligibility by participating in issuer-requested discussions about voting decisions or by discussing its views with a person conducting a proxy solicitation. The report pulls in the other direction by emphasizing the risks of coordinated conduct and intermediary-facilitated engagement. Qualified institutional investors and passive investors may therefore become more cautious about engaging in contested or high-profile situations, even when companies themselves are seeking dialogue, potentially making shareholder outreach less candid and predictable heading into proxy season. Companies should also be alert to the beneficial ownership and proxy solicitation disclosure questions that arise where multiple investors appear to be acting through an intermediary or common coalition.

UK Consumer Protection Regime – Lessons From the First Investigations by the UK’s Competition and Consumer Regulator

Thu, 08 Oct 2026 13:58:00 Z

In this alert, we discuss key lessons which can be drawn from the first round of investigations and comment on what businesses should expect from the CMA going forward.

1. The CMA’s new powers

2. Key lessons from recent investigations

The AA and BSM Driving Schools: Redress of £760,000 to affected learner drivers and a total fine of £4.2 million for engaging in drip pricing. The CMA’s investigation found that, between April and December 2025, more than 80,000 learner drivers were not shown the total price upfront when booking driving lessons online, as a mandatory booking fee was only included later in the booking process.
Marks Electrical: Redress of £600,000 to affected consumers and a fine of £720,000 in relation to online choice architecture where consumers were automatically opted in to certain services without their consent.
StubHub UK: Redress of £590,000 to affected consumers and a fine of £889,200 in relation to failing to include mandatory fees in the price of tickets shown at the beginning of the sales process (‘drip pricing’).

The CMA is investigating a broad array of practices. Whilst most cases opened to date fall within its priority areas (fake reviews, drip pricing and online choice architecture), the CMA is also looking at a broader range of consumer protection issues. Other investigations include whether early cancellation fees are unfair and misleading, changes to subscription terms and conditions, time-limited promotional offers and unfair fees. Key lesson: All businesses selling goods and services to consumers should consider themselves in scope.

Quick resolutions and high case throughput. The CMA has been explicit that it will aim to conduct investigations with pace, prioritising cases that establish precedent and create a deterrent effect in order to promote both business confidence and consumer trust. So far, it seems to be delivering on its promise.

In contrast, a recent UK High Court judgment brought to a close a four-year enforcement case against Emma Matratzen GmbH (Emma Sleep) conducted under the CMA’s previous enforcement powers. The case principally concerned the use of recommended retail prices (RRPs) and ‘was’ pricing and regularity of promotions. While Emma Sleep settled and/or admitted certain elements of the case, the CMA lost on the ratio between products Emma Sleep had to sell at full price versus those it could sell at a discount, with the High Court finding that the CMA’s approach to reference pricing was unjustified and unworkable. The case is, for the time being, damaging to the CMA’s ability to pursue reference pricing breaches and it is to be expected that the CMA will seek to close cases by way of settlement to avoid other cases moving to protracted appeals with the risk of unhelpful precedents. Key lesson: If you are involved in an investigation, you can expect matters to move much more quickly than traditional court proceedings.

Greater CMA focus on consumer protection is consistent with other regulators and a global approach to compliance is recommended. In general, we see heightened and similar activity by consumer regulators in other jurisdictions, focusing largely on the companies’ online activities. In particular, certain of the UK’s new provisions are similar to Section 5 of the Federal Trade Commission (FTC) Act, which bans business practices that cause harm to, or are likely to mislead, consumers, supplemented by narrower federal statutes such as the Restore Online Shoppers’ Confidence Act (ROSCA) for subscription/negative-option features, which we have written about here. Whilst the FTC, unlike the CMA, does not have direct enforcement powers, consumer law compliance programmes for international businesses – particularly those with common online interfaces and promotional mechanics – should be developed from a global viewpoint.

3. Looking ahead – Future enforcement priorities and next steps

The CMA has signalled that in year two of its enforcement of the DMCCA, which we are now in, it will focus its enforcement efforts on the following areas:

Subscription contracts: New rules around subscription contracts are expected to come into force in January 2027 as part of the government’s series of ‘everyday fixes’ to help UK consumers with the cost of living, with guidance to be issued around a similar time. Businesses will need to provide clearer information upfront, regular reminders and an easier exit. The CMA expects businesses to comply with the new rules as and when they come into force. We anticipate that the CMA is already actively monitoring businesses now with a view to launching investigations as soon as the new powers come into force.
Price transparency: Businesses are advised not to use ‘dripped’ or unlawful partitioned pricing. Any claims in relation to discounts must be true and not misleading.
Fake reviews: The CMA expects businesses to have “robust policies” in place, so reviews give consumers a good and honest indication of what others are saying (and businesses are expected to enforce and implement these policies)
Terms in contracts with consumers: Businesses should review their terms against the CMA’s revised guidance to ensure their terms are fair and transparent. This is especially relevant if contracts impose exit fees on consumers.
The use of AI, including agents: Specific focus is also placed on how businesses use AI, including AI agents. We wrote about this in March 2026.

CMS Seeks Comments on RAPID Medicare Pathway for Breakthrough Devices

Thu, 08 Oct 2026 07:00:00 Z

In August 2026, the Centers for Medicare & Medicaid Services (CMS) announced a notice with comment period (notice) providing information on the process CMS proposes to use to facilitate Medicare national coverage determinations (NCDs) under the Regulatory Alignment for Predictable and Immediate Device (RAPID) coverage pathway.¹ CMS describes the proposed RAPID coverage pathway as a voluntary process designed to provide accelerated Medicare beneficiary access to certain eligible Class II and Class III US Food and Drug Administration (FDA) breakthrough-designated devices (BDDs). The notice provides an opportunity for stakeholders to provide feedback on the proposed RAPID coverage pathway, with comments due on October 13, 2026.

RAPID reflects CMS’s latest effort to address stakeholder concerns that Medicare coverage of medical devices lags behind FDA market authorization. CMS has indicated that this lag may result, at least in part, from frequent underrepresentation of Medicare beneficiaries in the pivotal studies that support FDA marketing authorization determinations. In the notice, CMS states that “it is difficult for CMS to make an evidence-based decision on whether [a] device is reasonable and necessary” under the statutory standard for Medicare coverage if the device’s supporting clinical evidence does not adequately reflect the Medicare population. ²

Prior CMS efforts to address these concerns include the now-repealed 2021 Medicare Coverage of Innovative Technology (MCIT) final rule and the Transitional Coverage for Emerging Technologies (TCET) pathway established in 2024. CMS states in the notice that the “TCET pathway will be paused for new candidates upon publication of this notice with comment period as CMS focuses on the successful implementation of the RAPID coverage pathway.”³

The notice seeks input on several aspects of the proposed RAPID coverage pathway, such as eligibility criteria, procedural considerations and roles for participants, including manufacturers, FDA, CMS and the Agency for Healthcare Research and Quality (AHRQ).

Proposed eligible devices

CMS proposes that the RAPID coverage pathway would be available only for certain BDDs. Specifically, CMS proposes that eligible devices generally must be one of the following:

Presumptive Class II FDA BDDs participating in FDA’s Total Product Life Cycle Advisory Program (TAP) and planning to submit a de novo request to FDA.
Class III BDDs planning to submit a premarket approval (PMA) application, regardless of TAP participation.

CMS further proposes that, in either case, the device must be in the investigational device exemption (IDE) pre-submission stage, and the manufacturer must plan to conduct an IDE study that enrolls Medicare beneficiaries and evaluates clinical outcomes agreed upon by both FDA and CMS. In particular, the IDE study would be required to evaluate clinical outcomes that FDA determines are appropriate for the device and CMS confirms would provide evidence demonstrating that the device “improves health outcomes for Medicare beneficiaries.”⁴

CMS proposes that otherwise eligible devices would be ineligible for the RAPID coverage pathway if any of the following factors applied:

Based on the information available, there is evidence indicating the device will not fall under a Medicare benefit category.
The device is already the subject of a controlling Medicare NCD.
The device is not a separately payable device that could, if approved, be billed to Medicare.
The device is otherwise excluded from coverage through law or regulation.
The device is an in vitro diagnostic (IVD), such as a diagnostic laboratory test.⁵

On IVD products, CMS states that IVDs are a “highly specific area of coverage policy development,” and that the agency has historically delegated the review of many IVD products to specialized Medicare administrative contractors (MACs).⁶ CMS states its view that the majority of coverage determinations for IVDs that are BDDs “should continue to be determined by the MACs through existing pathways,” and that IVD products therefore “will not be accepted into the RAPID coverage pathway.” ⁷

Regarding the proposed criterion that eligible devices must be in the IDE pre-submission stage, CMS specifically solicits feedback on whether it should establish a temporary process under which devices that have already progressed beyond the IDE pre-submission stage and are currently being studied under an IDE could become eligible for the RAPID coverage pathway. CMS states that, as part of this potential process, CMS and FDA would assess whether ongoing IDE studies evaluate clinical health outcomes that both agencies “have agreed are appropriate to assess the health benefits to the Medicare beneficiary population,” or whether modifications to those studies would be needed to support such assessment.⁸ CMS is seeking input on whether such a process should be established and, if so, how long it should remain available.

Stakeholders with views on the proposed eligibility criteria for RAPID are encouraged to provide input to CMS through public comments.

Proposed key features of RAPID

As outlined in the notice, RAPID would be a voluntary pathway intended to provide manufacturers with “information on the specific health outcomes needed to support Medicare NCDs much earlier in the process,” before FDA market authorization, such that the clinical evidence generated to support FDA review could also support a Medicare coverage decision. ⁹

Key proposed features of the RAPID coverage pathway under the notice include:

Development stage coordination. FDA and CMS would work together, along with the manufacturer, during IDE pre-submission to agree on the clinical health outcomes the IDE study would evaluate. Those outcomes would be intended to support FDA review and provide evidence demonstrating that the device “improves health outcomes for Medicare beneficiaries” to support a CMS coverage determination.
Accelerated NCD timing. If the completed IDE study showed that the device improves the agreed-upon health outcomes for Medicare beneficiaries, CMS would issue a proposed NCD on the same day as FDA market authorization, with a final NCD to be issued as early as 60 days later for Class II devices and 90 days later for Class III devices. Additionally, CMS proposes “to prioritize the opening of RAPID NCDs over non-RAPID NCDs from the NCD Wait List” if CMS is unable to address the total volume of NCDs with its available resources at any given time.¹⁰ This proposal creates timing implications for both RAPID and non-RAPID NCDs.
Potential requirement for further evidence development. The notice states that CMS may issue proposed NCDs for the RAPID pathway under the Coverage with Evidence Development (CED) framework. While many NCDs involve determinations pursuant to Medicare’s “reasonable and necessary” coverage standard under section 1862(a)(1)(A) of the Social Security Act (SSA), CMS also has issued several NCDs under section 1862(a)(1)(E) of the SSA, which CMS describes as supporting the CED pathway under which “Medicare provides coverage for certain promising technologies that have limited supporting evidence.”¹¹ NCDs issued under the CED framework specify that Medicare coverage is available only in the context of CMS-approved clinical research studies, which CMS reviews in collaboration with AHRQ. For RAPID, CMS proposes that it may issue a proposed NCD under the CED framework if there is “insufficient evidence” to support Medicare coverage under SSA section 1862(a)(1)(A).¹² The notice indicates that the degree to which the device improves health outcomes and the relative risk of the device would determine whether further evidence development (i.e., CED) would be part of the NCD.¹³
Voluntary exit. CMS proposes that manufacturers may withdraw from the RAPID pathway at any point before a proposed NCD is issued, and that FDA and CMS also may determine that the RAPID pathway is no longer appropriate.

Proposed stages of the RAPID coverage pathway

CMS describes the RAPID coverage pathway as unfolding in three stages. Below is an overview of the proposed steps and roles of manufacturers, FDA and CMS at each stage:

Stage 1: IDE pre-submission

Manufacturer: Expresses interest in RAPID to FDA before IDE pre-submission and then participates in a RAPID kick-off meeting with FDA and CMS to discuss the proposed IDE study design.
FDA: Screens the device against RAPID eligibility criteria and consults with CMS on benefit category and coverage eligibility considerations. Participates in the kick-off meeting and provides formal written feedback on the IDE study protocol.
CMS: Conducts a preliminary benefit category analysis and consults with FDA. Participates in the kick-off meeting and provides written feedback on whether the proposed health outcomes would be sufficient to support a future NCD.

Stage 2: Formal IDE submission

Manufacturer: Submits the IDE application to FDA and addresses study design considerations identified by FDA and CMS. After FDA approves a revised protocol (if needed), submits the IDE protocol to CMS for approval.
FDA: Reviews the IDE application through its normal process. Issues a decision letter, including any study design considerations, and shares it with CMS.
CMS: Reviews the IDE protocol under its existing IDE review process. If approved, issues a letter confirming its intent to issue a proposed NCD concurrently with FDA market authorization.

Stage 3: Transition from IDE to coverage

Manufacturer: Conducts the IDE study and submits marketing application to FDA. If electing to proceed with RAPID, submits a formal NCD request cover letter to CMS.
FDA: Shares the IDE final study report with CMS. Reviews and authorizes (if approved) the marketing application.
CMS: On the day of FDA market authorization, posts a proposed NCD and opens a 30-day comment period. Targets a final NCD on the 60- or 90-day timeline described above, depending on the FDA class of the device. If CMS believes evidence gaps remain, CMS may issue the NCD under the CED framework. Throughout all proposed stages of the RAPID coverage pathway, CMS would communicate and coordinate with manufacturers, FDA and (for potential CED) AHRQ.

Considerations for stakeholders

RAPID represents CMS’s third attempt in five years to close the timing gap between FDA market authorization and Medicare coverage for innovative devices, following the now-repealed MCIT final rule and the now-paused TCET pathway. Unlike MCIT, which would have provided automatic, time-limited national coverage upon FDA market authorization without requiring Medicare-specific evidence, RAPID takes a fundamentally different approach: It requires manufacturers to build Medicare-relevant clinical outcomes into their IDE studies from the outset, coordinating with both FDA and CMS well before market authorization. This front-loaded evidence requirement means manufacturers that participate successfully may secure a final NCD within 60 to 90 days of FDA authorization, but it also demands a significantly earlier and more sustained investment in the CMS engagement process than prior pathways contemplated.

Several practical considerations stand out for manufacturers evaluating whether to participate:

Timing and development stage. Because RAPID eligibility is generally limited to devices still at the IDE pre-submission stage, manufacturers that have already progressed further in their IDE studies may face a narrow window, or none at all, to participate. Manufacturers should assess where their device programs currently stand and consider whether the potential temporary process for devices that have already progressed beyond IDE pre-submission could apply to their products. Companies with devices at early development stages should begin evaluating RAPID’s potential fit now, since the pathway requires engagement with both FDA and CMS before IDE submission.
IDE study design implications. RAPID requires IDE studies to evaluate clinical outcomes agreed upon by both FDA and CMS – specifically, outcomes that CMS confirms would demonstrate that the device “improves health outcomes for Medicare beneficiaries.” This dual-agency alignment requirement may necessitate adjustments to study populations, endpoints, study duration or sample sizes beyond what FDA alone would require. Manufacturers should factor in the additional time and cost of designing studies that satisfy both agencies’ expectations, including ensuring adequate enrollment of Medicare-eligible populations.
Comment opportunity. Because RAPID is still at the proposal stage, manufacturers and other stakeholders have a meaningful opportunity to shape the potential final pathway through comments due October 13, 2026. CMS has specifically requested feedback on several open questions, including whether to establish a temporary process for devices beyond the IDE pre-submission stage, how long such a process should remain available, and other aspects of the proposed eligibility criteria and procedures. Stakeholders are encouraged to submit detailed comments addressing the aspects of the proposal that affect their device programs and the broader policy questions CMS has raised.

Cooley’s life sciences and healthcare regulatory team closely monitors FDA and CMS regulatory developments and actively works with clients navigating FDA approval pathways, CMS coverage strategies, IDE study design and policy development opportunities. For assistance evaluating the RAPID coverage pathway or preparing comments on the notice, please contact the authors listed below.

Notes

91 Fed. Reg. 51710 (Aug. 11, 2026).
Id. at 51712.
Id. at 51718.
Id. at 51714.
Id.
Id.
Id. CMS adds that, “[i]n the rare case where manufacturers and CMS agree that an NCD is appropriate for an IVD product, manufacturers may submit an NCD request” under the regular NCD request process. Id.
Id. at 51715.
Id. at 51713–51714.
Id. at 51718.
Id. at 51711.
Id. at 51716.
Id. at 51714.

California Amends ‘Stay or Pay’ Law to January 1, 2027, and Expands Exceptions

Thu, 08 Oct 2026 07:00:00 Z

California recently enacted AB 1697, delaying by one year the operative date of AB 692, California’s law restricting “stay or pay” provisions, and expanding its exceptions.

Background

As described in a November 2025 alert, AB 692 applies to contracts entered into on or after January 1, 2026, and prohibits provisions requiring a California worker to repay a “debt,” or imposing any other penalty, fee or cost, upon termination of employment. A key exception covers discretionary or unearned payments made at the outset of employment that are not tied to job performance (e.g., sign-on or relocation bonuses), provided they meet certain conditions – including that the repayment terms appear in a separate contract, and the worker is notified of the right to consult an attorney and given at least five business days to do so.

Employers that violate the law face liability for actual damages or $5,000 per worker, whichever is greater, plus injunctive relief and attorneys’ fees and costs. Workers may bring claims on behalf of themselves and similarly situated workers.

What has changed

Delayed effective date

AB 1697 moves AB 692’s operative date to January 1, 2027, giving employers, in the legislature’s words, “an additional year to structure their employment contracts free of debt traps or quit fees that penalize workers who choose to exercise their freedom of employment.” AB 1697 also makes AB 692 inoperative from January 1, 2026, through December 31, 2026, so no liability accrues for that period, and any pending claim based on conduct during that window is moot.

Modified bonus exception

AB 1697 makes substantive changes to the discretionary or unearned bonus exception. Significantly, it removes the requirement that the bonus be paid “at the outset of employment,” so qualifying bonuses paid at any point during employment may now fit within the exception, provided they still meet the following conditions:

Repayment terms are contained in a contract separate from the employment contract
The worker is notified that they have the right to consult an attorney regarding the agreement and given at least five business days to do so.
Any repayment obligation is prorated based on the remaining term of any retention period (not to exceed two years) and is not subject to interest accrual.
The worker can defer receipt of payment to the end of a fully served retention period without any repayment obligation.
Separation from employment before the retention period is at the worker’s sole discretion, or at the employer’s election due to worker misconduct.

Advanced PTO payments exception

AB 1697 also adds a new exception for repayment obligations that arise from a worker’s voluntary separation, where the obligation relates to an advanced paid time off (PTO) payment exceeding the worker’s accrued balance. To qualify, the exception requires that:

The repayment terms are disclosed to the worker, separately from the primary employment contract, upon the worker's request for the advanced PTO payment.
The repayment obligation does not exceed 40 hours of accrued PTO.
The repayment obligation is not subject to interest accrual.

What hasn’t changed

The underlying prohibitions, the definition of “debt” and other existing exceptions (including the transferable-credential tuition exception) remain unchanged, as do the civil remedies for violations (actual damages or $5,000 per worker, whichever is greater, plus injunctive relief and attorneys’ fees and costs).

Next steps

The delay gives employers additional time to bring repayment arrangements into compliance. Employers should use this time to review and revise bonus and retention arrangements, train relevant teams on the updated law, and stay alert to similar restrictions in other jurisdictions, such as New York and Washington.

If you have any questions about these laws or how to comply, please contact your Cooley employment lawyer or one of the lawyers listed below.

FTC Secures Landmark Robinson-Patman Act Settlement With Southern Glazer’s Wine and Spirits

Wed, 07 Oct 2026 07:00:00 Z

On October 2, 2026, the Federal Trade Commission (FTC) announced a settlement with Southern Glazer’s Wine and Spirits, the nation’s largest wine and spirits distributor, resolving the agency’s closely watched Robinson-Patman Act price discrimination suit. The settlement is the first successful conclusion of an FTC Robinson-Patman Act enforcement action in 26 years, but does not necessarily signal the agency’s intention to broadly apply the statute in similar instances.

Background

In December 2024, the FTC sued Southern Glazer’s in the US District Court for the Central District of California, alleging that the company had violated Section 2(a) of the Robinson-Patman Act by selling wine and spirits to small, independent retailers at prices drastically higher than the prices it charged large national and regional chains, such as Total Wine, Costco and Kroger. According to the FTC’s complaint, Southern generated approximately $26 billion in revenue from wine and spirits sales in 2023 – selling roughly one in three bottles of wine and spirits purchased in the United States – making it one of the 10 largest privately held companies in the country. The complaint alleged that, beginning at least in 2018, Southern routinely charged small, independent retailers significantly higher prices than larger retailers nearby for identical bottles of wine and spirits sold within overlapping time periods. Southern did this through large-volume quantity discounts, cumulative quantity discounts and scan rebates that were generally unavailable to independents and not justified by Southern’s actual costs of distribution.

This is fundamentally a legacy Biden-era case. The FTC’s vote to authorize the original 2024 suit passed 3 – 2 with then-Commissioner Andrew Ferguson and Commissioner Melissa Holyoak dissenting. Commissioner Alvaro Bedoya, joined by then-Chair Lina Khan and Commissioner Rebecca Kelly Slaughter, defended the action as the long-overdue revival of the 1936 statute to prevent large chains from using size-based leverage to extract secret discounts and rebates unavailable to smaller competitors, framing the case as a straightforward secondary-line claim. Ferguson dissented from the outset, writing that while the government does not have the power to suspend a law merely because it disagrees with the law’s underlying policy, the FTC nonetheless has an obligation to carefully choose how it will spend its limited resources.

Outcome

Under the terms of the proposed stipulated consent order, Southern will face defined limitations on its ability to charge small, independent retailers higher prices than it charges competing large retail chains, without admitting liability or wrongdoing. The order covers nearly all of Southern’s wine and spirits sales to the five largest chain retailers across 26 states, including California, Florida, New York, Texas and Washington, among others.

Instead of a blanket nondiscrimination rule, the consent decree sets up a compliance framework built around “Paired Transactions,” a sale by Southern to a top-five retailer by sales volume in a state made around the same time as a sale of a similar product to a nearby small, independent retailer with 75 or fewer locations:

A Paired Transaction becomes a “Discriminatory Paired Transaction” if the price gap exceeds a “Safe Harbor” threshold (state-specific operating costs plus a 2.5% margin).
Southern is considered in violation if excess payments to a given independent retailer add up to more than $5,000 within any rolling 12-month period.
Southern can cure a violation by paying the affected retailer 1.5x the excess amount.
If Southern does not cure, and the FTC later wins an enforcement action, Southern must pay the independent retailer double the aggregated price differentials.
An independent monitor, chosen jointly by the FTC and Southern, will oversee compliance for the order’s six-year term.

FTC Bureau of Competition Director Daniel Guarnera called the settlement “a significant milestone for the FTC in its enforcement of the Robinson-Patman Act,” adding that the agency “is committed to ensuring that all businesses, no matter their size, can compete on a fair and level playing field.”

Chairman Andrew Ferguson, on the other hand, has been blunt about his position on the case, stating he “disagreed with the Democrat Commissioners’ imprudent decision to tie up the Commission’s budget and staff for years to come,” and that he remained, “utterly baffled by [his] former colleagues’ decision to commit thousands of man-hours and millions of dollars of resources to a case addressing an issue that was not injuring American consumers.” Ferguson has maintained that the FTC “should exercise sound discretion to pursue only those Robinson-Patman Act cases where both retailers and consumers are injured by second-line price discrimination.” Commissioner Mark Meador has echoed that consumer harm focus, writing that alcohol distribution’s “unusually poor” regulatory regime “shape[s] pricing and discount practices in ways that make application of the Robinson-Patman Act particularly complicated and can produce pricing differences whose motivation and legal significance depend on state-specific regulatory requirements rather than straightforward evidence of competitive injury or consumer harm.” He instead supports focusing on instances where there is clear consumer harm “in a sector that more directly impacts the cost of living for American families, such as food and groceries.”

Why this matters

For suppliers and distributors operating tiered retail channels, several practical takeaways emerge:

The Southern Glazer’s settlement is significant, but is not necessarily a signal of a Robinson-Patman revival. Although the settlement is noteworthy, it does not signal a resurgence of Robinson-Patman Act enforcement. As the FTC’s first successful Robinson-Patman action in roughly a generation, the case confirms that the agency remains willing to use the statute when warranted. However, Ferguson and Meador unambiguously emphasized that enforcement should focus on cases involving clear consumer harm, limiting the circumstances where the act is likely to be deployed.
Discount and rebate justifications need contemporaneous support. The order requires Southern to retain documentation supporting any cost justification, meeting competition or changed market conditions defense for three years. Suppliers should assume the same evidentiary burden applies to them and should document, in real time, the cost basis for any pricing that favors larger customers.
Internal pricing governance is now an enforcement expectation. The order mandates a formal compliance program, designated compliance officer, mandatory training for commercial and revenue management staff, and confidential reporting channels. Companies with tiered retail channels should consider similar internal controls before the FTC or a private plaintiff comes calling.

The Law of Neural Data Licensing: The State Law Landscape and the De-Identification Question

Mon, 28 Sep 2026 07:00:00 Z

Over the past few years, one of the more visible trends among neurotech companies has been the emergence of neural data licensing as a business model. Companies collect neural data – sometimes from consumer wearables, sometimes from participants in clinical or research studies – and then license that data to third parties, such as developers of “brain foundation models” and other neuroscience companies. What began as an incidental use of research datasets has, in some quarters, become a revenue thesis: “Brain-data-as-a-service” providers now standardize and license neural datasets for others to train large-scale “mental models.” That commercial arc has the potential to intersect with efforts by states to give consumers more control over their personal data.

Five states have laws that make it unlawful or practically impossible to license neural data because they either almost prohibit it (Connecticut, Delaware and Vermont), or they require the consent of the individual whose neural data is to be sold (Colorado and Montana). Since in many cases, companies that hold neural data do not know what states the individuals reside in, licensing out neural data can be prohibitive.

In addition to state laws that prohibit or require consent for the licensing out of neural data, there are additional states that require companies that license out neural data to register as data brokers, which carry a host of operational and legal burdens. Six states run stand-alone data broker registration regimes: California, Oregon, Texas, Vermont, Connecticut and New Jersey. A seventh state, Nevada, regulates a narrower set of data brokers without requiring registration with the state, but affording individuals an ability to opt out of their data being sold or licensed.

Each of the states that regulate the licensing of neural data has different definitions of neural data and different scopes of applicability. Each of the registration laws has its own definition of who is a “data broker,” what kind of data triggers the registration requirement and what thresholds and exemptions apply.

Four structural models of data broker laws are now in play.

Model 1: California

California’s long-standing data broker law defines “data broker” as a business that knowingly collects and sells to third parties “the personal information of a consumer with whom the business does not have a direct relationship.” The law applies to a broad definition of “personal information” – any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

The law classifies neural data as a category of “sensitive personal information,” which is a subset of personal information under the law. The definitional path is short: Neural data that is identifiable to an individual is sensitive personal information; sensitive personal information is personal information; and personal information triggers the data broker regime. As a result, selling identifiable neural data about individuals with whom the business has no direct relationship falls within California’s data broker regime, even when the neural data is transferred without accompanying identifiers – unless the neural data has been de-identified to the California Consumer Privacy Act’s (CCPA) exacting standard, in which case it is excluded from “personal information” and out of scope of the law. Whether neural data can meet that de-identification standard is a threshold question discussed later in this article.

The operational obligations are substantial. For example, registered data brokers must:

Post a privacy policy that contains certain disclosures and offers certain consumer rights.
Pay a $6,000 annual registration fee (increased to $9,500 in 2027), plus payment processing fees, during the January 1 – 31 registration period.
Create and maintain a Delete Request and Opt-Out Platform (DROP) account, download the CPPA’s consumer deletion list at least every 45 calendar days, and delete the consumer’s personal information (including deletion by service providers and contractors) upon match.
Process every deletion request received during the previous access session and report a response code back to the DROP (“Record deleted,” “Record opted out of sale,” “Record exempted” or “Record not found”) at each subsequent access.
Make enhanced disclosures during registration, including whether the data broker has shared for purposes of cross context behavioral advertising, or sold data to specific recipient categories, in the past year and identifying the most common types of personal information collected.

The CCPA regulations also refine the “direct relationship” question in a way that matters for neurotech companies: For the data broker law not to apply, a consumer must have intentionally interacted with the business to access, purchase, use, request or obtain information about the business’s products or services. Collecting data “directly from the consumer” does not, by itself, create a direct relationship if the consumer’s intent to interact with the business is missing – a distinction that matters for research-participant and clinical-trial datasets that later flow into licensing arrangements. The California law affords data brokers some exceptions from consumers’ deletion rights.

Model 2: Connecticut, Oregon and Vermont – Enumerated ‘brokered personal data’

Three states – Connecticut, Oregon and Vermont – apply to a specifically enumerated list of “brokered” personal data information. The list varies in the details, but the shape is consistent: name; address; date of birth; place of birth; mother’s maiden name; unique biometric data used to identify or authenticate the consumer; the name or address of a member of the consumer’s immediate family or household; Social Security or other government-issued identification number; and a catch-all for “other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty” (Connecticut and Vermont), or “can reasonably be associated with the individual” (Oregon).

Neural data is not one of the enumerated categories in any of these three statutes. It is pulled into these regimes only in three specific circumstances:

Bundling with enumerated identifiers. The license package also contains one or more of the enumerated identifiers (name, address, date of birth, Social Security number or the like) alongside the neural data.
Biometric identification or authentication. The neural data is itself being used by the licensor or licensee to identify or authenticate the consumer, bringing it under the “unique biometric data” prong. This prong requires an actual identification or authentication use – not merely that the data could theoretically be used that way. Neurotech companies whose license value proposition is training AI, not identifying users, are typically outside this prong. However, the Oregon law leaves a possibility that biometric information need not be used to identify an individual in order to be covered by the Oregon data broker law.
The identifiability catch-all. The neural data itself, alone or in combination with other data, would allow a reasonable person to identify the consumer with reasonable certainty (Connecticut/Vermont) or can reasonably be associated with the individual (Oregon). This is where the de-identification question lands.

The registration and mechanics vary across these three states. Oregon has required registration since January 1, 2024, with a $600 annual fee paid through the Oregon Division of Financial Regulation, an opt-out disclosure requirement and no state-run deletion mechanism. Vermont has required registration since January 1, 2019 – the first-in-the-nation data broker registration law – with a $100 annual filing to the secretary of state, security-program requirements and enforcement by the Vermont attorney general. Connecticut’s new regime turns on January 1, 2027; the Commissioner must stand up the state’s accessible deletion mechanism by July 1, 2028, and data brokers must begin honoring deletion requests received through it by October 1, 2028; annual public transparency statements begin July 1, 2029; and the first triennial independent audits must be completed by July 1, 2031.

In Connecticut and Vermont, separate laws, if they apply to a business, prohibit the sale of neural data absent the consent of the individuals whose neural data is to be sold. If these laws apply to a business, and they do not have the requisite consent, they cannot license neural data, and therefore the data broker registration requirement becomes moot.

Model 3: The Texas outlier – A revenue-based test

Texas takes a structurally different approach. The Texas Data Broker Act defines “data broker” as a business entity that collects, processes or transfers personal data that the business entity did not collect directly from the individual to whom the data is linked or linkable. “Personal data” for these purposes is broad and includes information linked or reasonably linkable to an identified or identifiable individual.

But Texas layers a materiality test on top of the definition. The law applies only to a business that, in a 12-month period, derives more than 50% of its revenue directly from processing or transferring personal data not collected by the data broker directly from the individuals to whom the data pertains, or any amount of revenue directly from processing or transferring the personal data of more than 50,000 individuals. Registration is a $300 filing with the Texas secretary of state. Obligations include a website notice identifying the business as a data broker, a comprehensive information security program, and civil penalties of $100 per day, capped at $10,000 per year, plus unpaid registration fees for noncompliance.

The practical implication for neurotech companies: Texas structurally protects businesses whose principal revenue is from selling another product or service, even where they engage in some downstream neural data licensing. The Texas law applies to pure-play “data-as-a-service” licensors of identifiable neural data and businesses with sizeable licensed-out populations. Texas also expressly exempts genuinely de-identified data, on essentially the CCPA-style standard: reasonable technical measures to prevent re-identification, a public commitment not to re-identify and contractual downstream controls.

Model 4: New Jersey – Highest fees in the nation and a novel ‘data collector’ concept

New Jersey enacted its data broker law on June 30, 2026 – introduced, passed and signed within a 48-hour window – making it the sixth state with a stand-alone data broker registration regime and, by a wide margin, the most expensive and structurally most disruptive. Unlike every other state’s data broker law, the New Jersey law regulates not only “data brokers” (the traditional definition) but a novel second category called “data collectors” – first-party businesses that sell or license their own customers’ personal data to data brokers. The law also imposes a categorical prohibition on the sale or licensing of “sensitive data,” which took effect immediately upon enactment. But this ban does not apply to neural data, unless it is swept into the prohibition where the neural data reveals mental or physical health condition, treatment or diagnosis of an individual, or where the neural data is processed for the purpose of biometrically identifying an individual. Enforcement rests with the New Jersey attorney general through the Division of Consumer Affairs, and the law contains exceptions that apply in certain circumstances.

Within days of enactment, however, the law drew immediate backlash over its unusually high fees, severe penalties and novel coverage of “data collectors.” A senior official from the administration of Gov. Mikie Sherrill confirmed to the press that the state would not enforce the law until the legislature fixes “certain defects that have come to light,” and, on July 10, 2026, the Division of Consumer Affairs issued a public alert stating that covered data brokers and data collectors will not be required to register or pay any registration fees until the registry launches in spring 2027. The sensitive data sale prohibition, by contrast, has not been paused and remains enforceable now, although that ban does not expressly apply to neural data.

The “data collector” category is the structural novelty. A “data broker” is defined much as in other states – an entity that knowingly collects or purchases the personal data of consumers with whom it has no direct relationship, and sells or licenses that data to third parties. A “data collector,” by contrast, has no analog in any other state’s data broker statute. A data collector is a business that has a direct relationship with the consumer (the individual is or was a customer, subscriber, research subject or similar counterparty) but sells or licenses those consumers’ personal data to a data broker downstream. A consumer neurotech company (for example, a wearable manufacturer that sells or licenses its own users’ neural data downstream to a data broker) is a data collector under New Jersey law, and it is subject to the same registration, fee, disclosure and sensitive data sale prohibition obligations as a traditional broker.

Registration fees are graduated based on the number of New Jersey residents whose personal data is sold or licensed: $5,000 for 100,000 residents or fewer; $10,000 for 100,001 to 499,999; $100,000 for 500,000 to 999,999; $500,000 for 1,000,000 to 1,499,999; $750,000 for 1,500,000 to 2,499,999; $1,000,000 for 2,500,000 to 4,499,999; and $1,500,000 for 4.5 million or more. These are the highest data broker registration fees enacted by any state – the top tier alone is 250 times California’s $9,500 2027 fee. Failure to register or pay the fee is a civil penalty of $2,500 per day; failure to submit or update required disclosures is the same. The law separately bans the sale, offer for sale or licensing of “sensitive data,” carrying a civil penalty of $50,000 per record.

The shared thread: The ‘direct relationship’ carve-out

Most of the state data broker regimes turn on the presence or absence of a direct relationship between the business and the individual whose data is at issue. Under California, Connecticut, Oregon, Texas and Vermont, if the neurotech company sits at the source – the individual is (or was) a customer, a research subject under contract, an investor, a donor or in a similar direct relationship – the business is not a data broker when it licenses out that data. New Jersey is the outlier because of its additional category of “data collector.” As discussed above, New Jersey’s “data collector” category closes the direct relationship exception for any first-party neurotech company that sells or licenses personal data to a downstream data broker. Whether the New Jersey law applies to a business that has a relationship with the individuals whose data is being licensed depends on what the licensee does with the data downstream. Therefore, diligencing (and contractually constraining) the recipient's own resale and relicensing conduct is central to the New Jersey analysis.

State restrictions on sale of neural data

In addition to state data broker registration requirements and consumer opt-out rights, two states (Colorado and Montana) have separate laws that, if they apply, prohibit the sale of neural data of their state residents absent consent from the individuals whose neural data is to be sold, or impose such restrictions on the sale of neural data that it is impractical even with consent (Vermont, Delaware and Connecticut).

Colorado and Connecticut

The Colorado and Connecticut laws apply to essentially any business that sells or licenses out neural data.

Vermont

The Vermont law only applies to businesses that conduct business in Vermont or produce products or services that are targeted to residents of Vermont, and control or process the personal data of 35,000 or more Vermont residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the sensitive data (including neural data) of 3,000 or more Vermont residents, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or offer for sale in trade or commerce the personal data of 3,000 or more Vermont residents

Many businesses that wish to license neural data will likely not be covered by the Vermont law because they do not have a consumer-facing business and do not have a business presence in Vermont or do business with Vermont entities.

Delaware

The Delaware law applies to businesses that conduct business in Delaware or produce products or services that are targeted to residents of Delaware, and control or process the personal data of 10,000 or more Delaware residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the personal data of 5000 or more Delaware residents, and derive more than 20% of their gross revenue from the sale of personal information; or acquired personal data from another entity that is covered by the law

Some businesses that wish to license neural data will not be covered by the Delaware law because they do not have a consumer-facing business and do not have a business presence in Delaware or do business with Delaware entities.

Montana

The Montana law applies to entities that either offer consumer genetic testing products or services directly to a consumer or that collect, use or analyze genetic data. Many businesses that wish to license neural data will likely not be covered by the Montana law because they are not in the genetic testing business.

If neural data is health or biometric information

Neural data might possibly be considered health information if an individual’s health information can be derived from the neural data. Neural data might possibly be considered biometric information if an individual’s identity can be derived from the neural data. If neural data is considered health information or biometric information under applicable laws, additional legal protections are afforded to such data. These additional laws would further regulate data licensing, including by imposing requirements in some additional states to obtain consent before selling or licensing such data.

Federal regulation of the sale of health information

The Federal Trade Commission (FTC) has taken actions against businesses that have sold health information to adtech companies and sensitive location information to third parties. The FTC has reasoned that consumers were not told about the sale and not given a method to decide whether their data would be included in the sale, and thus this practice was an unfair trade practice under federal consumer protection law. To date, the FTC has not applied the same rule to neural data, but it is conceivable that it would if faced with the question.

The federal Health Insurance Portability and Accountability Act (HIPAA) and the Food and Drug Administration regulations on research studies apply to neural data depending on the context in which it is collected – and the nature of the business that has collected it. If these federal laws apply, the state laws do not, but the federal laws come with their own compliance burdens. Businesses that have a choice should architect their way of doing business to either operate under HIPAA or the state laws depending on their preferred regulatory regime.

Two threshold questions: ‘For free’ licensing and revenue/volume gates

Before turning to the de-identification question, two questions of statutory scope cut across every one of the state regimes and are worth flagging together.

1. Does licensing data for free take you out of the regimes?

For most of the state data broker regimes, no. A purported “free” license usually does not remove the arrangement from scope. California defines “sale” broadly to include “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating” a consumer’s personal information to a third party “for monetary or other valuable consideration.” California courts and the state attorney general have consistently interpreted “other valuable consideration” through the lens of California’s general contract law concept of consideration – any bargained-for benefit conferred on the transferor, whether or not money changes hands. In-kind exchanges of neural data for services, joint research outputs, model access or reciprocal datasets are therefore likely to qualify as a “sale.” Connecticut takes a similar approach, defining “license” as granting access to or distributing personal data “in exchange for consideration” – the Connecticut statute expressly contemplates nonmonetary consideration. Vermont and Oregon both use “sells or licenses” without a narrower monetary limitation, and the market has consistently read those terms to reach nonmonetary bargained-for exchanges as well.

Texas is broader still. Its data broker definition captures any business entity that “collects, processes, or transfers” personal data it did not collect directly from the individual. “Transfer” does not require consideration at all, so even a genuinely gratuitous handoff of neural data to a third party can trigger the Texas regime (subject to Texas revenue and volume thresholds, discussed next). New Jersey uses “sells or licenses” without a defined monetary limit, and “licenses” in this context is likely to be read as encompassing noncash arrangements.

The one narrow off-ramp that runs through all of these regimes is a true one-way transfer of data with no benefit flowing back to the transferor – for example, a pure charitable donation of a research dataset to an academic institution with no reciprocal services, no access rights, no attribution and no other consideration. Companies should not assume that framing a license as “no fee” or “complimentary” removes it from scope.

2. Do the state data broker laws apply only to businesses with a certain amount of revenue or volume of data?

The answer depends materially on the state.

California. The data broker regime imports the CCPA’s definition of “business,” which itself has thresholds – in general terms, annual gross revenue in excess of $26,625,000; buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information. A neurotech company below all three thresholds is not a “business,” and therefore not a “data broker,” under the California regime. That said, the 100,000-consumer prong is easy to trip for consumer-facing neurotech, and the 50%-of-revenue prong bites hard for pure-play neural data licensors.
Connecticut, New Jersey, Oregon and Vermont. No revenue or data-volume thresholds.
Texas. Subject to the 50%-of-revenue and 50,000-individual thresholds described above in Model 3.

The upshot: Outside of Texas (and the narrower California “business” threshold), state data broker regimes are not size-gated. A small neurotech company licensing neural data of persons with whom it has no direct relationship can be a data broker, subject to the full compliance stack, in Connecticut, Oregon, Vermont and New Jersey. And in New Jersey, even a first-party neurotech company is regulated as a data collector regardless of size.

The de-identification question

Under every one of these regimes, data that is not identifiable to a specific person, or that has been genuinely de-identified, is out of scope. The California law excludes de-identified data from “personal information;” Connecticut’s law excludes de-identified data from “personal data;” Vermont and Oregon exclude de-identified data through parallel mechanisms; and Texas has an explicit de-identification exception. The statutory standard is broadly similar across the states: The data must not be reasonably capable of being linked to an identifiable individual, and the controller must take reasonable technical measures to prevent linkage, publicly commit not to re-identify and contractually bind recipients to the same standard.

The threshold legal question for neurotech companies pursuing a licensing model is therefore whether their neural data can be de-identified to the applicable legal standard. That question is not settled. Reasonable technical experts disagree. What follows is the best case for each position.

The argument that neural data can be de-identified (and data laws therefore do not apply)

The strongest argument that neural data can be adequately de-identified runs through a simple fingerprint analogy: A fingerprint lifted from a crime scene identifies no one on its own. It becomes identifying only when a fingerprint database exists and the lifted print can be matched against it. Neural signatures work the same way. A neural signal “lifted” from an anonymized dataset can identify a specific individual only where a reference database exists that ties known individuals to their neural signatures. That kind of reference database does not exist today for the general population, and in most licensing scenarios it does not exist for the licensed-out population either. Where the reference set does not exist, the neural signal cannot be linked to any particular person as a matter of fact, regardless of how unique it is in theory. If the reference set does exist, but is not accessible to the entity that holds the neural data, then the neural data is not identifiable from that entity’s perspective.

The statutory standards support this reading. Connecticut requires that the data “cannot reasonably be used to infer information about, or otherwise be linked to,” an identifiable individual. The CCPA requires that the data “cannot reasonably be used” to identify or associate with a consumer. Both standards are grounded in reasonableness, and reasonableness is calibrated to the state of the world today, not to speculative future capabilities. If linking a neural signal to a person requires access to a reference dataset that no one has built for the population in question, the linkage is not reasonably available, and the data satisfies the statutory de-identification test.

The technical picture also cuts more finely than the skeptics allow. Neural signatures are not stable in the way that traditional biometrics are. A fingerprint is essentially fixed for life; a neural signature varies with sleep, mood, attention, age, medication and disease state. The high identification accuracy rates in the research literature are typically achieved within a single session and cohort, on high-fidelity recordings, using algorithms tuned to the specific data. Licensed-out neural datasets can be downsampled, aggregated, cropped to short windows or transformed into derived features that discard much of the individuating detail.

In practice, de-identification measures can combine several techniques at once: removing hidden identifying tags from files (metadata scrubbing), reporting group-level figures instead of individual records (aggregation), adding small amounts of random “static” to obscure exact values (statistical noise), ensuring each described group is large enough that no one person stands out (k-anonymity-style controls), and dropping unusually rare records that would be recognizable on their own (outlier suppression). And where the underlying data is already coarse to begin with – for instance, a summary index (such as an attention or workload score) rather than a raw, moment-by-moment brain signal – the remaining risk of identifying a person can be substantially lower, and in some cases may fall below what the applicable law counts as personal or neural data.

The statutory de-identification standard also depends on business controls that neurotech companies can and do implement. Public commitments not to re-identify, contractual undertakings from downstream recipients, technical safeguards against linkage and monitoring for compliance are all feasible in commercial licensing arrangements. Where those controls are in place and the underlying data is not intrinsically identifying to the population in question, it can be said that the data satisfies the statutory de-identification test, or that it was not identifiable to start. In short, the de-identification off-ramp is available for neural data – it just requires a defensible technical basis and disciplined contractual architecture, not a blanket assumption.

The arguments that neural data cannot be de-identified (and data laws therefore apply)

The identifiability skeptics rest on a growing body of neuroscience research suggesting that neural signatures function as biometric fingerprints. A widely-cited 2015 fMRI study identified individuals from their whole-brain functional connectivity patterns with 93 – 94% accuracy in cohorts drawn from the Human Connectome Project (Finn et al., Functional Connectome Fingerprinting: Identifying Individuals Using Patterns of Brain Connectivity, 18 Nature Neuroscience 1664 (2015)). Each target scan was matched to the most similar entry in a database of prior scans from the same subjects, so the result speaks to the risk of linking a new scan to an existing record rather than to identification from a neural recording alone.

A 2014 EEG study achieved 100% accuracy in matching people to their brain recordings by looking at how different parts of the scalp “talked to” one another at specific frequencies, rather than at any single sensor on their own (La Rocca et al., Human Brain Distinctiveness Based on EEG Spectral Coherence Connectivity, 61 IEEE Transactions on Biomedical Engineering 2406 (2014)). As with the fMRI work described above, that accuracy was measured against a closed reference set – each new recording was matched to the most similar entry in a database of prior recordings from the same people – so the result speaks to the risk of linking a new scan to an existing record rather than to identifying a stranger from a brain recording alone. Later reviews of the EEG-identification literature report similar or slightly lower accuracy figures, typically in the high-80s to high-90s, across a range of methods and datasets.

And identification does not require long recordings. A 2021 MEG study reported that just thirty seconds of resting-state brain activity was enough to correctly pick a participant out of a closed cohort roughly 84% of the time – compared with about 95% when longer segments were used (da Silva Castanheira et al., Brief Segments of Neurophysiological Activity Enable Individual Differentiation, 12 Nature Communications 5713 (2021)).

There is also a distinct identifiability pathway that has nothing to do with neural fingerprinting. In speech and communication brain-computer interfaces (BCIs), the decoded output is not a signal signature but the user’s own words. Everyday speech and messaging routinely surface autobiographical detail – the speaker’s own name, references to family members, an employer or workplace, a medical diagnosis, or other personal facts – that identifies the person on the face of the transcript, without any comparison to a reference dataset. For that class of neural product, the identifying information is embedded in the content itself.

That distinction – between recognizing someone by the pattern of their brain activity and identifying them from what they said – is one instance of a broader point that the current debate tends to skip past: Not all “neural data” is the same thing, and different forms of it carry very different re-identification risk. A raw recording taken directly from the electrodes; a set of summary measurements calculated from that recording (for example, how much activity is present in different frequency bands, or how strongly different brain regions move together); the trained software model that translates brain activity into speech, movement or a category label; the decoded output itself (the actual text, speech or cursor movement the system produces); and a high-level conclusion drawn from the data (for example, a single “alertness” or “focus” score) each sit at a different point on the identifiability scale, even when they all come from the same recording session. What is enough to strip identifying information out of an alertness score will not be enough for a raw recording, and the reverse is equally true. The same regulated term – “neural data” – is doing very different work as the information moves through these stages, and any workable de-identification analysis has to look at the specific form at issue, not just at the category label.

The intrinsic uniqueness of neural data has three consequences under the statutory de-identification tests. First, small datasets are trivially re-identifiable within their own populations: A neurotech company holding neural recordings from 200 research subjects may be able to associate neural data with specific individuals without any external reference. Second, reference datasets are actively being built. Large-scale consumer neurotech products, invasive BCI companies and academic-industrial collaborations are generating neural datasets at scale, and open science initiatives are publishing sizable reference corpora, which means that even a “bare” neural sample that is not identifying today may be identifiable tomorrow through comparison to a growing reference base. Third, neural data reveals sensitive attributes – cognitive state, health conditions, emotional response profiles – that themselves can be linked with other data to re-identify a specific person, especially in small populations with distinctive clinical characteristics.

Finally, the regulatory apparatus is unusually demanding on the de-identification side. It requires reasonable technical measures to prevent re-identification, a public commitment not to re-identify, contractual downstream controls that flow those obligations to every recipient and ongoing monitoring of the recipient’s compliance. Neural data licensing arrangements need to be designed to meet those requirements in practice, particularly the downstream contractual and monitoring components. On the other hand, under the California law for example, if data de-identification has rid a business of any of the personal identifiers that consumers can use to request data brokers to delete their data, such as email addresses and phone numbers, the data broker will be hard-pressed to delete data even in the face of a deletion request, possibly making it impossible for the business to comply with the law.

Where this lands

Reasonable minds will continue to differ, and the answer for any particular licensing arrangement is fact specific. It depends on the type of neural data – identification accuracies vary meaningfully across modalities, and EEG, fMRI, MEG and fNIRS each carry different identifiability profiles even before considering feature engineering, so the answer for a raw EEG recording is not the answer for a downsampled fMRI feature vector. It also depends on the amount of neural data per subject. The size and distinctiveness of the licensed-out population, the availability of a reference dataset that could support linkage, and the technical and contractual architecture the licensor puts around the data round out the analysis. What is clear is that a blanket “we’ll de-identify” strategy is not a substitute for the analysis. Companies pursuing a de-identification path should pressure-test it with both technical experts and privacy counsel – dataset by dataset, modality by modality and duration by duration – and paper the required public commitments, contractual controls and monitoring practices before treating the licensed data as out of scope.

A note on the parallel state consumer privacy law regimes

Separate from the state data broker registration laws discussed above, the sibling comprehensive state consumer privacy laws in 23 states will apply independently to any business that qualifies as a “controller” of neural data, and meets the triggering metrics of the law, meaning a business that (alone or jointly with others) determines the purposes and means of processing that neural data. “Processing” in each of those statutes is defined broadly to include the collection, use, storage, disclosure, sale and licensing of personal data, so licensing neural data downstream is a processing activity that a controller performs. Controllers of neural data are subject to notice, consent, purpose-limitation, minimization, sensitive-data opt-in and data protection assessment obligations under those laws (subject to the state-by-state applicability thresholds), regardless of whether the business is also a “data broker” under the state’s data broker regime. In short, a neurotech company that stays below a data broker regime’s coverage line can still be a controller of neural data subject to the parallel privacy law’s substantive obligations.

Practical takeaways for neurotech companies

Map your data flows against each state’s definitional model. Identify every neural dataset your company licenses, sells or grants access to, and separate them into datasets about individuals with whom you have a direct contractual or similar relationship and datasets about individuals with whom you do not. Also, identify the states of residence of the individuals whose neural data is to be licensed, so that the applicable laws’ requirements can be met.
Do not rely on de-identification as an off-ramp without stress-testing it. Confirm the type of neural data you are licensing, the size and distinctiveness of the licensed-out population, whether a reference dataset exists (or is plausibly being built) that could support linkage, and whether your technical and contractual controls meet the applicable statutory standards. Paper the public commitments and downstream contractual undertakings the statutes require.
Choose your regulatory regime. If your business has a choice between HIPAA and the state data law regime, examine both carefully, choose which regime best meets your data needs, and architect your way of doing business to fit into, and comply with, your preferred regulatory regime.

Regulating AI Like a Doctor: FDA Floats Competency-Based Path for Generative AI-Enabled Devices

Mon, 28 Sep 2026 07:00:00 Z

On August 18, 2026, the US Food and Drug Administration (FDA) Center for Devices and Radiological Health (CDRH) released a discussion paper proposing new approaches to regulating medical devices enabled by generative artificial intelligence (genAI), and requesting stakeholder feedback, which must be submitted by October 19, 2026. The paper is not guidance, but it offers insight into how the agency is thinking about the unique risks and evidentiary challenges posed by genAI-enabled devices. The paper presents two main ideas: a two-axis framework for assessing risk and a “competency-based” model for premarket evaluation inspired by how human clinicians are evaluated and credentialed.

Background

CDRH has been concerned about genAI-enabled medical devices for some time. Following a November 2024 public meeting of its Digital Health Advisory Committee, CDRH identified two categories of regulatory challenges posed by these devices:

Challenges associated with applying a risk-based approach to classifying and determining regulatory requirements for genAI-enabled devices.
Challenges associated with determining the types of valid scientific evidence for FDA’s evaluation of the safety and effectiveness of such devices across the total product life cycle.

This discussion paper offers potential ideas to address these challenges and requests stakeholder feedback.

The two-axis framework

CDRH proposes organizing risk assessment for genAI-enabled software functions in a chart with the horizontal axis representing the degree and independence of the device’s activity and the vertical axis representing the severity of consequences if a user relies on an incorrect output. Risk increases moving from the lower left toward the upper right of the line chart. (See Figure 1)

Figure 1: FDA’s two-axis framework for risk

Within that framework, CDRH puts forth several specific factors that it suggests should shift a function’s risk classification, including, for example:

Measurement and signal processing functions. FDA claims that genAI-enabled in vitro diagnostic, measurement and signal processing functions raise increased concern as their outputs typically cannot be independently assessed by the user. Even though such functions do not direct users to perform an action (a function CDRH considers higher risk than simply providing nondirective information), CDRH proposes to treat them as higher risk because a user cannot identify and avoid relying on an incorrect result.
Patient-facing versus HCP-facing informational functions. CDRH also proposes to weigh whether informational functions delivered directly to patients should be treated as higher risk than the same functions delivered to healthcare professionals (HCPs), since FDA believes that HCPs are generally better positioned to interpret an output, recognize limitations, spot an error and avoid over-relying on it.

Interestingly, both of these considerations appear to come directly from concepts that are structural to FDA’s clinical decision support (CDS) software guidance. The CDS guidance’s nondevice carve-out excludes software that acquires, processes or analyzes signals from an in vitro diagnostic device or a signal acquisition system and requires devices meeting the carve-out to enable an HCP (explicitly not a patient or caregiver) to independently review the basis for a recommendation. CDRH draws that connection itself in the discussion paper, in a footnote where it notes that its concern about measurement and signal processing functions “seems consistent with the independent- review criterion of the clinical decision support exclusion.”¹ Despite criticism that the CDS guidance significantly narrows the statutory carve-out from the 21st Century Cures Act, it appears CDRH proposes to import some of the CDS guidance’s risk logic into a broader framework for genAI-enabled devices generally.²

CDRH also flags other factors it is considering, including how to treat “action-directing” versus “action-taking” functions – terms CDRH uses descriptively as part of its proposed risk framework rather than as terms with fixed regulatory definitions. CDRH has not defined these categories with precision and is specifically asking stakeholders to help refine the distinctions between them. Other factors under consideration include generalist HCP-facing functions versus specialist-facing ones, multi-turn conversations that migrate from informational to action-directing over time and care escalation functions. CDRH specifically requests feedback on this proposed risk framework.

Competency-based model for premarket evaluation

CDRH also previews a possible shift in how genAI-enabled devices could be evaluated by FDA before they are permitted to be marketed. Traditional software device evaluation has relied on testing across a representative sample of defined inputs and outputs. However, CDRH notes that this approach likely will not work for genAI-enabled devices as the range of possible inputs and outputs may be too large for such testing to be practical. Instead, citing recent academic papers that propose evaluating genAI more like a clinician than an unchanging product, CDRH is considering a two-part “competency-based” evaluation model, which includes device benchmarking and clinical confirmation. CDRH anticipates that the scope of benchmarking and the rigor of clinical confirmation would scale with the device’s position on the two-axis risk framework.

Device benchmarking. CDRH envisions device benchmarking as a scalable, nonclinical evaluation to assess whether the device, in its deployed configuration, demonstrates the clinical knowledge, analytic capabilities, safety behavior, communication and generalizability to support reasonable assurance of safety and effectiveness of the device for its intended use. CDRH proposes evaluating devices across categories of competencies, including safety (e.g., recognizing safety-critical situations and communicating uncertainty), clinical proficiency (e.g., clinical knowledge and analysis), generalizability (e.g., robustness, reliability and reproducibility) and additional agentic-specific competencies for agentic AI functions.
Clinical confirmation. CDRH also believes that device benchmarking alone may not fully establish how a genAI-enabled device will perform in actual clinical use, since such devices interact with users, workflows and patient populations in ways that testing may not capture. CDRH therefore contemplates an additional clinical confirmation step, noting that this would not necessarily require a prospective clinical study in every case. Instead, the type and rigor of evidence would be consistent with the device’s risk profile and could range from retrospective evaluation on real patient data to prospective clinical studies or randomized controlled trials.

This competency-based evaluation model would represent a significant departure from traditional premarket review, which has generally relied on testing a device against a defined set of inputs and comparing its outputs to a known standard, such as the paradigm underlying the 510(k) substantial equivalence framework. Under the competency-based approach, by contrast, evaluation would center on whether a device demonstrates proficiency across prespecified categories of clinical knowledge, safety behavior and real-world generalizability – an assessment framework modeled less on product testing and more on how human clinicians are credentialed.

The shift is consequential because it would move FDA toward a qualitative, multidimensional evaluation of device capability. If adopted, this model could fundamentally reshape the FDA’s marketing authorization policy for genAI-enabled devices, replacing conventional input-output testing with a credentialing-style assessment of device competency, paired with clinical evidence scaled to risk. Whether and how these proposals take shape can still be influenced by industry engagement during the comment period and beyond.

Postmarket monitoring

Through the introduction of the competency-based model, CDRH recognizes that the novel capabilities of genAI-enabled devices can make it difficult for premarket testing alone to fully capture device performance. CDRH states that it is therefore considering whether it may be appropriate to accept greater premarket uncertainty regarding a genAI-enabled device’s benefit-risk profile, and instead place greater reliance on postmarket monitoring. The discussion paper identifies a handful of potential approaches to postmarket monitoring that are intended to be proportionate to a device’s risk profile:

Periodic device benchmarking

The manufacturer would reassess the device against the same prespecified benchmarking thresholds used in the premarket evaluation, on a defined cadence and after defined triggering events, including changes to the underlying model or other components of the deployment architecture. This approach is conceptually similar to FDA’s existing Predetermined Change Control Plan (PCCP) framework, under which preauthorized modifications can be implemented without new premarket submissions.

Periodic sample-based clinician review. Qualified, independent clinician adjudicators would review samples of real-world inputs and outputs against prospectively defined criteria, sampled to reflect device encounters in actual use. Although the discussion paper contemplates the use of qualified independent third parties as clinical adjudicators and describes a general methodology for comparing device outputs against independent clinician assessments, it does not address the institutional infrastructure for this process – for example, how adjudicators would be credentialed, whether they would operate under FDA oversight or institutional review board supervision, or what contractual or governance arrangements would apply. These implementation details remain open questions, consistent with the paper’s discussion-only status.
Performance degradation monitoring. The manufacturer would monitor for drift resulting from changes in the input population, data environment or underlying model components.

CDRH also asks for feedback on whether machine-based supervisory agents could help facilitate some aspects of postmarket monitoring, effectively raising the concept of AI agents evaluating AI device functions. This is a notable step for the agency: There does not appear to be precedent for FDA endorsing machine-based oversight of regulated devices, even at the discussion stage, and the proposal underscores the extent to which genAI-enabled devices may require fundamentally different regulatory approaches. Additionally, CDRH proposes a “shared ecosystem responsibility” for postmarket oversight, noting that clinicians, healthcare institutions, payors, professional societies and other stakeholders each may have roles to play in the deployment, monitoring, reporting and ongoing evaluation of genAI-enabled devices.

This framing reflects a broader pattern in FDA’s current thinking: Rather than concentrating all oversight within the agency, FDA is increasingly exploring models that leverage external institutions and stakeholders. For example, FDA’s Expedited IND Pilot, announced on September 15, 2026, under the Department of Health and Human Services’ Operation TrialBlazer initiative, pairs drug sponsors with qualified research institutions to accelerate first-in-human clinical trial timelines through rolling investigational new drug (IND) review – a model that, while structurally different from CDRH’s postmarket vision, similarly relies on distributing regulatory functions across a network of qualified participants within the clinical trial ecosystem rather than handling them entirely within FDA. However, it is unclear under what authority FDA could compel such parties to engage with FDA on these issues.

Foundation model master files

Because many genAI-enabled devices are built on third-party foundation models, CDRH is also exploring whether the existing Device Master File program could be leveraged to improve the agency’s visibility into those underlying models. Specifically, CDRH seeks feedback on the feasibility of voluntary Foundation Model Master Files (MAFs), under which foundation model developers and platform providers could submit information on their models to FDA. These files would be held confidentially by FDA and could be referenced by device sponsors, with the file holder’s authorization, in support of individual premarket submissions. Importantly, CDRH emphasizes that submission of a Foundation Model MAF would not constitute authorization of the underlying model for any device intended use, and device sponsors would remain independently responsible for demonstrating the safety and effectiveness of their own devices.

The voluntary nature of this proposal raises an obvious question: Foundation model developers may have limited commercial incentive to disclose safety-relevant information to a regulator, particularly where doing so could expose limitations or failure modes. CDRH itself acknowledges this tension and asks commenters whether the program could be made sufficiently useful for premarket review given that participation would be optional. If adopted, however, Foundation Model MAFs could streamline premarket review by giving FDA reviewers a baseline understanding of the models underlying multiple device submissions, potentially reducing duplicative information requests and promoting more consistent review across devices built on the same foundation model.

Themes from public comments

Stakeholders filing comments to date have raised a few recurring points. Many commenters, including AI developers, health systems and individual physicians, argue that the two-axis framework should be supplemented with additional risk considerations – such as the detectability of an incorrect output, its reversibility and traceability to the underlying data or specific model – rather than relying on device activity and consequences alone. A similar group cautioned that postmarket monitoring is not an adequate substitute for premarket evidence where harm may be severe, fast-acting or irreversible, and several commenters urge CDRH to require sponsors to affirmatively state what failure modes a monitoring program can and cannot detect before any such trade-off is accepted. Some commenters questioned the feasibility and reliability of the Foundation Model MAFs, given that some models are continuously changing and updated hundreds of times a day. These comments, along with others addressing agentic AI oversight, human-in-the-loop design and foundation model change management, suggest that industry feedback may be helpful and ultimately shape CDRH’s eventual approach.

Practical considerations

As this is a discussion paper, not guidance, CDRH does not propose any new regulatory policy concerning the marketing authorization process or evidentiary requirements at this stage. However, the paper offers a meaningful preview of the agency’s thinking, and stakeholders should not underestimate its significance, particularly given the novelty of its proposals. CDRH discussion papers have historically foreshadowed the agency’s regulatory direction, and stakeholders who engage early in this process will be better positioned to shape the framework before it solidifies into formal policy, guidance for industry or regulation. Companies developing, deploying or investing in genAI-enabled medical devices should consider several near-term actions:

Submit comments by the October 19, 2026, deadline. The open feedback period is one of the most direct ways for stakeholders to influence CDRH’s regulatory approach to genAI-enabled products. Comments submitted through regulations.gov during this window carry particular weight, as CDRH has specifically requested input on its proposed risk framework, competency-based evaluation model and postmarket monitoring approaches. Companies should consider engaging individually or through industry associations.
Map existing and pipeline products against the two-axis framework. Even though the framework is not yet final, companies should begin assessing where their genAI-enabled devices fall along CDRH’s proposed risk axes – degree of device activity and severity of consequences from incorrect outputs. This exercise can identify products that may face heightened scrutiny and help prioritize regulatory strategy and resource allocation accordingly.
Evaluate evidence generation strategies. The competency-based evaluation model, if adopted, would provide guidance for companies to demonstrate device proficiency across defined competency categories rather than relying solely on traditional input-output testing. Companies should assess whether their current clinical evidence and testing infrastructure can support device benchmarking and clinical confirmation at the rigor CDRH envisions.
Review foundation model supply chain arrangements. CDRH’s proposed Foundation Model Master File program, coupled with its emphasis on deployment architecture and model change management, underscores the importance of contractual and operational visibility into third-party foundation models. Companies that rely on third-party models should evaluate whether their existing agreements provide sufficient access to the safety, performance and change-management information that CDRH may expect device sponsors to possess or reference.
Prepare for expanded postmarket obligations. CDRH’s discussion of periodic benchmarking, sample-based clinician review and performance degradation monitoring signals a potentially significant expansion of ongoing compliance obligations for marketed genAI-enabled devices. Companies should consider how these proposals would affect their quality systems, postmarket surveillance capabilities and operational costs.

Cooley’s life sciences and healthcare regulatory team will continue to monitor CDRH’s approach to genAI-enabled devices and is available to discuss how this discussion paper may affect product roadmaps, regulatory strategies or premarket submission planning. We also can assist in preparing a comment letter to FDA in response to the proposals outlined in this paper.

Notes

Discussion paper at 11 n.17 (noting that genAI-enabled measurement and signal processing functions raise concerns “seem[ing] consistent with the independent-review criterion of the clinical decision support exclusion”).
For more information regarding FDA’s CDS guidance, read Cooley’s January 2026 client alert.

DOL Finalizes Rescission of EO 11246 Affirmative Action Rules, Narrows Section 503, Updates VEVRAA Thresholds

Thu, 24 Sep 2026 07:00:00 Z

On August 21, 2026, the Department of Labor (DOL) published three final rules in the Federal Register modifying federal contractors’ affirmative action obligations: formally rescinding the implementing regulations for Executive Order (EO) 11246, following EO 11246’s rescission last year; narrowing Section 503 of the Rehabilitation Act of 1973 to align with applicable law and recent EOs; and making technical changes to the Vietnam Era Veterans’ Readjustment Assistance Act (VEVRAA), including updating jurisdictional thresholds.

Rescission of EO 11246 implementing regulations – effective October 26, 2026

EO 11246 has long required covered contractors to maintain written affirmative action programs (AAPs) addressing race- and sex-based criteria. Following EO 11246’s rescission in January 2025, the DOL now formally rescinded the implementing regulations for EO 11246, which include placement goal and utilization analysis requirements for nonconstruction contractors. The agency cited additional rationales for the rescission, including eliminating legal vulnerabilities, improving efficiency of the government contracting process, decreasing employer burden and aligning the regulations with recent EOs.

Section 503 regulations modifications – effective September 21, 2026

The rule makes the following key changes to contractors’ disability affirmative action obligations under Section 503 of the Rehabilitation Act:

Eliminates the requirement that contractors invite applicants and employees to self-identify their disability status.
Rescinds the 7% utilization goal for individuals with disabilities and the corresponding utilization analyses.
Updates the Section 503 coverage threshold from $15,000 to $20,000 for inflation.
Removes references to EO 11246 and adds administrative procedures at 41 CFR Part 60-30, effective December 21, 2026.

The DOL stated the modifications fulfill EO 14219’s mandate to rescind regulations not authorized by clear statutory authority. The agency noted that the disability self-identification requirement and utilization goal were inconsistent with the Americans with Disabilities Act (ADA), and that the utilization analysis requirements were “now unworkable” given their dependence on the revoked EO 11246.

Importantly, the rule does not change reasonable accommodation requirements or the obligation to develop and maintain an AAP as to individuals with disabilities or protected veterans. Nondiscrimination provisions also remain intact, along with outreach requirements (Subpart C), complaint procedures (Subpart D) and most recordkeeping requirements.

VEVRAA regulations revisions – effective September 21, 2026

The VEVRAA revisions are modest. They remove cross-references to EO 11246, relocate administrative enforcement procedures to 41 CFR Part 60-300, and codify the coverage threshold increase from $150,000 to $200,000 (which had already been implemented in October 2025).

Next steps

The three rules have different effective dates and should be tracked accordingly. By September 21, 2026, contractors should discontinue use of the CC-305 disability self-identification form and review policies and HR systems for compliance with remaining disability affirmative action obligations. By October 26, 2026, contractors should retire any remaining race- and sex-based AAP obligations. Contractors should also consult employment counsel regarding previously collected self-identification data and remain mindful that Title VII, the ADA, and applicable state and local antidiscrimination laws continue in full force. VEVRAA obligations remain largely unchanged.

If you have any questions about these developments, please reach out to a member of the Cooley employment team.

Permission to Innovate: SEC Carves Out Path for On-Chain Stock Trading

Tue, 22 Sep 2026 15:00:00 Z

Temporary relief creates a notice-based pathway for qualifying tokenized securities venues and certain AMM liquidity providers while the SEC considers permanent rules

Bottom line: The SEC is opening a controlled pathway for secondary trading of tokenized US equities through permissioned automated market makers, but the relief is temporary and conditional.

Introduction and policy context

On September 17, 2026, the Securities and Exchange Commission (SEC) issued the long-awaited “Innovation Exemption,” an order under Section 36(a)(1) of the Securities Exchange Act of 1934 granting two forms of temporary, conditional relief. The first exempts qualifying tokenized securities venues (TSVs) from the definition of “exchange,” while the second exempts qualifying liquidity providers, termed “Covered Firms,” from the definition of “dealer” with respect to specified activity in a TSV’s automated market maker (AMM) liquidity pool. The relief expires five years after its publication, subject to earlier modification by the SEC, and the SEC has solicited comment on whether and how to revise, extend or make it permanent.^{^[1]}

The Innovation Exemption arrives at a pivotal moment. Just two days before the order was issued, the Senate rejected cloture, 49 – 50, on the motion to proceed to HR 3633, the CLARITY Act. In an accompanying statement, SEC Chair Paul Atkins expressly linked the two events, describing the exemption as a “bridge toward durable rulemaking.”^{^[2]} The implication is clear: With market-structure legislation stalled, the SEC intends to use rulemaking, exemptive orders and staff-level relief to facilitate on-chain securities activity within its existing authority. Commissioner Hester Peirce struck a similar chord, emphasizing that the exemptions should permit experimentation, self-custody and greater investor autonomy while generating the practical experience needed to inform permanent rules. Commissioner Mark Uyeda likewise characterized the order as a controlled, data-producing experiment designed to advance technology-neutral rulemaking without compromising investor protection or market integrity.^{^[3]}

Notably, the order comes on the heels of the SEC’s separate June 2026 proposal to rescind Regulation National Market System (NMS) rules 611 and 610(e), reinforcing the view that the existing NMS framework may warrant broader structural reform.^[4] The SEC’s central premise is that the NMS framework is fundamentally incompatible with AMM-based trading – including because pool-ratio pricing may not accommodate Rule 611’s trade-through requirements; continually shifting pool compositions and asset allocations complicate Rule 602(a)’s quotation obligations; and AMMs may quote at increments finer than Rule 612 permits. At the same time, the order acknowledges that the transaction, price movement and participant interaction transparency provided by AMMs may potentially obviate the need for certain existing regulations, and it identifies a range of potential benefits that AMM trading can provide for market participants, including self-custody, around-the-clock trading, fractional ownership, near-instantaneous settlement, improved sanctions screening, enhanced auditability and recordkeeping, lower operating and transaction costs, and reduced information asymmetries.^{^[5]}

The order also builds on a series of recent SEC staff statements addressing securities intermediaries and the trading of tokenized securities. First, the December 2025 custody statement identified conditions under Rule 15c3-3(b)(1) for broker-dealer physical possession or control of crypto asset securities. Second, the January 2026 statement set out a taxonomy of tokenized securities, including the distinction between issuer-sponsored and third-party-tokenized securities; further distinguished custodial third-party tokenization from synthetic third-party products; and confirmed that tokenization changes form, but not legal status. Third, the April 2026 interface statement provided a conditional, time-limited staff position for certain self-custodial interfaces used to prepare crypto asset securities transactions. Together, these statements address custody, product characterization and interfaces; the order addresses venues and liquidity providers.^{^[6]}

It is also noteworthy how the order marks a sharp departure from the prior commission’s approach. In 2022, the SEC proposed amendments to Exchange Act Rule 3b-16 that would have expanded the definition of “exchange” to encompass systems using non-firm trading interest and “communication protocols” – capturing a broad range of blockchain and decentralized finance systems, among them the very AMMs that the Innovation Exemption now seeks to accommodate. That proposal drew extensive comment and calls for clarification and was formally withdrawn effective June 17, 2025.^{^[7]}

TSV exemption from definition of ‘exchange’

The order defines a “TSV” as an organization, association or group of persons that brings together buyers and sellers of “Tokenized NMS Stock” by providing one or more AMM liquidity pools for permissioned participants and setting standards for access. The definition is functional: a website, browser extension or other software application that enables a participant to enter, display or agree to trade terms may itself form part of the TSV.^{^[8]}

A TSV that satisfies the order’s conditions is exempt from the definition of “exchange” for Exchange Act purposes and is therefore not required to register as a national securities exchange or operate under the alternative trading system (ATS) exemption. Because the TSV also falls outside the definitions of “trading center” and “market center” under Regulation NMS, the trade-through, access and other provisions of Regulation NMS applicable to those categories do not apply.^{^[9]}

The Innovation Exemption incorporates extensive guardrails designed to ensure investor protection, maintain fair, orderly, and efficient markets, and facilitate capital formation. These include:

Limited eligible securities and issuer objections. Eligible Tokenized NMS Stock encompasses both issuer-sponsored stock and third-party-tokenized stock, but excludes synthetic linked securities, security-based swaps, rights and warrants. Before listing a third-party-tokenized security, the TSV must notify the issuer of the underlying stock and allow at least 30 calendar days to elapse following receipt. A timely issuer objection bars trading, and the TSV must publicly disclose the objection within five business days.^{^[10]} The offshore issuance and trading of synthetic linked securities without issuer consent has generated significant recent controversy; the SEC accordingly scoped the order narrowly to exclude synthetic instruments and to afford issuers an objection right with respect to third-party tokenization of their stock.
Equivalent holder rights. The TSV must verify that each Tokenized NMS Stock confers the same rights and privileges as the equivalent traditional share, including economic, dividend, voting and liquidation rights. For third-party-tokenized stock, related proxy materials and issuer communications must be made available at no cost to the issuer or its shareholders. Notably, the order does not expressly require that the Tokenized NMS Stock be convertible or redeemable into a conventionally recorded share.
Permitted pairs. Tokenized NMS Stock may be paired against another Tokenized NMS Stock, a nonsecurity crypto asset (including a payment stablecoin) or a tokenized money market fund. A nonsecurity crypto asset or tokenized money market fund may trade on the TSV only when directly paired with a Tokenized NMS Stock.
Secondary trading only; registration and participant status unchanged. A TSV may facilitate only secondary trading; primary issuances and initial offerings of securities are not permitted. All offers and sales of Tokenized NMS Stock on a TSV must be registered or exempt under the Securities Act, and the TSV Exemption does not alter the registration status or other regulatory obligations of TSV Participants.^{^[11]}
Permissioned access, US nexus and eligibility. Only verified or credentialed participants and wallet addresses may trade on a TSV, though participation is not limited to institutions or registered entities. Where a third-party provider performs permissioning services on a TSV’s behalf, the TSV retains responsibility for compliance. The TSV itself must be a US person and must comply with applicable Office of Foreign Assets Control (OFAC) sanctions requirements. A TSV generally may not rely on the exemption if it includes a person subject to statutory disqualification, unless the SEC or the relevant self-regulatory organization has approved that person’s continued participation.^{^[12]}
Volume limits and broader market controls. The order categorizes Tokenized NMS Stock into two tiers that mirror the established Limit Up-Limit Down Plan and sets separate symbol and volume caps for each. A TSV may trade up to 75 Tier 1 Tokenized NMS Stock symbols, with volume in each capped at 0.25% of its prior-month average daily share volume, and up to 250 Tier 2 Tokenized NMS Stock symbols, with volume in each capped at 2.5%. Affiliated TSVs must aggregate both their trading volume and their symbol counts. These differentiated thresholds are designed to reflect liquidity differences across stocks, permit meaningful experimentation, and contain potential price dislocations or other spillovers between tokenized and conventional markets during the data-gathering period. Enforcement follows a stepped approach: The first time a TSV exceeds a volume threshold for a given stock, no action is required beyond ensuring future compliance; any subsequent breach triggers an immediate three-month pause in trading of the affected security.^{^[13]}
Transparency and recordkeeping. A TSV must make US-dollar-denominated transaction data – including symbols, price, size, time and direction – freely and publicly available in machine-readable format, updated within 10 minutes of each transaction. The TSV must also maintain comprehensive books and records covering, among other things, trading interest, execution details, permissioning information, fees, stoppages and daily share volume. In addition, the TSV must immediately notify “TSV Participants,” and promptly notify the SEC, of any event that has a significant impact on the operation of the TSV or on its participants.
Stoppages. Although a TSV may offer around-the-clock trading, it must stop trading in a Tokenized NMS Stock concurrently with any halt or suspension of the underlying stock on its primary listing exchange and immediately notify TSV Participants of the stoppage.
No leverage. A TSV may not borrow securities or nonsecurity crypto assets (whether on a secured or unsecured basis), directly or indirectly hypothecate or arrange for the hypothecation of any such assets, or extend credit to a TSV Participant for the purpose of purchasing Tokenized NMS Stock.
Built on public infrastructure. The distributed ledger applications (i.e., smart contracts) used by a TSV must be auditable, publicly available and deployed on a public, permissionless distributed ledger – meaning anyone can read or write to the ledger without authorization. This condition is designed to enhance transparency, support market integrity, and reduce systemic and operational risk by enabling TSV participants and third parties to inspect the applications, audit how trades are effected, report vulnerabilities and better assess the risks of trading on a particular TSV.^{^[14]}

Reliance on the TSV Exemption is notice-based and does not require affirmative SEC approval. It creates no presumption that the TSV would otherwise constitute an “exchange.” In order to qualify for the TSV Exemption, the TSV must publish a detailed notice on its website at least 30 calendar days before commencing operations and, within one business day after publication, notify the SEC by email providing contact information and the notice URL. The notice must disclose, among other things, that the TSV is not registered with the SEC, is not subject to Regulation NMS, and is not subject to the fair-access requirements applicable to registered exchanges and certain ATSs. Once operational, the TSV must update its notice within five business days for new or ceased listings, volume-related pauses, issuer objections and material inaccuracies; 20 calendar days before material operational changes; and within 30 calendar days after quarter-end for nonmaterial changes.^{^[15]}

Covered firm exemption from definition of ‘dealer’

The order also establishes the “Covered Firm Exemption,” which provides temporary, conditional relief from the definition of “dealer” under Section 3(a)(5) of the Exchange Act for certain AMM liquidity providers. As a threshold matter, the SEC recognizes that merely supplying liquidity to an AMM pool does not, standing alone, constitute dealer activity; absent additional indicia, an AMM liquidity provider would ordinarily be characterized as a “trader” rather than a “dealer.”[16] The analysis may become less clear cut, however, where a provider also quotes prices to customers, exercises control over pricing or inventory, enters into market-making arrangements, or enters into agreements, arrangements, or understandings to provide committed capital.^{^[17]}

The Covered Firm Exemption is therefore designed to provide additional certainty for liquidity providers that deploy proprietary capital into Tokenized NMS Stock in an AMM pool operating under the TSV Exemption and that may engage in those additional activities. To qualify, a Covered Firm must: trade solely for its own account; refrain from holding customer assets; maintain records documenting its financial resources, liquidity commitments, agreements and compensation arrangements; disclose on any public-facing website that it is not a registered broker-dealer and may receive liquidity incentives; notify the SEC in writing regarding its business model, controls, arrangements and compensation; confirm that neither it nor its affiliates is subject to statutory disqualification; and consent to SEC requests for information. As with the TSV Exemption, the notification is notice-based and does not require affirmative SEC approval, and reliance creates no presumption that the firm would otherwise be a dealer.^{^[18]}

What the order does not cover

Notwithstanding the breadth of the relief granted, the Innovation Exemption leaves several significant areas of securities regulation undisturbed. The following obligations and limitations remain fully in effect and are not modified, waived or otherwise affected by the order:

Antifraud and anti-manipulation laws. The order provides no relief from Section 10(b), Rule 10b-5, insider-trading restrictions, or any other federal antifraud or anti-manipulation provision. A TSV must also disclose whether and how it monitors for spoofing, wash trading, front-running, pump-and-dump schemes and other manipulative or abusive conduct.^{^[19]}
No broader registration safe harbor. The relief is limited to the exchange status of a qualifying TSV and the dealer status of a qualifying Covered Firm. It does not exempt securities offerings from Securities Act registration, provide relief under the Investment Company Act, determine the regulatory status of token issuers or TSV Participants, or extend to securities activity conducted outside the TSV.
Broker registration unaffected. The Covered Firm Exemption applies solely to the definition of “dealer.” Any person effecting securities transactions for others, soliciting transactions, receiving transaction-based compensation or otherwise acting in a broker capacity must independently assess its broker-dealer registration obligations. The April 2026 interface statement offers only a narrow, time-limited staff position for qualifying self-custodial interfaces that prepare user-directed transactions and satisfy detailed conditions. It does not extend to interfaces that negotiate transaction terms, solicit specific securities transactions, make recommendations or provide advice, arrange financing, process trade documentation, conduct independent asset valuations, handle user assets, execute or settle transactions, or take or route orders.^{^[20]} Registered broker-dealer participants remain subject to all applicable SEC and FINRA requirements; the order solicits comment on whether additional Regulation NMS relief may be warranted but grants none.
Model- and product-specific relief. The exemption does not extend to primary offerings, synthetic tokenized products, unrestricted securities trading, leveraged activity or every on-chain trading model.

The Innovation Exemption represents a welcome and meaningful step toward enabling experimentation and innovation in the trading of tokenized securities, but significant regulatory work remains – both in refining the contours of this relief and in establishing the durable, comprehensive framework that market participants will ultimately need. Peirce separately stated that the order is “not about decentralized finance,” expressed the view that truly decentralized, permissionless systems may not require the relief, and invited market participants operating under alternative models to engage directly with the SEC.^{^[21]}

^{^[1]} SEC, Order Granting Temporary Conditional Exemptive Relief, Exchange Act Release No. 34-106402, at 1 – 7, 57, 60 (Sept. 17, 2026) (the “order”); 15 USC § 78mm(a)(1).

^{^[2]} Paul S. Atkins, Chairman, SEC, Statement on the Innovation Exemption: A Bridge Toward Durable Rulemaking (Sept. 17, 2026); US Senate, Roll Call Vote No. 234 (Sept. 15, 2026).

^{^[3]} Hester M. Peirce, Commissioner, SEC, Slumber Number: Innovation Exemption Statement (Sept. 17, 2026); Mark T. Uyeda, Commissioner, SEC, Statement on the Innovation Exemption (Sept. 17, 2026).

[4] SEC, “The Trade-Through Rule and Locked and Crossed Markets Provisions of Regulation NMS,” Exchange Act
Release No. 34-105655, 91 Fed. Reg. 36,656 (June 17, 2026) (proposed June 11, 2026).

^{^[5]} Order at 11 – 14, especially 12 – 13 (discussing Rules 602(a), 611, and 612, the potential redundancy of certain regulations, and potential benefits of TSVs and distributed-ledger technology).

^{^[6]} SEC divisions of Corporation Finance, Investment Management, and Trading and Markets, Statement on Tokenized Securities (Jan. 28, 2026); SEC Division of Trading and Markets, Statement on the Custody of Crypto Asset Securities by Broker-Dealers (Dec. 17, 2025); SEC Division of Trading and Markets, Staff Statement Regarding Broker-Dealer Registration of Certain User Interfaces Utilized to Prepare Transactions in Crypto Asset Securities (Apr. 13, 2026). Staff statements have no legal force or effect and do not alter applicable law.

^{^[7]} SEC, Amendments Regarding the Definition of “Exchange” and Alternative Trading Systems (ATSs) That Trade US Treasury and Agency Securities, National Market System (NMS) Stocks, and Other Securities, Exchange Act Release No. 34-94062, 87 Fed. Reg. 15,496 (Mar. 18, 2022); SEC, Supplemental Information and Reopening of Comment Period for Amendments Regarding the Definition of “Exchange,” Exchange Act Release No. 34-97309, 88 Fed. Reg. 29,448 (May 5, 2023); SEC, Notice of Withdrawal of Proposed Regulatory Actions, Release Nos. 33-11377, 34-103247, IA-6885, and IC-35635 (June 12, 2025) (withdrawal effective June 17, 2025).

^{^[8]} Order at 1 – 3, 7 – 10 and n.28. By comparison, the prior Rule 3b-16 proposal would have replaced “orders” with the broader concept of “trading interest” and added “communication protocols” as an example of an established, nondiscretionary method, potentially reaching systems such as AMMs. See Rule 3b-16 Fact Sheet.

^{^[9]} Order at 14 – 15.

^{^[10]} Order at 8, 21 – 23; SEC divisions of Corporation Finance, Investment Management, and Trading and Markets, Statement on Tokenized Securities (Jan. 28, 2026) (distinguishing custodial third-party tokenization from synthetic linked securities and security-based swaps); Atkins, “Bridge Toward Durable Rulemaking” (identifying “No Synthetics” and “Issuers Can Object” as key conditions). The order notes that issuers may be concerned about shareholder-register administration, price dislocation and adverse effects on the underlying stock. Order at 21 – 22.

^{^[11]} Order at 15 – 17, 22 – 23. The order also does not provide Investment Company Act relief. Id. at 7 n.22.

^{^[12]} Order at 16 – 19. The exemption is unavailable if an organization, association or person within the TSV group is subject to statutory disqualification, unless the SEC or relevant self-regulatory organization has permitted continued participation. Id. at 16. Permissioned trading may be deployed on a public, permissionless blockchain. Id. at 18 n.55.

^{^[13]} Order at 23 – 28. The SEC used the established Limit Up-Limit Down tiers, set separate symbol and volume limits to reflect liquidity differences, and explained that the limits are intended to reduce the risk that price dislocations in tokenized stock affect the broader NMS market while still allowing meaningful trading. The stepped approach applies to volume breaches, not symbol-limit breaches; affiliated TSVs must pause the same security after a subsequent breach. Id. at 26 – 28 and nn.74 – 75.

[14] Order at 10 n.31, 18 – 19 and nn.54 – 55. Required applications must be auditable, public and deployed on a public, permissionless ledger, but access to the TSV remains permissioned. Public deployment is intended to facilitate independent review, vulnerability reporting, transparency, market integrity and operational resilience. A TSV remains responsible for a third-party permissioning provider.

^{^[15]} Order at 13 n.37, 19 – 21, 28 – 47. The public notice must cover operations, access standards, assets, technology, conflicts, fees, risks, safeguards, market oversight and trading stoppages. Material changes require 20 calendar days’ advance notice; nonmaterial changes must be reported within 30 calendar days after quarter-end. Id. at 20 – 21.

[16] Section 3(a)(5)(B) excludes from “dealer” a person that buys or sells securities for its own account, individually or in a fiduciary capacity, but not as part of a regular business – the so-called “trader” exception. Dealer status remains a facts-and-circumstances inquiry. Order at 52 – 54 and nn.111 – 12; 15 USC § 78c(a)(5)(B).

^{^[17]} Order at 52 – 54.

^{^[18]} Order at 54 – 57. The Covered Firm Exemption runs in parallel with the TSV Exemption and expires on September 17, 2031. Id. at 55, 57.

^{^[19]} Order at 15 – 16, 45 – 46, 55. The order requires disclosure of whether a TSV monitors for specified forms of fraudulent or manipulative activity but does not itself mandate a particular surveillance model. Id. at 45.

[20] SEC Division of Trading and Markets, Staff Statement Regarding Broker-Dealer Registration of Certain User Interfaces Utilized to Prepare Transactions in Crypto Asset Securities (Apr. 13, 2026). The statement is a time-limited staff position under Section 15 and has no legal force or effect.

^{^[21]} Peirce, Slumber Number. Peirce’s statement reflects her individual views and is not an additional condition of the order.

Out With the Old: SEC Proposes to Trim Long-Standing Proxy Requirements

Tue, 22 Sep 2026 07:00:00 Z

On September 16, 2026, the Securities and Exchange Commission (SEC) proposed amendments intended to modernize several proxy solicitation rules under Regulation 14A of the Securities Exchange Act of 1934, as amended (Exchange Act), by eliminating the delivery deadline that applies when documents are incorporated by reference into a proxy statement (or Form S-4/F-4 prospectus), eliminating the requirement to file soliciting material for certain exempt solicitations, shortening the minimum broker search period for proxy solicitations and eliminating the requirement to deliver an annual report to security holders (proxy solicitation proposal). These changes eliminate or shorten fixed timing deadlines and duplicative filing requirements that the SEC views as outdated in light of EDGAR access and electronic communications.

The same day, the SEC also proposed separate amendments that would eliminate the federal rule allowing shareholders to include their proposals in a company’s proxy statement (Exchange Act Rule 14a-8) and would broaden companies’ ability to exercise discretionary voting authority on timely received shareholder proposals submitted outside of the Rule 14a-8 process (Exchange Act Rule 14a-4(c)). The proposing release raises distinct and significant questions of its own, including the shift of shareholder proposal rights to state law and company bylaws, and is addressed separately in our September 17 alert on that topic – SEC Proposes Rescission of Rule 14a-8: What Comes Next?

Comments on the proxy solicitation proposal and proposal to rescind Exchange Act Rules 14a-8 and 14a-4(c) are due on or before November 20, 2026.

At a glance: Current framework versus proposed changes

The proxy solicitation proposal would make several changes as follows:

Eliminate minimum delivery period for proxy statements (or Form S-4/F-4 prospectuses) incorporating documents by reference Schedule 14A (Note D.3); Forms S-4/F-4
Current framework	Proposed change
A proxy statement (or Form S-4/F-4 prospectus) that incorporates information by reference generally must be sent to shareholders at least 20 business days before the meeting	Eliminate the 20-business-day minimum delivery period entirely, on the rationale that the incorporated filings are readily accessible on EDGAR
Eliminate ‘Notice of Exempt Solicitation’ requirement Rule 14a-6(g)
Current framework	Proposed change
Shareholders beneficially owning more than $5 million of a company’s securities at the start of a written exempt solicitation must file a “Notice of Exempt Solicitation” on EDGAR	Rescind Rule 14a-6(g) in full, eliminating both the mandatory notice for large shareholders and the practice of voluntary notices by shareholders with beneficial ownership below the threshold
Shorten broker search period Rule 14a-13
Current framework	Proposed change
A company must commence its broker search – identifying how many sets of proxy materials record holders must forward to beneficial owners – at least 20 business days before the meeting’s record date¹	Shorten the minimum broker search period to five business days, citing technological advances that the SEC notes can now often be completed in as few as three days
Eliminate annual report to security holders and stock performance graph Rule 14a-3; Item 201(e) of Regulation S-K
Current framework	Proposed change
Companies electing directors must accompany or precede the proxy statement with a separate annual report to shareholders, including a stock performance graph²	For companies with a Form 10-K already on file, eliminate the separate annual report and stock performance graph requirements given their substantial overlap with Form 10-K disclosure
Addition of cover page contact information Schedule 14A/14C cover pages
Current framework	Proposed change
No requirement to identify a company representative or contact information on the cover page	Require Schedule 14A/14C cover pages to identify a company representative, including that person’s contact information – an approach similar to that taken with registration statements under the Securities Act of 1933, as amended

Why this matters: A consistent theme of technology-driven modernization

The proxy solicitation proposal is perhaps best understood as part of a broader and consistent pattern under the current SEC administration to revisit disclosure and delivery requirements designed for a paper-based world, and to recalibrate such requirements to match how investors and market participants share and process information today, primarily through EDGAR and electronic channels.³ Several recent, related developments illustrate the same underlying logic:

Tender offer timing and dissemination methods. In April 2026, the SEC’s Division of Corporation Finance (Corp Fin) issued an exemptive order halving the minimum tender offer period for qualifying negotiated, all-cash tender offers from 20 to 10 business days.⁴ Corp Fin conditioned that relief in part on the offeror issuing a widely disseminated press release with a hyperlink to the complete offer materials at commencement, rather than relying on the traditional tombstone advertisement, reflecting the same view that modern information dissemination has outpaced decades-old delivery assumptions.⁵ In July 2026, Corp Fin expanded the permissible dissemination methods for certain tender offer materials at commencement to allow a press release through a widely disseminated news or wire service containing a hyperlink to the full offer materials in lieu of a summary newspaper advertisement or a mailing to shareholders.⁶
Default electronic delivery. On July 16, 2026, the SEC proposed Regulation E-Delivery, which would make electronic delivery the default method for satisfying disclosure delivery obligations across the federal securities laws, reversing the current opt-in framework. As part of that same proposal, the SEC would eliminate the 40-calendar-day e-proxy deadline in Rule 14a-16 under the Exchange Act, on the reasoning that the deadline existed to give shareholders time to receive a paper notice, request paper materials and review them before voting – a rationale that falls away once the paper notice itself is eliminated.⁷

This same rationale drives the proxy solicitation proposal’s most significant delivery change: eliminating the 20-business-day delivery period for proxy statements and Form S-4/F-4 prospectuses that incorporate documents by reference. That period predates EDGAR and the current regime of mandatory electronic filing, and assumed shareholders needed extra time to track down materials that were not otherwise in their hands. The SEC notes that the filings eligible for incorporation by reference are now freely available on EDGAR, that it has taken numerous steps to facilitate electronic delivery, and that investors increasingly expect, and often prefer, electronic delivery of required disclosures.⁸

Those developments, the SEC concludes, have made the 20-business-day period unnecessary today independent of any other reform. The pending Regulation E-Delivery proposal reinforces the same point from another direction: Once electronic delivery becomes the default method of satisfying delivery obligations generally, including for business combination transactions, the case for retaining a paper-era mailing buffer weakens further. Rather than merely shortening the period, the SEC has proposed eliminating it outright, though it has also asked whether a shorter period should be retained instead. A company would still need to deliver a copy of any incorporated document promptly upon a shareholder’s request, preserving a paper-copy option for shareholders who want one.

Eliminating the notice of exempt solicitation

The proxy solicitation proposal would also rescind Rule 14a-6(g), eliminating the requirement for shareholders beneficially owning more than $5 million of a company’s securities to file a Notice of Exempt Solicitation on Form PX14A6G when conducting certain written exempt solicitations. This change follows a sequence of related developments:

Rising voluntary filings. The SEC cited data showing that voluntary filings had grown increasingly common: Proportion of Notices of Exempt Solicitation filed on a voluntary basis grew from roughly 40% of such filings in 2018 to roughly 80% in 2025.⁹ That rising share of voluntary filings suggests many filers were using the notice to publicize their campaign, not because the proxy rules required it.
Corp Fin’s January 2026 guidance. Corp Fin sought to curb voluntary filings by issuing guidance objecting to voluntary Form PX14A6G filings by shareholders below the $5 million threshold, reversing a long-standing practice of not objecting to such filings.¹⁰
The proxy solicitation proposal takes a different approach. Rather than continuing to police who may file voluntarily, the proxy solicitation proposal would eliminate the notice requirement for mandatory and voluntary filers alike, on the conclusion that the distinction between the two no longer serves a meaningful purpose.

Since Corp Fin’s January 2026 guidance, market participants have already turned increasingly to press releases, other media and third-party platforms to publicize campaigns – all still subject to the proxy rules’ antifraud provisions. If the notice requirement is eliminated entirely, companies will need to monitor these channels with greater frequency rather than principally relying on EDGAR to learn they are the target of an exempt solicitation.

Next steps

Companies and investors should continue to comply with the current proxy solicitation rules, including the existing 20-business-day delivery period and the Notice of Exempt Solicitation requirement, unless and until the SEC adopts final rules. Corp Fin has already signaled comfort with a shorter broker search timeline through interpretive guidance, so companies should confirm their current practice reflects that guidance in addition to monitoring this rulemaking.

The SEC has invited commenters to submit feedback before the public comment period closes on November 20, 2026. Given the 60-day comment period, final rules may not take effect before most companies have already locked in their 2027 annual meeting timelines, so proxy statement preparation and meeting planning for the 2027 proxy season should proceed on the assumption that the current framework will remain in place. Companies should nonetheless track the rulemaking closely and start thinking now about how their delivery practices, exempt solicitation monitoring and broker search procedures would need to change if the proxy solicitation proposal is adopted substantially as proposed, and companies should expect these topics to come up in shareholder engagement over the months ahead.

Cooley’s corporate governance and securities regulation attorneys are available to discuss these issues with you.

Notes

In January 2026, the SEC’s Division of Corporation Finance issued guidance stating that the Staff will not object to a broker search commenced in less than 20 business days before the record date, provided the company reasonably believes its proxy materials will be timely disseminated to beneficial owners and otherwise complies with Rule 14a-13. Proxy Rules and Schedules 14A/14C, Corporation Finance Interpretation Question 133.02 (Jan. 23, 2026).
Smaller reporting companies are not currently required to include the stock performance graph in their annual reports to security holders. See Instruction 6 to Item 201(e) of Regulation S-K and Proxy Solicitation Modernization, Proposing Release No. 34-106385 at Footnote 22 in II.A.2 (Sept. 16, 2026).
This theme is not limited to the current SEC administration. The 2023 amendments to Regulation 13D-G, adopted under the prior SEC administration, accelerated Schedule 13D and 13G filing deadlines based on a similar premise that modern systems and market infrastructure support faster information dissemination and processing. See Cooley alert, SEC Adopts Amendments to Beneficial Ownership Reporting Rules: What Investors Need To Know (Oct. 30, 2023).
The order applies to negotiated, all-cash, fixed-price tender offers for all outstanding shares of the target class, subject to a prompt target recommendation and other conditions, and does not extend to going-private transactions or cross-border offers relying on the Exchange Act’s cross-border exemptions. SEC Division of Corporation Finance, Exemptive Order for Tender Offers for Equity Securities (April 16, 2026
Corp Fin cited market efficiency, technological modernization and reduced exposure to intervening market volatility as the policy rationale for the shortened period. See Cooley M&A’s blog post SEC Exemptive Order Halves Minimum Tender Offer Period for Negotiated All-Cash Transactions (May 7, 2026).
Tender Offer Rules and Schedules, Corporation Finance Interpretation Questions 104.03 and 131.04 (July 9, 2026).
For additional information regarding Regulation E-Delivery, please refer to this Cooley alert, From Opt In to Opt Out: SEC Proposes Electronic Delivery as Default for Required Disclosures (July 22, 2026).
See Proxy Solicitation Modernization, at II.B.2.
See Proxy Solicitation Modernization, at II.C.2.
Proxy Rules and Schedules 14A/14C, Corporation Finance Interpretation Question 126.06 (Jan. 23, 2026).

FTC Challenges Interlock Tied to Beretta-Ruger Minority Investment

Tue, 22 Sep 2026 07:00:00 Z

Last week, the Federal Trade Commission (FTC) announced another “interlocking directorate” enforcement action, demonstrating the antitrust agencies’ continued aggressive enforcement of Section 8 of the Clayton Act. The proposed consent order resolves antitrust allegations arising from Beretta Holding’s minority acquisition of shares in Sturm, Ruger & Co. The order settles allegations that the agreement, which allowed Beretta to appoint two members to Ruger’s board of directors, would create an illegal interlocking directorate since the parties are direct competitors in the production and sale of firearms. This action follows the FTC’s announcement that three individuals resigned from the board of Sevita Health in September 2025 due to FTC scrutiny and recent unconfirmed reports that the Department of Justice (DOJ) is investigating a venture capital firm for potential Section 8 violations.

In the Beretta-Ruger matter, the FTC alleged that under the parties’ agreement, Beretta, a subsidiary of Upifra, agreed to increase its stake in Ruger to as much as 25% of Ruger’s outstanding shares. In exchange, Beretta obtained contractual board designation rights: The agreement provided that Ruger’s board “shall” appoint two directors sourced by Beretta to the board, with those directors included on Ruger’s slate of nominees for the 2027 and 2028 annual meetings.

Section 8 of the Clayton Act is a strict liability statute that prohibits the same person from serving as an officer or director of two competing companies, known as an interlocking directorate, regardless of whether the arrangement has any actual anticompetitive effect. The antitrust agencies have interpreted the statute, which refers to the same “person” sitting on the board of competitive corporations, to extend to “representatives” of the relevant corporations.

The rule applies when the companies compete with one another and exceed certain statutory size thresholds, unless one of the statute’s de minimis exceptions applies. Those exceptions generally exempt interlocks where the companies’ overlapping sales are relatively small, either in absolute terms or as a percentage of total sales. Section 8 also provides a one-year grace period to unwind an interlock that becomes unlawful due to changed circumstances, such as a transaction that increases competitive sales above the relevant threshold.

The FTC’s complaint alleged that this arrangement would create an illegal interlocking directorate in violation of Section 8 of the Clayton Act and an unfair method of competition under Section 5 of the FTC Act. According to the complaint, Beretta and Ruger are horizontal competitors across multiple lines of firearms, which the FTC alleged Ruger had acknowledged in its securities filings.

The FTC took particular issue with the fact that, although the agreement nominally required Beretta’s board designees to be “independent,” it lacked robust independence safeguards and permitted waiver of certain independence requirements, potentially allowing Beretta personnel or other non-independent individuals to sit on Ruger’s board. Of note, the FTC did not allege that Beretta intended to appoint an officer or director of Beretta to the Ruger board – the apparent focus was on the alleged lack of “fulsome requirements” on independence for any director. Also of note, the order does not eliminate the appointment right altogether.

The proposed consent order permits the transaction to proceed but imposes structural safeguards on Beretta’s board rights, including that Beretta:

May not appoint, nominate or otherwise cause any person to be appointed or nominated to Ruger’s board unless that person is a genuinely “Independent Director,” as defined to exclude anyone with a “Material Relationship” with Beretta or its parent.
Must give the FTC at least 15 days’ advance written notice before any board appointment, designation, nomination or election involving Ruger.
May not hire or enter into any financial or other relationship with an independent director it nominates that would compromise that director’s fiduciary duties, or that would facilitate the flow of Ruger’s nonpublic information to Beretta, for one year after that director leaves the Ruger board.
May not otherwise seek or receive Ruger’s nonpublic information from any director it nominates.

The order runs for five years, with interim and annual compliance reporting obligations, and requires Beretta to circulate the order to new board members and officers on an ongoing basis.

Why this matters

The enforcement action extends beyond officers or directors of competing corporations to appointed “representatives” and requires that those representatives be “independent.” The FTC scrutinized the substance of the independence protections in the agreement, not just the label. Contractual board rights that merely describe designees as “independent,” without a robust definition and without limits on waiver, will not insulate an interlocking directorate arrangement between competitors from scrutiny.
The current administration has shown it is broadly open to remedies, including Section 8 enforcement. Often companies remedy interlocking directorate concerns by having the offending director step down from the relevant board, but without signing a consent. Here, the FTC required a consent order, but the order does not block the appointment power outright. The FTC’s consent order provides a framework for parties considering investments in competitors, including independence requirements, information-sharing restrictions and a cooling-off period for departing directors.
The FTC is prepared to use its administrative complaint and consent order process to address board interlocks proactively, before they are ever seated. The FTC press release announcing the Beretta enforcement action stated, “This latest enforcement action serves as a warning that the FTC will take action to prevent anticompetitive board of director overlaps between competitors.”
Building on increased enforcement activity in the Biden administration, the current administration has also been focused on interlocking directorate issues, and Section 8 enforcement remains a priority. In announcing the September 2025 Sevita enforcement action that resulted in three individuals resigning from the Sevita Health board, the FTC noted, “We are committed to enforcing the Clayton Act’s prohibition on interlocking directorates, which risk suppressing competition.” This action follows attention from the DOJ and FTC to interlocking directorates, including a wave of board resignations obtained by the DOJ in 2022 and 2023 without formal litigation. Given this continued scrutiny, it is important for companies to ensure that their boards comply with Section 8, including reviewing board memberships when board members are added as a result of new investments.

SEC Proposes Rescission of Rule 14a-8: What Comes Next?

Thu, 17 Sep 2026 07:00:00 Z

On September 16, 2026, the Securities and Exchange Commission (SEC) proposed to rescind Rule 14a-8 under the Securities Exchange Act of 1934 in its entirety. If adopted, the proposal (proposed amendments) would eliminate the federal mechanism that for more than 80 years has allowed qualifying shareholders to require public companies to include their proposals in company proxy materials. In the same release, the SEC also proposed amendments to Rule 14a-4(c) that would expand companies’ ability to exercise discretionary voting authority on shareholder proposals submitted outside of the Rule 14a-8 process.

In a separate proposal issued the same day, the SEC proposed to modernize other aspects of the proxy rules, including to: eliminate the requirement that companies deliver an annual report to security holders, eliminate the delivery deadline when documents are incorporated by reference into a proxy statement, eliminate the requirement to include a stock performance graph in annual reports, eliminate the requirement and the ability to submit Notices of Exempt Solicitation (both required and voluntary filings), and shorten the minimum broker search governing the period by which record holders forward proxy materials to their customers (the beneficial owners of a company).

These are proposals, not immediate rule changes. The SEC must complete the public notice and comment process and, if it decides to proceed, adopt final rules. Any final rescission of Rule 14a-8 would likely face substantial litigation. We therefore expect that Rule 14a-8 will remain in effect through the 2027 proxy season. Even so, the proposed amendments could affect proponent behavior now. If proponents view 2027 as a possible last opportunity to use Rule 14a-8, they may use it more aggressively, including to seek company-specific proposal rights that would survive Rule 14a-8’s rescission.

Comments on the proposed amendments are due 60 days after publication of the proposing release in the Federal Register.

Key takeaways

The proposed amendments would rescind the federal shareholder proposal framework of Rule 14a-8. This would eliminate long-standing rules that allow qualifying proponents to include their proposals in a company’s proxy materials.
Do not expect proposed rules to be effective for the upcoming proxy season. The proposed amendments must move through the public notice and comment period and survive other hurdles, including likely litigation, before becoming effective. Companies should therefore plan for the 2027 season under the existing rules.
2027 could become a “last chance” season. The prospect of rescission may drive a surge in shareholder proposal submissions under Rule 14a-8, including both traditional governance proposals and proposals designed to create a shareholder proposal proxy access right that would survive a rescission of Rule 14a-8. Some companies have already received such proposals for this upcoming proxy season. Cooley’s June early proxy season alert previewed many of these themes.
Private ordering may become the central battleground. The closest analogy may be proxy access for director nominations by shareholders. After the SEC’s mandatory proxy access rule was vacated in 2011, shareholder proposals submitted under Rule 14a-8 drove company-by-company adoption of proxy access for director nominations by shareholders. Given the proposed rescission of Rule 14a-8, proponents may have only a limited window to use the Rule 14a-8 process to establish company-specific proxy access rights for shareholder proposals.
State law and governing documents would take on greater significance. Texas has already enacted an opt-in statutory framework addressing shareholder proposal rights more broadly. In Delaware, whether shareholders have an inherent right to bring precatory proposals remains unsettled; the debate could move to the legislature and the courts.
Rescission of Rule 14a-8 would redirect activism, not eliminate it. Activism efforts are likely to shift toward other strategies, including director “vote no” campaigns, proxy contests, litigation, direct engagement and targeted publicity campaigns. If adopted, the proposed Rule 14a-4(c) amendments would provide companies with greater flexibility to exercise discretionary voting authority on shareholder proposals submitted outside of the Rule 14a-8 process, subject to disclosure and an affirmative shareholder opt-out election. Importantly, however, while the proposed amendments to Rule 14a-4(c) are intended to address the concern that “zero slate” campaigns can pressure companies to include in their proxy materials shareholder proposals that might otherwise be excludable under Rule 14a-8, effectively circumventing the Rule 14a-8 process, the amendments would not prohibit zero slate campaigns. Indeed, if adopted and Rule 14a-8 is rescinded, they could further elevate zero slate campaigns as a prominent activist tool, providing a means for bringing shareholder proposals to a vote.

Rule 14a-8 in brief: An 80-year federal shareholder proposal mechanism under pressure

The SEC first adopted the federal shareholder proposal mechanism in 1942. Rule 14a-8 generally requires a company subject to the federal proxy rules to include, at the company’s expense, a qualifying shareholder proposal and any accompanying supporting statement in its proxy materials if the shareholder satisfies minimum ownership, holding period and other procedural requirements. The rule also provides procedural and substantive bases for exclusion, including ordinary business or micromanagement, substantial implementation, duplication of another proposal and resubmission of a substantially duplicative proposal.

The proposing release rests principally on the SEC’s view that Rule 14a-8 exceeds the agency’s statutory authority under Section 14(a) of the Exchange Act. The SEC takes the position that Section 14(a) authorizes regulation of the proxy solicitation process but does not authorize it to displace state law on the corporate governance question of which matters shareholders may present or require to be included in company proxy materials.

The SEC also cites independent policy reasons for rescission, including its view that some of Rule 14a-8’s original justifications are unsubstantiated in practice or less compelling today, that the rule requires the SEC to make judgments about state law, and that a uniform federal regime has inhibited development of state law and private ordering.

The proposed amendments follow the dismantling of the SEC staff’s long-standing Rule 14a-8 no-action process. For decades, companies seeking to exclude proposals routinely sought SEC staff concurrence, creating a substantial body of interpretive precedent. In November 2025, the SEC staff largely stepped back from substantive no-action responses, and on August 14, 2026, it announced that it would stop responding to shareholder proposal no-action requests altogether, while leaving companies’ obligations to provide notice of exclusions pursuant to Rule 14a-8(j) in place. See the SEC staff’s August 14, 2026, statement.

The proposed amendments also follow years of debate over the politicization of the shareholder proposal process. Proposal volume rose sharply over the past decade, with submissions approaching 1,000 at Russell 3000 companies in recent peak seasons. A relatively small group of serial individual proponents, policy-focused investment funds, labor and advocacy organizations, and, more recently, anti-ESG proponents have accounted for a significant share of submissions. Many proposals address contested social or political topics, including climate, diversity, equity and inclusion (DEI), and other environmental, social and governance (ESG) matters. SEC staff guidance has also shifted across administrations, particularly on environmental and social (E&S) proposals (see Cooley’s February 2025 client alert).

More broadly, the proposed amendments reflect the SEC’s current willingness to revisit long-standing rules it views as imposing unnecessary cost and complexity for public companies or making the public markets less attractive. Alongside other recent initiatives to reduce public company burdens and facilitate capital formation, rescinding Rule 14a-8 would be a significant step in that agenda.

What the proposed amendments would do

Rescind Rule 14a-8

The proposed amendments would rescind Rule 14a-8 in its entirety. Once effective, public companies would no longer have a federal obligation under Rule 14a-8 to include qualifying shareholder proposals in company proxy materials, and the rule’s ownership thresholds, procedural requirements, substantive exclusions and Rule 14a-8(j) exclusion notice framework would fall away with it.

Rescission would not prevent shareholders from raising matters at meetings or conducting their own solicitations. It would instead shift the default away from a uniform federal inclusion right and toward state corporate law, company charters and bylaws, advance notice provisions, and the remaining federal proxy rules governing independent solicitations.

Expand discretionary voting authority under Rule 14a-4

The proposed amendments also would amend Rule 14a-4 to broaden companies’ ability to exercise discretionary voting authority on timely received shareholder proposals submitted outside of the Rule 14a-8 process. Under current Rule 14a-4(c)(2), a proponent can prevent the company from exercising that authority by furnishing its own proxy materials to holders of at least the percentage of shares needed to approve the proposal. The proposed amendments would eliminate that solicitation threshold. Instead, a company could exercise discretionary voting authority if it satisfies the following three conditions:

Its proxy statement briefly describes the proposal and states how it intends to exercise that authority.
Its proxy card cross-references that disclosure.
It includes a check box on its proxy card allowing shareholders to prevent the company from exercising discretionary authority with respect to their individual shares. A company could use a single opt-out box for multiple proposals.

The proposed amendments to Rule 14a-4(c) are intended to address the concern that zero slate campaigns, first employed at Warrior Met Coal during the 2024 proxy season, can pressure companies to include in their proxy materials shareholder proposals that might otherwise be excludable under Rule 14a-8, effectively circumventing the Rule 14a-8 process. However, the amendments would not prohibit zero slate campaigns. Indeed, if adopted and Rule 14a-8 is rescinded, they could further elevate zero slate campaigns as a prominent activist tool, providing a means for bringing shareholder proposals to a vote. See Cooley’s 2024 proxy season alert for additional background on zero slate campaigns.

Clarify application of advance notice deadlines and amend related disclosure requirements

Proposed amendments to Rule 14a-4(c)(1) would clarify that a company’s advance notice provision, or an applicable state law provision, generally determines whether a proposal is timely received for purposes of exercising discretionary voting authority. The current 45-day federal default deadline would apply only if no such provision exists. Similarly, the proposed amendments to 14a-4(c)(1) provide that if a company did not hold an annual meeting during the prior year, or if the date of the meeting has changed more than 30 days from the prior year, any deadline established under the company’s advance notice provision, or an applicable state law provision, would govern instead of the default deadline in the current rule (which is “a reasonable time before the registrant sends its proxy materials”). Proposed amendments to Rule 14a-5(e) would, if Rule 14a-8 is rescinded as proposed, align proxy statement deadline disclosures with governing documents or applicable state law for proposals seeking inclusion in a company’s proxy materials and with amended Rule 14a-4(c)(1) for proposals not seeking inclusion. If the date of the next annual meeting changes by more than 30 days, proposed amendments to Rule 14a-5(f) would also require companies to disclose updated shareholder proposal and director-nomination deadlines, to the extent applicable.

Change preliminary proxy filing requirements

The proposed amendments also would amend Rule 14a-6 so that the submission of a shareholder proposal outside the 14a-8 process would not itself trigger a preliminary proxy filing. A preliminary filing instead would only be required when the company knows, or reasonably should know, that a nonexempt “solicitation in opposition” is being conducted by the shareholder proponent. A “solicitation in opposition” would be broadly defined to include any solicitation (other than a solicitation exempt under Rule 14a-2): subject to Rule 14a-19, to vote against or withhold votes from any of the company’s director nominee(s), to vote against a proposal that the company expressly supports in its proxy materials, and to vote in support of a proposal that the company does not expressly support in its proxy materials.

Do not expect an overnight change

The proposed amendments do not change Rule 14a-8 today. The SEC must solicit public comment, review the resulting record, and, if it decides to proceed, adopt a final rule that addresses the significant issues raised by commenters. Companies should therefore continue planning for the 2027 proxy season under the existing rule.

Significant or controversial rulemakings can take time. The SEC’s 2026 proposal to permit optional semiannual reporting, for example, reportedly generated roughly 200,000 comments and form letter submissions. A proposal to eliminate an 80-year-old federal shareholder proposal framework likewise is likely to attract substantial participation.

Any final rescission also would likely face substantial litigation. The now-stayed climate disclosure rules illustrate how rulemaking and litigation can extend the timeline: The SEC proposed the rules in March 2022, adopted them in March 2024 and stayed them after legal challenges were filed. The SEC later changed course after the 2024 election. Similar litigation here could delay effectiveness, and challengers could seek a judicial stay. With the 2028 presidential election approaching, the process could extend into another administration.

2027 could be the ‘last chance’ Rule 14a-8 season

While Rule 14a-8 is expected to remain in effect through the 2027 proxy season, the proposed amendments could have an immediate effect on proponent behavior. Many calendar-year companies begin receiving shareholder proposals in the fall, and a credible prospect of rescission could create a rush to use the federal process while it remains available, potentially reversing the recent decline in proposal volume.

That dynamic would arrive against an already unsettled backdrop. As discussed in our June 2026 shareholder proposal season review, the SEC staff’s retreat from the no-action process altered company-proponent negotiations during the 2026 season and was accompanied by increased proponent litigation. The staff’s August 2026 decision to stop responding to no-action requests entirely means companies should expect to enter the 2027 season without the substantive staff concurrence that historically provided greater predictability around exclusion decisions. As a result, exclusion decisions may require a more litigation-focused approach. Companies should identify potentially excludable proposals early, preserve the Rule 14a-8(j) notice deadline (generally 80 calendar days before filing definitive proxy materials), develop a robust legal analysis supporting any exclusion decision, and assess in advance their risk tolerance for excluding a proposal without SEC staff concurrence. Companies should also anticipate that exclusion decisions could prompt litigation, public campaigns or director-focused pressure, and consider whether early engagement with proponents may help mitigate those risks.

Under these circumstances, some companies may prefer to skip the exclusion or negotiation process and simply allow many proposals to go to a vote, particularly on less sensitive topics or where low support is expected. Conversely, the SEC’s stated view in the proposing release that Rule 14a-8 exceeds its statutory authority may cause some companies to view both the litigation risk and the reputational consequences associated with exclusion as more manageable and, as a result, take more aggressive positions on whether particular proposals may be excluded.

The most consequential submissions may not be ordinary E&S or governance proposals, but proposals designed to preserve shareholder proposal rights in a post-Rule 14a-8 world. Proponents may pursue precatory proposals asking boards to adopt a shareholder proposal bylaw and, where permissible, binding bylaw amendments creating a company-specific right to submit proposals independent of Rule 14a-8. Those proposals could address ownership and holding thresholds, notice and procedural requirements, permissible subject matter, supporting statements, resubmission standards and bases for exclusion. Some companies have already received proposals on this topic for the upcoming proxy season, including proposals from a prominent conservative proponent, one of which is scheduled for a vote in October.

That makes timing particularly important. If Rule 14a-8 is rescinded and a company has no contractual or bylaw-based proposal right, shareholders may no longer have a comparable low-cost mechanism to force a proposal onto the company’s proxy card. Moreover, if the proposed Rule 14a-4 amendments are adopted, companies would have broader discretion to vote proxies on shareholder proposals submitted outside of the Rule 14a-8 process, subject to disclosure and an affirmative shareholder opt-out election. Proponents may therefore place greater emphasis on securing company-specific proposal rights while Rule 14a-8 remains available.

Private ordering: Proxy access redux?

Proxy access provides a useful precedent for company-by-company governance change. In 2010, the SEC adopted Rule 14a-11, which would have created a mandatory federal proxy access regime for shareholder director nominees. The US Court of Appeals for the District of Columbia Circuit vacated that rule in 2011. But amendments to Rule 14a-8 permitting shareholders to submit company-specific proxy access proposals survived, and those proposals became a defining governance campaign of the 2015 proxy season and ultimately drove widespread adoption of proxy access bylaws through private ordering.

The dynamic here would differ in one important respect. Proxy access private ordering was enabled by Rule 14a-8 after the mandatory federal rule disappeared. Here, Rule 14a-8 itself is the federal mechanism that may disappear. That makes the coming proxy season potentially more consequential: Proponents may seek to use Rule 14a-8 one last time to create the company-specific proposal rights that will replace it. If those proposals gain broad institutional support, market-standard terms could develop quickly, just as they did with proxy access.

Companies receiving these proposals would face strategic choices beyond a simple include-or-exclude decision. Depending on the proposal and shareholder base, a company could oppose the proposal, negotiate more tailored terms or adopt its own framework. Boards should be prepared for proposal access rights to become a mainstream governance topic rather than a niche procedural issue.

Could alternative shareholder proposal rights attract investor support?

That possibility warrants attention. Overall support for shareholder proposals, particularly E&S proposals, has declined from prior peaks, and institutional investors and proxy advisory firms have become more selective. Governance proposals involving traditional shareholder rights have proved more resilient. Proposals addressing special meeting rights, written consent, board declassification and supermajority voting requirements continue to attract comparatively strong support, and several categories achieved majority support during the 2026 season.

Tesla’s November 2025 annual meeting provides a potentially relevant data point on investor sentiment. Shareholders considered a proposal requesting that the board seek shareholder approval before adopting any bylaw amendment, as permitted under Texas law, that would impose ownership thresholds or solicitation requirements for shareholder proposals above those specified in Rule 14a-8. The proposal received approximately 49% support overall and, assuming all insiders voted against it, approximately 67% support from non-insider shareholders. Although the proposal would not itself have created a new shareholder proposal right, the result suggests that a proposal framed around preserving shareholder access to the Rule 14a-8 process could attract significant – and potentially majority – support.

There is no established market model for a Rule 14a-8 replacement bylaw today, and investor and proxy advisor views would likely depend heavily on the terms. The combination of durable support for traditional shareholder rights proposals and a perceived “now or never” dynamic means companies should treat these proposals as a real voting risk, not a theoretical one.

A key variable will be how major institutional investors and proxy advisory firms respond. If influential investors or proxy advisors adopt policies favoring shareholder proposal access bylaws, or otherwise press companies to adopt them, private ordering could accelerate quickly. If they do not, proponents may need to build support company by company.

State law could become the next battleground

Rescission would immediately raise a state law question that Rule 14a-8 has largely allowed companies and proponents to avoid: What right does a shareholder have to require that a matter be presented for a shareholder vote? Rule 14a-8 is a federal proxy rule governing when a company must include a qualifying proposal in its own proxy materials. It does not resolve all questions regarding the underlying state law right to present a proposal at a meeting. That question received relatively little attention while a broadly available federal mechanism existed, but it could become central if that mechanism disappears.

Texas has already moved in this direction. Its corporate law permits certain public companies to impose materially higher ownership and solicitation requirements for submitting shareholder proposals than those under Rule 14a-8. Those provisions were directly implicated in the Tesla proposal discussed above and provide an early example of how state law can shape shareholder proposal access.

Other states could respond by creating their own shareholder proposal regimes. Those regimes need not mirror the federal rule: States could provide a proposal right while setting ownership, holding period, solicitation or other eligibility thresholds materially different from Rule 14a-8. That could make state of incorporation and governing documents even more important to shareholder proposal access, and differences between states could become another factor in reincorporation decisions.

Delaware presents a different and still unsettled question. Delaware courts have not squarely resolved whether shareholders have an inherent right to bring precatory proposals for a vote. Recent commentary has argued that no such right exists absent a right created by statute, the certificate of incorporation, bylaws or board action; other scholars have reached the opposite conclusion. If Rule 14a-8 is rescinded, pressure may build for Delaware to address that uncertainty legislatively. One possible approach would be to codify that shareholders have no inherent right to submit precatory proposals unless the corporation affirmatively provides one, leaving the issue principally to private ordering.

Rule 14a-8 may disappear – shareholder pressure won’t

Rescission of Rule 14a-8 would eliminate a widely used tool of shareholder activists, but companies should not expect the underlying pressure to disappear. Proponents and other activists are likely to redirect their efforts toward director “vote no” campaigns, proxy contests, opposition to say-on-pay and other management proposals, litigation, direct engagement and targeted publicity campaigns. Companies also could face pressure to adopt shareholder proposal rights voluntarily.

Publicity and board-focused campaigns may become especially important. Rule 14a-8 gives proponents a relatively low-cost way to place an issue in a company’s proxy statement, attract public attention and engage the board. If that channel disappears, proponents may try to recreate the same pressure through targeted media campaigns, dedicated websites, open letters and other public pressure tactics, as well as campaigns aimed directly at directors. Some of these tactics are already emerging: During the 2026 season, proponents litigated exclusions, threatened or pursued Rule 14a-4 zero slate campaigns, and used director elections and public campaigns as alternative pressure points.

Rescission of Rule 14a-8 therefore may change the channel for shareholder activism more than the level of activism itself. For now, companies should continue preparing for the 2027 proxy season under the existing Rule 14a-8 framework while considering whether their advance notice bylaws, shareholder engagement approach, state of incorporation and broader activism preparedness remain appropriate if the federal shareholder proposal framework ultimately disappears.

Ninth Circuit Comet Ruling Spotlights Trade Secret Proof Burdens

Wed, 16 Sep 2026 19:30:00 Z

Cooley partners Amanda Main, Bobby Ghajar, Mark Lambert, Heidi Keefe and Erin Trenda co-authored an article for Law360 examining the Ninth Circuit’s decision to reverse a $40 million trade secret verdict in Comet Technologies USA Inc. v. XP Power LLC based on an erroneous jury instruction. The article discusses the differing burdens of proof under the federal Defend Trade Secrets Act and California’s Uniform Trade Secrets Act, as well as key considerations for litigants involving jury instructions, damages models and remedies in trade secret cases.

Read the article

Bulk-Power System Order: What Utilities and Industry Players Need to Know

Wed, 16 Sep 2026 18:23:00 Z

On August 26, 2026, President Donald Trump signed Executive Order 14421 (EO), declaring a national emergency arising from foreign exploitation of vulnerabilities in the bulk-power system and imposing new restrictions on transactions involving that system. While framed in country-neutral terms, the EO’s operative definitions, historical precedent and underlying threat assessment make clear that Chinese companies and China-linked supply chains likely are its principal targets. Companies that source equipment, components, software, firmware or maintenance services from Chinese manufacturers – or from joint ventures, subsidiaries or contract manufacturers with Chinese ownership or jurisdictional ties – face the most immediate exposure and should be evaluating their risk now.

China is expressly listed among countries subject to a policy of denial under International Traffic in Arms Regulations (ITAR) section 126.1 – the specific provision the EO incorporates to define “Covered Foreign Entities.” The Department of Energy’s (DOE) only prior implementing action under the predecessor 2020 order exclusively targeted Chinese-linked equipment. As discussed in detail below, final regulations implementing the EO must be published by the DOE in December; however, now is the time for companies with any Chinese nexus in their bulk-power supply chains to conduct supply chain audits, review financing contracts and assess their exposure. Companies should also consider participating in the rulemaking process to shape key definitions and provisions.

The EO prohibits “any acquisition, importation, transfer, or installation of any foreign-produced bulk-power system electric equipment (transaction) by any person, or with respect to any property, subject to the jurisdiction of the United States,” where:

A foreign country or national has any interest in the transaction (including through a supply contract).
The transaction was initiated after August 26, 2026.
The secretary of energy determines that:
1. The equipment (or associated components, software, firmware, digital services, maintenance services or remote-access capabilities) was designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of a “Covered Foreign Entity.”
2. The transaction poses an undue risk of sabotage, subversion, unauthorized access, supply disruption or catastrophic effects on US critical infrastructure or the economy, or otherwise poses an unacceptable risk to US national security or the safety of US persons.

Scope of covered infrastructure

The “bulk-power system” encompasses facilities and control systems necessary to operate an interconnected electric energy transmission network, plus generation facilities needed for reliability, including transmission lines rated at 69 kV or higher. Local distribution facilities are expressly excluded.

Scope of covered equipment

“Bulk-power system electric equipment” is defined by a detailed illustrative list: reactors, capacitors, substation transformers, utility-scale and grid-connected inverters, battery energy storage systems, uninterruptible power supply (UPS) systems supporting critical infrastructure, generators, generation turbines, high-voltage circuit breakers, protective relaying, metering equipment and industrial control systems – including remote terminal units (RTUs), programmable logic controllers (PLCs) and intelligent electronic devices (IEDs). Agencies may also consider associated software, firmware, remote-access capabilities, life cycle maintenance and supply chain dependencies. Equipment with broader application unrelated to the identified national security concerns is excluded.

‘Foreign produced’

An article is “foreign produced” if it is not manufactured, produced or assembled in the United States. The EO provides no customs-style rules for substantial transformation, country of origin or de minimis foreign content. A product assembled domestically from foreign components may have a textual argument that the final article is not “foreign produced,” but this is not a categorical safe harbor. DOE may examine critical components, firmware, remote access and supply chain dependencies, and the EO separately prohibits transactions structured to evade its requirements.

Existing equipment

The secretary of energy may impose conditions on the continued use, operation, maintenance, servicing or updating of qualifying foreign equipment already installed before August 26, 2026, including requiring its identification, isolation, monitoring, disconnection, replacement or removal. Before ordering the more disruptive remedies, the secretary must consider reliability and safety effects, replacement availability and continuity of essential service, and may phase compliance. This does not create an immediate fleetwide “rip-and-replace” mandate, but installed assets may become subject to technical conditions, increased monitoring, restricted maintenance arrangements or accelerated replacement requirements – creating potentially material exposure for asset owners, lenders and project buyers.

Impacted industries

The EO’s practical reach will depend on DOE’s implementing rules, but its express terms create direct exposure for utilities and transmission owners/operators (particularly those procuring or operating equipment rated 69 kV or above from higher-risk jurisdictions); energy infrastructure developers across all generation technologies; grid technology, storage and inverter suppliers (the most significant expansion relative to 2020); data center developers and operators to the extent their equipment ties into the bulk-power system; equipment manufacturers and supply chain vendors facing expanded country-of-origin and ownership disclosure demands; investors, lenders and M&A participants who should add the EO to regulatory and R&W insurance diligence; and federal contractors who may be affected by forthcoming Federal Acquisition Regulation (FAR) revisions prioritizing US-manufactured energy infrastructure.

Mitigation, pre-qualification and anti-evasion

The secretary may negotiate mitigation measures as a precondition to approving an otherwise prohibited transaction and may publish a pre-qualified equipment and vendor list exempt from the prohibition, while retaining authority to later regulate even pre-qualified equipment or suppliers. Any transaction that evades, avoids or attempts to violate the order – and any conspiracy to do so – is separately prohibited. Companies should document sourcing determinations and business rationales and avoid restructurings designed to obscure country, ownership or service provider connections.

Implementation timeline

Within 120 days (by December 24, 2026), the secretary of energy – in consultation with the Office of Management and Budget, the secretaries of war and homeland security, and the national intelligence director – must publish implementing rules, including criteria for identifying Covered Foreign Entities and licensing procedures for otherwise prohibited transactions. Within 180 days (by February 22, 2027), the secretary must submit recommended FAR revisions to integrate national security screening into federal energy infrastructure procurement and prioritize US-manufactured equipment; the FAR Council then has 90 days to consider proposing those revisions for notice and comment.

As a first step toward implementation, on September 9, 2026, DOE published a request for information (RFI) seeking stakeholder input on key implementation questions, including the scope of covered equipment and transactions, risks associated with Covered Foreign Entities, supply chain and remote-access practices, mitigation of existing equipment, licensing and pre-qualification procedures, domestic manufacturing capacity, federal procurement, and potential economic, reliability, safety and small-entity impacts. Written responses are due by October 9, 2026.

Broader scope than prior bulk-power regulation

The EO is not the first attempt to regulate foreign equipment in the bulk-power system. On May 1, 2020, the first Trump administration declared a similar national emergency and authorized DOE to prohibit transactions involving equipment connected to “foreign adversaries.” DOE implemented that order in December 2020 with a Prohibition Order targeting limited transmission-level equipment from China at critical defense facilities. However, full implementation of this effort was suspended in January 2021 with the change in administration. Several features distinguish the 2026 EO from its predecessor.

First, existing, already-installed equipment is now in scope. The 2020 order applied only to transactions initiated on or after specified effective dates; neither it nor the Prohibition Order reached previously installed equipment. The 2026 order expressly authorizes the secretary to require isolation, disconnection, replacement or removal of qualifying equipment installed before the order, subject to reliability and phased-compliance safeguards – materially expanding reach into the existing installed base.

Second, the covered entity standard has broadened. The 2020 order turned on “foreign adversary.” The 2026 order uses “Covered Foreign Entity,” defined to include countries or persons connected to a government subject to a US arms embargo or sanctions regime under ITAR, or that the secretary determines is engaged in conduct detrimental to US national security or foreign policy. This is broader in structure – embracing sanctions- and embargo-linked jurisdictions generally – and gives the secretary considerable discretion to designate additional countries or entities case by case.

Third, equipment coverage now expressly reaches grid modernization technology. The 2026 order’s illustrative list calls out utility-scale and grid-connected inverters, battery energy storage systems, UPS systems supporting critical infrastructure, and associated software, firmware, digital services and remote-access capabilities – categories not covered by the 2020 order or its narrower Prohibition Order (which centered on transformers, circuit breakers and reactive power equipment at 69 kV and above).

The order also follows the Federal Communications Commission’s (FCC) recent addition of foreign-produced power inverters to its Covered List. The FCC and DOE frameworks use different legal authorities and triggers; companies procuring or supplying inverters should conduct a parallel analysis rather than assuming compliance under one regime resolves the other.

Ambiguities and open interpretive questions

Several aspects of the EO are unresolved and will depend on DOE’s implementing rules, due by December 24, 2026. We flag these because they bear directly on near-term considerations:

When is a transaction “initiated”? The EO does not define this term, nor does it explain whether acquisition, importation, transfer and installation are separate transactions for timing purposes. It is unclear how the term applies to purchase orders placed but not yet performed before August 26, 2026, deliveries or payments under pre-existing master supply agreements, or change orders and amendments. This is especially important for equipment with multistage procurement: A contract may have been signed before August 26 while manufacturing, importation and installation occur afterward. Because the EO applies “notwithstanding any contract entered into or any license or permit granted prior to the date of this order,” pre-existing contractual protections may not shield a transaction that DOE treats as “initiated” after the effective date. Companies should not assume a pre-August 26 contract places all subsequent performance steps outside the EO’s reach.
Which countries and entities will be designated Covered Foreign Entities? The definition combines an objective prong (countries subject to a US arms embargo or ITAR-referenced sanctions regime) with a discretionary prong (persons the secretary determines are engaged in conduct detrimental to US national security or foreign policy). Until DOE publishes designations, affected companies cannot be certain which suppliers, countries or ownership structures are covered – even though the underlying prohibition is already in effect.
How will DOE apply the “owned by, controlled by, or subject to the jurisdiction or direction of” standard? This test is not further defined – no percentage ownership threshold, no guidance on indirect or minority ownership, joint ventures or contractual control. Several additional undefined concepts will determine practical reach: “critical component,” “critical infrastructure” for covered UPS systems, “foreign manufactured or operated” for existing equipment, and the degree of foreign component, software or service content sufficient to establish a Covered Foreign Entity nexus. These questions are particularly significant for minority investments, joint ventures, third-country subsidiaries, contract manufacturers, dual-sourced products, and equipment assembled domestically but reliant on foreign firmware or ongoing foreign technical support.
What does the pre-qualified vendor list process look like? The EO allows, but does not require, the secretary to publish a pre-qualified list and expressly reserves authority to later regulate even pre-qualified equipment. It is unclear whether or when DOE will publish such a list, what certification process vendors would follow, and how much reliance companies can place on it given that reserved authority.

China-specific implications

The order does not name China in its operative text; “Covered Foreign Entity” is defined generically by reference to US arms embargo or sanctions status or through a case-by-case determination. However, China is expressly listed among countries subject to a policy of denial under ITAR section 126.1, the specific provision incorporated into the definition. On its face, this may reach beyond Chinese state-owned enterprises or companies on US sanctions and export-control lists, creating potential exposure for privately owned companies organized in China and certain subsidiaries, joint ventures, and suppliers whose relationship to China is jurisdictional rather than equity-based. Several additional features point to particular relevance for China-linked entities and supply chains.

Direct historical precedent targeting China

DOE’s only prior implementing action under the 2020 order targeted equipment manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of China, based on DOE’s assessment that the Chinese government was “equipped and actively planning to undermine the electric power system in the United States.” Companies should expect DOE to draw on this factual record when implementing the 2026 order, making Chinese-linked equipment and suppliers a likely early focus of forthcoming designations.

China-linked AI and grid-technology intersections

The order’s threat rationale explicitly ties bulk-power system security to “advanced manufacturing, data centers, artificial intelligence, and defense production.” Given the administration’s broader scrutiny of Chinese involvement in AI infrastructure, DOE may initially focus on grid technologies with Chinese-origin software, cloud or remote-access components. Potential targets include grid-connected inverters, battery management software and remote-monitoring or predictive-maintenance platforms, particularly when integrated with AI-driven grid optimization or data center energy management.

Potential transaction restrictions

Because the prohibition reaches any transaction where a foreign country or national has any interest – including through a contractual interest in equipment supply – transactions with Chinese equipment manufacturers, joint venture partners or component suppliers initiated after August 26, 2026, are at risk of being deemed void or subject to unwinding if DOE later designates the relevant entity or country as a Covered Foreign Entity, notwithstanding any prior contract, license or permit. Companies with pending or planned procurement from Chinese-linked suppliers should treat this as an active transaction risk during the pre-implementation period.

Practical guidance and action steps

Inventory pipeline transactions and the existing installed base

Identify all pending, planned or recently initiated (on or after August 26, 2026) acquisitions, imports, transfers or installations of qualifying bulk-power system equipment, mapping each supplier’s country of manufacture, ultimate ownership, and the origin of associated software, firmware, maintenance services and remote-access capabilities. In parallel, compile an inventory of currently installed equipment by manufacturer, country of origin and ownership/control chain so the company can quickly assess exposure if DOE designates a Covered Foreign Entity.

Build supply chain disclosure into contracts and do not assume pre-existing contracts provide protection

Update procurement templates and requests for proposals (RFPs) to require supplier certifications on country of manufacture, beneficial ownership, and origin of embedded software, firmware, remote access and maintenance services. New and amended contracts should address notification obligations, audit rights, product substitution and domestic sourcing rights, cooperation with DOE inquiries, and allocation of removal, replacement and delay costs. Because the EO applies “notwithstanding any contract entered into or any license or permit granted prior to the date of this order,” companies should not treat existing master supply agreements, purchase orders or long-term contracts as insulating a transaction from the prohibition.

Monitor DOE’s implementing rulemaking and vendor list developments

DOE’s rules are due by December 24, 2026, and will define Covered Foreign Entities, identify equipment warranting scrutiny and establish licensing procedures. Companies with material exposure should build a process to reassess procurement and vendor decisions promptly after publication. If DOE publishes a pre-qualified vendor list, treat qualification as an increasingly important procurement input – while recognizing that DOE retains authority to regulate even listed equipment or vendors.

Coordinate diligence across overlapping regimes

This order operates alongside the Committee on Foreign Investment in the United States (CFIUS), Federal Energy Regulatory Commission/North American Electric Reliability Corporation (FERC/NERC) supply chain standards, the FCC’s Covered List for foreign-produced power inverters, and other China-specific restrictions (such as foreign entity of concern rules for certain tax credits). Compliance under one regime does not resolve the others; companies should coordinate workstreams rather than treating them as independent silos.

Develop technical mitigations and incorporate the EO into deal diligence

For higher-risk equipment, evaluate whether remote access can be eliminated, firmware independently validated, networks segmented and maintenance localized. Transaction teams should assess potential DOE restrictions as part of regulatory, sanctions and supply chain diligence; purchase agreements and financing documents may need specific disclosure schedules, covenants, closing conditions, indemnities, and reserves for remediation or replacement.

Engage counsel before initiating higher-risk transactions

Given uncertainty around when a transaction is “initiated” and which entities will be designated Covered Foreign Entities, companies contemplating significant procurement of foreign-manufactured bulk-power system equipment – particularly equipment with any China nexus – should seek legal input before signing or performing the transaction.

DOJ Announces ‘Historic’ $250 Million Penalty for HSR Filing Violations

Fri, 04 Sep 2026 20:39:00 Z

On August 26, 2026, the US Department of Justice (DOJ) announced a proposed settlement with private equity firm KKR & Co. to resolve a complaint alleging repeated and “systemic” Hart-Scott-Rodino (HSR) Act violations. Under the settlement, KKR will pay a “historic” civil penalty of $250 million – “more than 20 times any prior HSR penalty,” as noted by Associate Attorney General Stanley Woodward.

The DOJ’s January 2025 complaint alleged that KKR violated the HSR Act in at least 16 separate transactions during 2021 and 2022. According to the DOJ, KKR altered documents in HSR filings for eight transactions, omitted required documents for 10 transactions and failed to make the required HSR filing in two transactions. In a statement, KKR disagreed with the DOJ’s position, noting that it believed it had “acted in good faith … consistent with industry practice” in its HSR filings but wanted to resolve the matter without further litigation. Notably, KKR also added that outside law firms would fully reimburse KKR for the civil penalties.

This settlement comes weeks after the Federal Trade Commission (FTC) announced $12 million in penalties against Edwards Lifesciences Corp. and Genesis MedTech Group Limited for HSR Act violations. At the time, that penalty was the largest ever for failure to make an HSR filing. The FTC alleged that the parties structured the transaction with the aim of avoiding an HSR filing requirement by splitting the consideration between a purchase price for the target below the HSR threshold coupled with a separate investment into the seller. The combined value would have triggered an HSR filing.

Why this matters

HSR Act violations can result in significant penalties. The maximum civil penalty for an HSR Act violation is currently $53,088 per day per violation, and the DOJ initially sought more than $650 million in penalties in the KKR complaint. With the recent settlements, the DOJ and the FTC are signaling that both agencies take HSR evasion and incomplete filings seriously. Given the time that may pass between agency enforcement and the required time of filing, penalties can accrue rapidly. It is essential to conduct a thorough reportability analysis at the outset of a transaction.

Ensure compliance with HSR document collection. Sweep broadly and comprehensively in the collection process for documents that should be included with the HSR filing. The DOJ’s complaint discussing alleged omitted documents underscores the importance of identifying all key custodians and ensuring that their materials are collected and reviewed.

Adhere to document creation and hygiene guidelines. In the KKR complaint, the DOJ alleged that KKR made alterations to responsive business documents in some transactions to minimize the competitive impact of the proposed deal. Altering documents is of course an immediate red flag, but not creating “hot” documents in the first instance is the best approach. Involving antitrust counsel to review drafts before broad circulation to officers or directors reduces the risk of unnecessarily inflammatory language in responsive materials.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Fri, 04 Sep 2026 13:32:00 Z

Despite uncertainty heading into the 2026 proxy season (January 1 – June 30 meetings), final voting results largely continued established patterns. Governance proposals attracted the strongest support, while environmental and social (E&S) proposals and proposals from anti-environmental, social and governance (ESG) proponents received considerably less support. Director elections and say-on-pay proposals continued to receive strong shareholder support, and ISS recommendations were associated with sharp differences in voting outcomes across shareholder and management proposals.

Building on our early review of the 2026 shareholder proposal season, this alert reviews final 2026 shareholder proposal voting results across the Russell 3000, with separate analyses of tech companies, life sciences companies and, for the first time, “recently public companies,” defined as Russell 3000 companies that went public since 2016. This additional lens complements Cooley’s inaugural Post-IPO Governance Trends Report, which examines how governance practices and annual meeting voting outcomes evolve during companies’ early years as public companies. We also highlight key trends in director elections and say-on-pay votes across each of these groups, and we review voting results for select nonroutine management proposals across the Russell 3000.

Shareholder proposals

Although the US Securities and Exchange Commission (SEC) staff’s withdrawal from its traditional role in the Rule 14a-8 no-action process created substantial uncertainty, 2026 voting results largely followed recent patterns. Governance proposals remained the best-supported category, averaging 34% support, compared with 16% for environmental proposals, 15% for social proposals and 5% for proposals from anti-ESG proponents. The results reinforce a familiar divide: proposals addressing core governance and shareholder rights matters continue to attract materially more investor support than E&S proposals. Looking ahead, the forthcoming SEC proposal to rescind Rule 14a-8 and the SEC staff’s recent decision to end no-action responses entirely could produce more significant change in 2027, including more aggressive efforts by proponents to challenge exclusions or other actions to preserve access to companies’ proxy materials.

2026 shareholder proposals at tech companies

ISS recommendations and shareholder support

ISS recommendations were closely associated with voting outcomes across every proposal category. Across all Russell 3000 companies, proposals backed by ISS averaged 33% support for environmental matters, 34% for social matters, 41% for governance matters and 24% for proposals from anti-ESG proponents, compared with 14%, 10%,17% and 3%, respectively, when ISS opposed them. Although these results reflect correlation rather than causation, they underscore the continuing importance of proxy advisor recommendations to voting outcomes.

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

Tech companies continued to be the primary target of anti-ESG proponents, accounting for 28% of their proposal submissions in 2026. Most of these proposals focused on social topics, with diversity, equity and inclusion (DEI), viewpoint and ideological discrimination, AI and data privacy representing the most common topics. Consistent with the broader market, shareholder support for social-focused proposals submitted by anti-ESG proponents at tech companies remained low in 2026, averaging 2%.

2026 shareholder proposals at tech companies

Life sciences companies

While shareholder proposal activity remained relatively limited at life sciences companies, voting outcomes were generally consistent with broader market trends. Governance proposals averaged 32% support, compared with 14% for social proposals and 1% for proposals from anti-ESG proponents, and no environmental proposal went to a vote. Proposal activity also remained concentrated among large-cap life sciences companies, with recipients having a median market capitalization of $30 billion.

2026 shareholder proposals at life sciences companies

Recently public company trends

Among Russell 3000 companies that went public since 2016, shareholder proposal activity was relatively limited and skewed toward larger companies. We identified 34 publicized proposals – representing less than 6% of total publicized submissions – and the median market capitalization of recently public companies receiving proposals was $14.8 billion. Of the 26 recipient companies, 16 had market capitalizations above $10 billion, and none went public after 2021. Where proposals did reach recently public companies, governance issues dominated. Each of the four proposals receiving majority support addressed a foundational governance matter: two sought board declassification, one sought majority voting for director elections and one sought majority voting for director removal. These results are consistent with a broader post-IPO pattern: As companies mature and their ownership bases broaden, IPO-era governance structures attract increasing shareholder scrutiny.

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election results remained strong in 2026. Average support was 95.4% across Russell 3000 companies, compared with 94.3% at tech companies, 92.4% at life sciences companies and 92.9% at recently public companies. Similarly, 87.2% of all Russell 3000 director nominees received more than 90% support, compared to 83.6%, 71.8% and 75.3% of director nominees at tech, life sciences and newly public companies, respectively.

Director election vote results by support level

ISS opposition continued to correlate meaningfully with voting outcomes across all companies, although its incidence varied significantly by group. ISS recommended against 11.6% of all Russell 3000 director nominees, compared with 15% at tech companies, 26.1% at life sciences companies and 36.2% at recently public companies. Despite receiving the highest opposition rate, director nominees at recently public companies averaged nearly 93% support. As discussed in our Post-IPO Governance Trends Report, proxy advisors frequently oppose directors at newly public companies because of governance provisions commonly adopted at the time of IPO, but these recommendations generally have a more limited impact on voting outcomes, likely reflecting concentrated ownership and greater investor tolerance for these governance structures during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to evolve their governance practices.

Variance in director election support levels by ISS recommendation

Say-on-pay

Say-on-pay results also remained strong, with average support of 92% across the Russell 3000, 89.7% at tech companies, 90.8% at life sciences companies and 92% at recently public companies. Each group saw year-over-year increases in average support and in the percentage of proposals receiving more than 90% support.

Say-on-pay vote results by support level

ISS recommendations were again closely associated with say-on-pay voting results. Across the Russell 3000, ISS-supported proposals averaged 94.4% support, compared with 73.5% for ISS-opposed proposals. The gap was widest among tech companies at 22 percentage points, though this gap was down from 26 points in 2025. Recently public companies had a higher rate of ISS opposition than the broader Russell 3000, but adverse recommendations had a smaller effect on their voting outcomes. As with director elections, this likely reflects concentrated ownership and greater investor patience during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to mature their compensation practices.

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

The lower passage rates appear to reflect stringent charter or bylaw amendment thresholds rather than declining shareholder support. Many such amendments require approval by a supermajority of outstanding shares, and in each of 2025 and 2026, only one proposal to eliminate a supermajority vote requirement failed to receive support from a majority of outstanding shares.

DExit reincorporation proposals

Notably, nearly 70% of the 26 companies that have sought shareholder approval to reincorporate from Delaware to Nevada or Texas since 2024 had a controlling shareholder or a significant insider voting bloc. This trend is consistent with the role that controlling shareholder concerns have played in driving the broader DExit movement.

Although 88% of DExit proposals have passed, this high success rate appears to reflect concentrated insider ownership at many of the companies pursuing these reincorporations rather than broad investor support. Assuming insiders voted all of their shares in favor, estimated noninsider support averaged 43% across all DExit proposals, including 30% at controlled companies and 55% at noncontrolled companies. This disparity suggests that institutional investors are generally more skeptical of DExit proposals at controlled companies.

Support from the Big Three – BlackRock, Vanguard and State Street – for DExit proposals has also been limited. While all three firms supported Tesla’s 2024 move to Texas, among Nevada reincorporation proposals in 2024 and 2025, BlackRock, Vanguard and State Street supported only 25%, 17% and 0%, respectively. Voting data for institutional investors on 2026 reincorporation proposals will become available in September 2026.

Officer exculpation proposals

Among Delaware-incorporated Russell 3000 companies, officer exculpation proposals continued to decline in prevalence following the initial wave of proposals after Delaware authorized officer exculpation in 2022. Proposal volume fell from 115 in 2025 to 53 in 2026, average support declined from 72% to 66% and the passage rate decreased from 93% to 87%. The decline occurred despite a modest increase in ISS support, as the percentage of proposals receiving favorable ISS recommendations rose from 84% in 2025 to 87% in 2026. Nevertheless, officer exculpation proposals continued to pass at a high rate.

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focuses exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Fri, 04 Sep 2026 13:32:00 Z

Shareholder proposals

2026 shareholder proposals at tech companies

ISS recommendations and shareholder support

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

Governance proposals at tech companies substantially outperformed other proposal categories, averaging 37% support compared with 13% for both environmental and social proposals. Proposal activity also remained concentrated among large-cap tech companies, with recipients having a median market capitalization of $61 billion. Tech companies continued to be the primary target of anti-ESG proponents, accounting for 28% of their proposal submissions in 2026. Most of these proposals focused on social topics, with diversity, equity and inclusion (DEI), viewpoint and ideological discrimination, AI and data privacy representing the most common topics. Consistent with the broader market, shareholder support for social-focused proposals submitted by anti-ESG proponents at tech companies remained low in 2026, averaging 2%.

2026 shareholder proposals at tech companies

Life sciences companies

2026 shareholder proposals at life sciences companies

Recently public company trends

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election vote results by support level

ISS opposition continued to correlate meaningfully with voting outcomes across all companies, although its incidence varied significantly by group. ISS recommended against 11.6% of all Russell 3000 director nominees, compared with 15% at tech companies, 26.1% at life sciences companies and 36.2% at recently public companies. Despite receiving the highest opposition rate, director nominees at recently public companies averaged nearly 93% support. As , proxy advisors frequently oppose directors at newly public companies because of governance provisions commonly adopted at the time of IPO, but these recommendations generally have a more limited impact on voting outcomes, likely reflecting concentrated ownership and greater investor tolerance for these governance structures during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to evolve their governance practices.

Variance in director election support levels by ISS recommendation

Say-on-pay vote results by support level

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

Management proposals seeking to unwind long-standing governance provisions declined in 2026. Board declassification proposals declined from 44 in 2025 to 31 in 2026, while proposals to eliminate supermajority vote requirements fell from 70 to 47. The decline likely reflects market maturation rather than diminished focus on these core governance issues, as many larger-cap, consumer-facing companies that historically faced the greatest investor pressure to eliminate these structures have already done so. Shareholder support remained relatively steady, averaging 79% for declassification proposals and 77% for supermajority-elimination proposals, compared with 80% for both proposal types in 2025. However, passage rates notably declined, from 75% to 68% for declassification proposals and from 70% to 57% for supermajority-elimination proposals. The lower passage rates appear to reflect stringent charter or bylaw amendment thresholds rather than declining shareholder support. Many such amendments require approval by a supermajority of outstanding shares, and in each of 2025 and 2026, only one proposal to eliminate a supermajority vote requirement failed to receive support from a majority of outstanding shares.

DExit reincorporation proposals

Nevada and Texas remained the primary destinations for companies seeking to leave Delaware, with Texas emerging as the top destination in 2026. Nevada attracted four Delaware exit (DExit) proposals in 2024 and eight in 2025, but only three in 2026, while Texas increased from one proposal in 2024 and none in 2025 to 10 in 2026. Notably, nearly 70% of the 26 companies that have sought shareholder approval to reincorporate from Delaware to Nevada or Texas since 2024 had a controlling shareholder or a significant insider voting bloc. This trend is consistent with the role that controlling shareholder concerns have played in driving the broader DExit movement. Although 88% of DExit proposals have passed, this high success rate appears to reflect concentrated insider ownership at many of the companies pursuing these reincorporations rather than broad investor support. Assuming insiders voted all of their shares in favor, estimated noninsider support averaged 43% across all DExit proposals, including 30% at controlled companies and 55% at noncontrolled companies. This disparity suggests that institutional investors are generally more skeptical of DExit proposals at controlled companies. Support from the Big Three – BlackRock, Vanguard and State Street – for DExit proposals has also been limited. While all three firms supported Tesla’s 2024 move to Texas, among Nevada reincorporation proposals in 2024 and 2025, BlackRock, Vanguard and State Street supported only 25%, 17% and 0%, respectively. Voting data for institutional investors on 2026 reincorporation proposals will become available in September 2026.

Officer exculpation proposals

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focuses exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Fri, 04 Sep 2026 07:00:00 Z

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Shareholder proposals

2026 shareholder proposals at Russell 3000 companies

ISS recommendations and shareholder support

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

2026 shareholder proposals at tech companies

Life sciences companies

2026 shareholder proposals at life sciences companies

Recently public company trends

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election vote results by support level

ISS opposition continued to correlate meaningfully with voting outcomes across all companies, although its incidence varied significantly by group. ISS recommended against 11.6% of all Russell 3000 director nominees, compared with 15% at tech companies, 26.1% at life sciences companies and 36.2% at recently public companies. Despite receiving the highest opposition rate, director nominees at recently public companies averaged nearly 93% support. As discussed in our Post-IPO Governance Trends Report[CS1.1][C1.2], proxy advisors frequently oppose directors at newly public companies because of governance provisions commonly adopted at the time of IPO, but these recommendations generally have a more limited impact on voting outcomes, likely reflecting concentrated ownership and greater investor tolerance for these governance structures during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to evolve their governance practices.

Variance in director election support levels by ISS recommendation

Say-on-pay

Say-on-pay vote results by support level

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

DExit reincorporation proposals

Officer exculpation proposals

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focuses exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

White House Steps Up Trade Fraud Enforcement With AI

Thu, 03 Sep 2026 19:32:50 Z

The White House recently announced that “the age of untraceable illegal transshipment is over.” In an August 13 report titled, “The Great Transshipment Scam,” the White House Office of Trade and Manufacturing Policy issued what it called a “warning to the world” – “stop evading and avoiding the Trump tariffs through illegal transshipment. Those who continue will be caught.”

Illegal transshipment, which is the practice of routing goods from higher-tariff countries through lower-tariff jurisdictions to evade US tariffs, reportedly costs America tens of billions of dollars annually. To counter illegal transshipment, US Customs and Border Protection (CBP) is developing an AI-enabled “detective border” that will analyze shipment data, routing histories, product classifications and other information to purportedly “reveal[] inconsistencies that no human could catch at scale.”

On the same day the White House report was released, the US Department of Justice (DOJ) issued a memorandum identifying trade fraud as a top enforcement priority, underscoring the risk of criminal prosecution for companies and individuals engaged in tariff evasion or other fraud schemes.

The government’s focus on illegal transshipment can affect any company engaged in foreign commerce, but those connected to China supply chains should pay particular attention. Now is a good time to evaluate import practices, strengthen compliance programs and prepare for this new era of data-driven enforcement.

CBP’s new AI ‘detective border’

The White House report estimates that transshipment “is draining the US treasury” of $10 billion to $100+ billion in lost tariff revenue each year.

According to the report, since the first Trump administration imposed Section 301 tariffs on China in 2018, goods that previously moved directly from China to the US are increasingly being routed through third-country jurisdictions – including Vietnam, Malaysia, Thailand, Mexico and Cambodia – to take advantage of lower tariff rates. The report makes clear that the government is aware of these routing patterns and views them as a principal driver of tariff revenue losses. Other higher-tariff countries are allegedly beginning to adopt similar practices, but China-origin transshipment remains the enforcement priority.

One step being taken to counter transshipment is the development of an AI-enabled “detective border.” The AI detective border is described as an “AI-driven net that never sleeps, never tires, and never forgets.” The AI architecture will fuse “anomaly detection, link analysis, capacity validation, and mirrored-flow verification into a single predictive platform.” The platform will continuously analyze data to attempt to identify “anomalous routing patterns, suspicious bills of lading, false-origin claims, value mismatches, and capacity inconsistencies.” Additionally, AI will play a role in identifying potential mismatches between a product’s “digital identity” and its “physical reality” by analyzing “container markings, packaging patterns, and X-ray imaging.” CBP will leverage these findings to bring enforcement actions.

DOJ memo outlines enforcement priorities for fraud

Also on August 13, the National Fraud Enforcement Division (NFED) issued a memorandum setting forth its enforcement priorities. As we discussed previously, the NFED is a new division within the DOJ for investigating and prosecuting fraud against federal government programs.

The memo states that the NFED will utilize sophisticated data analytics tools and other new technology to build a “data-driven white-collar law enforcement” group. The NFED is expected to have 500 attorneys and other staff by late August and will “continue to rapidly grow for the next two years.”

The memo identifies five enforcement priorities:

Global trade and commerce, which will target “illicit transshipment schemes, country-of-origin fraud, the undervaluation of imported goods designed to evade duties, sanctions evasion, and foreign forced labor schemes.”
Public trust and financial integrity, including government procurement fraud (such as bid rigging, self-dealing and billing fraud), as well as benefit and grant programs (such as student loans and small business programs).
Healthcare, such as Medicare or Medicaid fraud, controlled substance diversion, home health and hospice schemes, and deceptive marketing of unsafe products and services.
Internal revenue, which will focus on criminal tax enforcement.
Corporate misconduct, which will focus on “fraud and other economic crimes.”

Echoing the White House report, the memo emphasizes that trade fraud and customs evasion “undermine American industry” and “deprive the public fisc of vital external revenue.”

Implications

With the administration viewing trade fraud as a significant threat to American industry and the broader US economy, companies with global supply chains should expect heightened scrutiny of their import practices. That scrutiny will be increasingly data-driven and take advantage of new technology. The consequences of noncompliance may extend beyond civil penalties to criminal prosecution. Companies should consider reviewing and strengthening their compliance programs to identify and address potential issues or weaknesses in their supply chain.

Companies that receive notice that they are the subject of a trade fraud investigation – whether through a CBP Request for Information, a subpoena or Civil Investigative Demand from the DOJ, or a formal notice of detention or seizure – should act quickly and deliberately to evaluate the allegations and potential defenses. Companies with China-connected supply chains should be particularly alert, as enforcement agencies are actively scrutinizing import patterns involving Chinese-origin goods routed through third countries.

As an initial matter, companies should retain experienced counsel before responding to any government inquiry or making statements to investigators. Companies should also take immediate steps to preserve all potentially relevant documents and data, including shipping records, customs filings, supplier agreements and internal communications relating to import practices. In parallel, companies should consider initiating an internal investigation to assess the scope of the issue, determine whether voluntary self-disclosure is appropriate and develop a strategy for engaging with the government. Throughout this process, companies should be mindful that trade fraud investigations often involve multiple agencies – including CBP, DOJ and the Department of Commerce – and that early coordination across enforcement tracks is critical.

How we can help

Cooley’s global tariffs task force is a team of high-stakes litigators, former prosecutors, including the former chief of the public corruption unit of the US Attorney’s office, and investigation counsel. We have extensive experience in cross-border investigations, particularly those involving Asia and China, and our team includes Mandarin-speaking lawyers who can communicate directly with clients and counterparties in their native language. Companies that receive an inquiry or notice that indicates they may be the subject of a government investigation can reach a member of our team by emailing zCooleyTariffsTeam@cooley.com.

USPTO Appeals Review Panel Reinstates Double Patenting Rejections, Limits Allergan in Examination

Wed, 02 Sep 2026 17:11:25 Z

Executive summary

In Ex parte Baurin (Appeal 2024-002920), the US Patent and Trademark Office (USPTO) Appeals Review Panel (ARP) reversed the Patent Trial and Appeal Board (PTAB) and reinstated six obviousness-type double patenting (OTDP) rejections against US Application No. 17/135,529.¹ The decision adopts a narrow reading of Allergan USA, Inc. v. MSN Laboratories Private Ltd. and confirms that a later-filed, later-expiring patent can still support an OTDP rejection, even where issuance of the challenged claims would not extend patent exclusivity.²

The decision turns on OTDP’s second rationale: preventing harassment through enforcement by separate owners of patentably indistinct patents. Relying on Fallaux, Hubbell and Cellect, the ARP held that this anti-harassment rationale independently supports an OTDP rejection, even when there is no improper extension of patent term.³

Still, the ARP was not entirely comfortable with that outcome. It said that absent binding precedent, it would not treat hypothetical future harassment as a stand-alone basis for rejection, and it sketched a more streamlined, term-focused framework it might adopt in the future. That framework is not the law yet. Until the Federal Circuit says otherwise, examiners will keep applying pre-Allergan practice, except in the narrow circumstances where the ARP found Allergan applies.

Background

The ’529 application is directed to antibody-like binding proteins, was filed December 28, 2020, and has a patent-term filing date of March 28, 2012, giving it an ordinary expiration of March 2032.⁴

The examiner rejected claims 1 – 18 for OTDP over six reference patents/applications, each combined with US 2009/0162359 A1 (the ’359 publication). The principal reference, US Patent No. 10,882,922 (the ’922 patent), was filed April 13, 2017, issued January 5, 2021, and expires April 13, 2037, after a 70-day patent term adjustment (PTA) award. The ’529 application and the ’922 patent are commonly owned by Sanofi and share several inventors; it was undisputed that the pending claims would have been obvious over the ’922 patent in view of the ’359 publication.

The anti-harassment rationale

OTDP rests on two justifications. The first, and historically dominant, one prevents a patentee from obtaining a second, later-expiring patent on a patentably indistinct invention that would unjustifiably extend exclusivity. The second, the anti-harassment rationale, guards against patentably indistinct rights ending up with separate owners, each able to assert the same technology against an infringer or licensee. A licensee that cleared rights under one patent could face a separate claim from another owner of related, indistinct claims. The common-ownership provision required in a terminal disclaimer exists to prevent that outcome, even where the patents’ terms are already aligned.

The PTAB reversed the OTDP rejections in November 2024 and denied rehearing in a 2 – 1 decision (with dissent) in December 2025. On March 5, 2026, the director sua sponte convened the ARP, inviting briefing from the applicant and 11 amici on the scope of Allergan, projected expiration dates and whether separate ownership risk independently supports an OTDP rejection. On August 6, 2026, the ARP reversed the PTAB and reinstated all six rejections.

The decision

Allergan applies only in narrow circumstances

The ARP rejected the PTAB’s broader application of Allergan. In Allergan, the Federal Circuit held that a first-filed, first-issued, later-expiring claim could not be invalidated for OTDP based on a later-filed, later-issued, earlier-expiring reference claim sharing a common priority date.

On the ARP’s reading, Allergan applies where the challenged and reference claims are in the same family and share the same patent-term filing date, and the challenged claims are first-filed, first-issued and later-expiring within that family.

The ’529 application met none of these: It lacks the first actual filing date in its family, remains pending (so is not first-issued) and does not share a patent-term filing date with the ’922 patent, which is from a different family. A pending continuation will rarely qualify as first-issued during ordinary prosecution, so the ARP instructed examiners to continue pre-Allergan practice outside this narrow fact pattern.

Anti-harassment can independently support an OTDP rejection

The PTAB treated the absence of a term extension concern as dispositive. The ARP disagreed, concluding that its reading of Federal Circuit precedent recognizes two independent OTDP rationales: preventing unjustified timewise extension and preventing multiple suits by different owners of patentably indistinct rights.

The ARP viewed Fallaux and Hubbell as controlling because the Federal Circuit affirmed OTDP rejections even where the challenged claims would have expired before the references and relied on Cellect’s recognition of divided ownership risk. It rejected the PTAB’s view that this reasoning was dicta, since that would leave those affirmances with no articulated basis at all.

The practical result: Claims in a later-filed, later-expiring patent can support an OTDP rejection of earlier-expiring foundational claims even though issuance of the foundational claims would not extend exclusivity, so long as the challenged claims are not patentably distinct from the reference claims.

The ARP questions the rule it applies

Although the ARP reinstated the rejections, it was candid about its discomfort with the rule it applied. Absent controlling precedent, the panel said it would not treat hypothetical future harassment as a stand-alone basis for rejection: Without evidence that an applicant actually split ownership and exposed the public to separate suits, the USPTO is simply speculating. The ARP also credited the amici’s concern that a broad anti-harassment rule creates a backward-looking problem, since a later improvement could threaten earlier foundational claims. That concern is particularly acute in collaborative research, licensing-driven portfolios and situations involving inventor mobility. The tension is sharpest because a terminal disclaimer requires continued common ownership: It is easiest to obtain where the harassment risk is most hypothetical, and unavailable precisely where separate ownership already exists.

A proposed new framework, but not yet the law

If the Federal Circuit determines anti-harassment cannot stand alone, the ARP outlined a term-focused alternative. For references outside the application’s family, examiners would ask only whether the reference has a later patent-term filing date than the application. If so, the term extension inquiry ends there. If earlier, the examiner would compare the claims for patentable distinctness. Examiners would rely on known facts, such as an existing terminal disclaimer or already awarded PTA, rather than speculate about future events.

Within a single family, the analysis would instead turn on actual filing (and issue) dates: A later-filed application could be rejected over an earlier-filed parent, but not the reverse. This is consistent with Allergan’s principle that the first-filed, first-issued patent sets the family’s maximum period of exclusivity. The ARP also floated narrowing any surviving anti-harassment rationale by requiring actual evidence of prior ownership-splitting, or a two-way obviousness showing, before it alone could support a rejection. None of this is presently in effect; the ARP expressly conditioned it on further Federal Circuit guidance.

Key takeaways

1. Allergan protection remains narrow and family specific.

The Allergan exception protects only a first-filed, first-issued, later-expiring claim against a later-filed, later-issued, earlier-expiring reference sharing the same patent-term filing date within the same family. That is not the fact pattern most applicants will see during original prosecution; it is more likely to come up in reexamination, reissue or a later validity dispute.

2. Anti-harassment remains a live, independent ground for rejection.

Applicants should expect examiners to keep making OTDP rejections based on later-filed, later-expiring patents, including cross-family references, wherever the claims are not patentably distinct and a common ownership or inventorship link exists. Under the ARP’s current guidance to the USPTO, an earlier expiration date will not by itself defeat that kind of rejection.

3. Terminal disclaimers deserve more strategic attention than they typically get.

A terminal disclaimer is not just a formality. It imposes a common ownership requirement that can affect licensing, assignments, acquisitions and enforcement, and it may cut short a patent term that would otherwise result from PTA. Where common ownership cannot be achieved or maintained, for example in university-industry collaborations, joint development arrangements or after an inventor leaves, a disclaimer will not cure an OTDP rejection. Prosecution strategy, inventorship and ownership provisions need to be coordinated up front in those situations.

Alignment with Federal Circuit precedent

The ARP treated its result as compelled by Fallaux, Hubbell and Cellect, while acknowledging the Federal Circuit’s more recent focus on patent term in Gilead, Cellect and Allergan. Baurin is precedential within the USPTO and binds office personnel, but it does not bind the Federal Circuit or district courts. That leaves an open question the ARP expressly asked the Federal Circuit to resolve – whether the anti-harassment rationale is, by itself, still enough to reject an earlier-expiring claim under the current patent-term regime?⁵

Recent developments in this space

That question is now squarely before the Federal Circuit in In re Ablynx N.V., Appeal No. 26-1333, arising from Ex parte Baumeister. A decision there could address the continuing force of Fallaux and Hubbell, the scope of Allergan and the ARP’s proposed framework. A further appeal from Baurin itself could offer a second vehicle for review.⁶

Notes

Ex parte Baurin, Appeal 2024-002920, Application No. 17/135,529 (USPTO Appeals Review Panel, Aug. 6, 2026) (precedential).
Allergan USA, Inc. v. MSN Laboratories Private Ltd., 111 F.4th 1358, 1369-70 (Fed. Cir. 2024).
See In re Fallaux, 564 F.3d 1313, 1318-19 (Fed. Cir. 2009); In re Hubbell, 709 F.3d 1140, 1145-48 (Fed. Cir. 2013); In re Cellect, LLC, 81 F.4th 1216, 1229-30 (Fed. Cir. 2023).
See Cooley, PTAB Rehearing Limits Double Patenting Rejections of Earlier Patent Applications From Later-Filed Family Members, Jan. 26, 2026.
See Gilead Sciences, Inc. v. Natco Pharma Ltd., 753 F.3d 1208, 1214-17 (Fed. Cir. 2014); In re Cellect, LLC, 81 F.4th at 1226-30; Allergan, 111 F.4th at 1367-70.
In re Ablynx N.V., Appeal No. 26-1333 (Fed. Cir.) (appeal from Ex parte Baumeister, Appeal 2026-000193).

OSC Releases ‘Call for Interest’ in Space Commerce Certification Pilot Program

Wed, 02 Sep 2026 07:00:00 Z

On August 20, 2026, the Department of Commerce Office of Space Commerce (OSC) announced a call for interest for companies interested in participating in a pilot phase of the newly established Space Commerce Certification (SCC) framework. Submissions are due October 5, 2026, and should be submitted to Space.Certification@noaa.gov.

Space Commerce Certification framework

Under the proposed framework, companies would apply for per-mission certification and commit to adhering to the OSC-imposed “light-touch” requirements, such as orbital debris mitigation and payload review. OSC would conduct basic due diligence while simultaneously circulating the application to relevant portions of the interagency to identify any concerns relating to national security, foreign policy or international obligations, and safety of operations. Agencies involved in the process would include OSC’s Commercial Remote Sensing Regulatory Affairs department, Federal Communications Commission, Federal Aviation Administration, National Aeronautics and Space Administration and Department of War. If no concerns are identified, certification would be granted within 120 days of submission.

The SCC framework is a process designed to facilitate approval of mission authorizations for activities not explicitly governed by existing regulatory frameworks and provide additional certainty for such operators. Novel space activities include, but are not limited to, in-space manufacturing, orbital datacenters, satellite servicing, lunar operations and commercial inhabitable stations.

Participation in SCC pilot phase

OSC is inviting expressions of interest in participating in a pilot phase intended to test and further develop the new framework. Participants will have the opportunity to provide the agencies with feedback on the process. OSC will be highly selective during this pilot phase and will prioritize missions that are critical to industry advancement, are sufficiently likely to occur and represent high-utility use cases.

Interested companies must include in their submission to OSC:

The nominated entity’s full name, any affiliations and contact information.
Evidence of US entity ownership/operation.
A clear description of the intended operations, the space objects involved and the targeted launch/deployment timeline.
A statement confirming the submitter’s commitment to working with OSC, in a manner as transparent to the public as possible, to develop best practices.

If you are interested in learning more about the SCC pilot phase or framework, please reach out to one of the Cooley lawyers listed below.

New Federal Program Deputizes Private Companies to ‘Hack Back’

Tue, 01 Sep 2026 21:33:03 Z

On August 12, 2026, President Donald Trump signed a memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime” (memorandum). Historically, private companies have faced the imperative to defend themselves against cybercriminals while being legally barred from fighting back or “hacking back” – also known as active defense or active cyber response (ACR). The concept of ACR stems from a situation where participants in the program respond on behalf of victims of hacking by launching various offensive counterattacks against the hacker, with the intent of mitigating the effects of the attack. Business, scholars and politicians alike have debated this historical prohibition on “hacking back,” arguing over the limits on the tools available to the private sector to defend itself when it holds the vast majority of the world’s online infrastructure.

The memorandum directs the federal government to authorize vetted private companies to conduct offensive cyber operations, including surveillance and disruptive effects operations under federal oversight, against suspected foreign criminal hacking groups. For cybersecurity firms, threat intelligence providers and defense contractors, this memorandum potentially opens up new lines of activity and opportunity, but not without potential risk and exposure.

What the memorandum enables

The memorandum directs the National Coordination Center (NCC) to create and manage a program that would authorize certain preapproved “Participating Companies” to conduct cyber surveillance operations and cyber effects operations, under federal control and oversight, against foreign cyber-enabled transnational criminal organizations.

A cyber surveillance operation means accessing another organization’s computer systems or networks, without authorization from the owner or operator or by exceeding authorized access, primarily to passively collect information or intelligence, including information that could support a future cyber effects operation, with the intent to remain undetected.
A cyber effects operation means an operation that actually manipulates, disrupts, denies, degrades or destroys another organization’s information systems, networks or data, going beyond mere observation.

The program will be overseen jointly by the Department of Justice (DOJ) and the Department of Homeland Security (DHS), which must coordinate with each other to approve any operation, and every resulting action must be conducted on behalf of, and under the supervision of, these agencies.

The opportunity: a new kind of government relationship

For companies that provide offensive or clandestine cyber capabilities, this program provides a potential opportunity to become a partner to the US government. Participating companies would enter into contractual agreements with DOJ or DHS.

The memorandum also directs the government to build out the terms of this relationship over the coming months. By October 11, 2026, the program’s executive directors must establish operating procedures, including minimum standards for participation covering technical proficiency, proven performance, facility security, personnel vetting, competence and reliability. In establishing these procedures and standards, the executive directions must ensure eligibility criteria that allows for participation by both large companies, which would provide capacity and volume, and smaller or more specialized companies, which would potentially be better suited to more discrete tasks.

The guardrails: federal oversight

The memorandum builds in several layers of federal oversight, including requiring:

Individual approval of each operation by the program’s executive directors.
Participating Companies halt operations that stray outside of the approved scope and notify the NCC.
Participating Companies to maintain a bond or escrow of at least $1 million, to be forfeited if the company falls out of compliance with its contractual agreement.
Annual evaluation of Participating Companies for continued participation in the program.

The risk: residual liability

The harder question for any company considering this program is what happens when something goes wrong, and the memorandum signals that the government is also conscious of potential risks.

Authorized operations can have unexpected results

If a Participating Company discovers that an authorized operation has exceeded its approved parameters, such as by unintentionally targeting a US person, a US-based information system or a system controlled by a US person, it must immediately stop the operation, take steps to minimize the impact and notify the NCC, which then notifies the DOJ. Companies must also immediately report any imminent attack on US critical infrastructure they discover, or any reasonable belief that an approved operation may result in loss of life or serious injury, or rise to the level of use of force or armed attack under international law. The fact that the memorandum specifically anticipates and requires reporting on scenarios this serious is a signal of just how much can go sideways, even with rigorous vetting and federal sign-off.

Anti-hacking laws at home and abroad

The Computer Fraud and Abuse Act (CFAA) is an avenue for exposure, as it bars cyber activity undertaken without authorization or that exceeds authorized access – the very activity this memorandum enables. Anyone who suffers damage or loss from a violation of the CFAA may sue the violator for damages and equitable relief.

It is unclear whether this private right of action would survive against a defendant acting as a Participating Company under the program. The memorandum references compliance with the CFAA, alluding to an exemption for “any lawfully authorized investigative, protective or intelligence activity of a law enforcement agency of the United States [and certain other government entities].”¹ But it’s unclear the extent to which the exemption can apply to the actions of private entities undertaken on behalf of the government. This uncertainty means that a Participating Company could find itself exposed to a civil suit from whoever was harmed, having to litigate the exemption’s scope.

Foreign law adds another layer that the memorandum does not seek to address or resolve. These operations are meant to target servers, networks and infrastructure located outside the United States, and most countries have their own computer crime statutes that make unauthorized access to a computer system a domestic offense wherever it originates. A US government contract does not extend to a foreign hacking law and does not confer immunity from prosecution or civil suit in that country. A Participating Company conducting an approved operation against infrastructure or targets sitting in a foreign jurisdiction could still face criminal or civil exposure under that jurisdiction’s own laws.

No new swords or shields

Federal oversight also does not mean federal immunity for a company that steps outside the lines. The memorandum expressly caveats that it does not create any right or benefit, procedural or substantive, that any party can enforce against the United States or its officers and employees. That language lays out the government’s position that a Participating Company cannot point to this memorandum as a federal government indemnity for claims brought against the company, and a private party harmed by an operation gone wrong has no new claim against the government created by this memorandum.

Who else should be paying attention

This is not only a story for companies that might apply to the program. Cloud and hosting providers, internet service providers and critical infrastructure operators have reason to watch closely too, because these operations could touch their infrastructure without warning. A hosting provider or network operator whose infrastructure sits between a Participating Company and its intended target may lack visibility into an authorized operation running through its systems until something breaks.

The program also contemplates Participating Companies entering into commercial agreements with other private sector entities to receive threat intelligence in support of their cyber operations. Managed security service providers and incident response firms should also take note, even if they never seek Participating Company status themselves. However, such entities also run the risk of identifying operations by Participating Companies when responding to incidents at foreign entities, which may present conflicts of interest between their incident response and threat intelligence services.

Before entering into any threat intelligence sharing arrangement with a Participating Company, a company should understand exactly how its data and its name could end up feeding into a federally authorized cyber operation, and what obligations or exposure that creates for the company supplying the intelligence, not just the company acting on it.

Looking ahead

The program’s operating procedures are not due until October, so the details of eligibility, vetting and contract terms are still being written. But companies in the defense industrial base, cybersecurity, and cyber operations, threat intelligence and managed security spaces should start thinking now about:

Whether becoming a Participating Company, or a commercial data partner to one, fits the company’s risk tolerance and business strategy.
What contractual protections, insurance and indemnification the company would need before agreeing to conduct operations under this kind of federal authorization.
Developing a legal strategy and assessing potential exposure under the CFAA and other anti-hacking laws (including outside of the US).
Preparedness for inadvertent or intentional retaliation or escalation from targets of cyber operations conducted under the program.
Whether the company’s infrastructure or client base could be swept into someone else’s authorized operation, even without any direct involvement in the program.

This memorandum marks a shift in how the government defines the private sector’s role in the fight against cybercrime. Companies in this space have an opportunity to contribute to the disruption of cyber-enabled transnational criminal organizations, but the legal exposure runs alongside the opportunity, not behind it. If you have questions about whether your company should participate in this program, how to structure a commercial data-sharing arrangement tied to it or how to manage the liability that comes with operating in this space, please contact the Cooley cyber/data/privacy practice.

Notes

18 USC § 1030(f).

FTC, Requiring Divestitures, Approves Final Consent Decree in Ascension/AmSurg Deal

Tue, 01 Sep 2026 21:11:00 Z

On August 25, 2026, the Federal Trade Commission (FTC) announced it had finalized a consent order resolving antitrust concerns arising from Ascension Health Alliance’s $3.9 billion acquisition of AmSurg. This order arrives against the backdrop of heightened FTC attention to the healthcare sector. In March 2026, FTC Chairman Andrew Ferguson directed the agency to form a Healthcare Task Force to pursue a “coordinated, integrated approach” to healthcare enforcement and advocacy in coordination with other agencies and law enforcement partners (such as the Department of Health and Human Services and Department of Justice). The final order in the Ascension/AmSurg matter reflects this continued focus and offers a useful window into how the FTC is applying it in practice.

The final order requires Ascension to divest seven AmSurg ambulatory surgery centers (ASCs) across five metro areas, settling allegations that the deal would substantially lessen competition for certain outpatient surgical services. The order also imposes a 10-year prior notice obligation on Ascension for future ASC acquisitions in the affected markets, as well as transition assistance, nonsolicitation, asset maintenance and monitor provisions typical of recent FTC healthcare merger remedies. True to FTC form, the matter demonstrates the agency’s continued scrutiny of vertical and horizontal healthcare consolidation at the local, service level – even where the overall transaction value and combined entity size might not otherwise trigger significant antitrust concern nationally.

Background

On June 2, 2026, the FTC announced a proposed consent order requiring Ascension, a national nonprofit health system, to divest several ASCs in order to proceed with its proposed acquisition of AmSurg. The FTC’s June 1 complaint alleged that the combination of Ascension and AmSurg, both providers of outpatient surgical services ranging from cataract surgeries to colonoscopies, would limit competition for certain outpatient surgical services performed by gastroenterologists, ophthalmologists and orthopedists in the Nashville, Tennessee, Panama City, Florida, Tulsa, Oklahoma, Waco, Texas, and Wichita, Kansas, metropolitan areas. The FTC alleged that this loss of competition would likely lead to higher surgery prices for patients while also threatening to lower the quality of care and limit innovation in surgical services. Daniel Guarnera, director of the FTC’s Bureau of Competition, stated that, “[a]ccess to quality surgical care at an affordable price is critically important for millions of Americans across the country,” and that the divestitures would “help preserve a competitive market that will allow patients to get the care they need at a fair price.”

Under the terms of the proposed order, Ascension agreed to divest seven AmSurg ASCs located in the markets where the FTC identified competitive concerns. Six of the centers were to be divested to SC Affiliates, while the seventh, located in Panama City, was to be divested to Florida Gastroenterology Center (referred to in the order as the Panama City Doctors), a physician group that already held a minority stake in that facility and would assume full ownership. The proposed order also required Ascension, Ambulatory Topco and AmSurg to provide up to one year of transition assistance, protect confidential information, maintain the viability of the divested assets pending transfer and refrain from interfering with employment relationships at the affected facilities. The FTC further required the appointment of a monitor to oversee compliance and imposed a 10-year prior notice obligation on Ascension for any future ASC acquisitions in the relevant metro areas.

The FTC’s investigation was conducted in coordination with the state attorneys general of Florida, Oklahoma and Tennessee, and the vote to issue the complaint and accept the consent agreement for public comment was 2 – 0. The proposed order was then placed on the public record for a 30-day comment period.

Why this matters

Local market power, not deal size, still drives FTC scrutiny. The FTC’s focus here was narrow. It did not object to the transaction as a whole, but to the loss of competition in five specific metro areas for three specific types of outpatient surgery. This demonstrates that deal size alone does not determine whether the FTC intervenes: A modest, local overlap in a single service may be enough to trigger a complaint and require a remedy. Companies acquiring ambulatory surgery centers, physician practices or other outpatient providers should expect the FTC to continue to analyze competition market by market and service by service, not just at the level of the overall transaction.
A 10-year leash: Prior notice extends well beyond Hart-Scott-Rodino (HSR) obligations. The order also puts Ascension under long-term FTC oversight – for the next 10 years, Ascension must notify the FTC at least 30 days before acquiring any interest in an outpatient surgery center in the five affected metro areas. This notice obligation applies even to deals that are too small to require a standard HSR filing. This means that the FTC can review Ascension’s future, smaller deals in these markets that might otherwise escape antitrust review entirely. Companies with a history of FTC healthcare enforcement should expect similar long-term reporting or notice conditions in future settlements.
The FTC is backing its words with action. The Ascension/AmSurg divestitures demonstrate yet another example of the FTC following through on its enforcement priorities, not just announcing them. Just days before finalizing this order, the FTC won a full trial in federal court blocking Henkel’s proposed acquisition of Liquid Nails, a construction adhesives merger, and secured a permanent injunction rather than settling for a preliminary one. That case was the first merger challenge litigated entirely in federal court under Ferguson’s stated preference for bringing merger cases only in federal court and bypassing the FTC’s in-house Part 3 administrative process. Similarly, the Ascension/AmSurg order highlights the agency’s announced commitment to working with other law enforcement partners to pursue coordinated enforcement efforts in the healthcare sector. Taken together, the Ascension/AmSurg order and the Henkel litigation win show that the agency is pursuing its stated priorities in practice, and that the FTC is prepared to both negotiate strong structural remedies and litigate mergers to a final result in federal court when a negotiated fix is not available.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Tue, 01 Sep 2026 20:10:00 Z

Shareholder proposals

2026 shareholder proposals at Russell 3000 companies

ISS recommendations and shareholder support

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

2026 shareholder proposals at tech companies

Life sciences companies

2026 shareholder proposals at life sciences companies

Recently public company trends

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election vote results by support level

ISS opposition continued to correlate meaningfully with voting outcomes across all companies, although its incidence varied significantly by group. ISS recommended against 11.6% of all Russell 3000 director nominees, compared with 15% at tech companies, 26.1% at life sciences companies and 36.2% at recently public companies. Despite receiving the highest opposition rate, director nominees at recently public companies averaged nearly 93% support. As , proxy advisors frequently oppose directors at newly public companies because of governance provisions commonly adopted at the time of IPO, but these recommendations generally have a more limited impact on voting outcomes, likely reflecting concentrated ownership and greater investor tolerance for these governance structures during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to evolve their governance practices.

Variance in director election support levels by ISS recommendation

Say-on-pay

Say-on-pay vote results by support level

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

DExit reincorporation proposals

Officer exculpation proposals

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focuses exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

CFTC’s Innovation Advisory Committee Holds Inaugural Meeting

Tue, 01 Sep 2026 07:00:00 Z

The Innovation Advisory Committee of the Commodity Futures Trading Commission (CFTC) held its inaugural meeting on August 20. The meeting brought together industry representatives from crypto, traditional financial markets and technology to discuss crypto assets, AI and prediction markets.

Roadmap for the new frontier of finance

In his opening remarks, CFTC Chairman Michael Selig previewed a “roadmap for the new frontier of finance,” stating that if the pending CLARITY Act, legislation that would establish a federal regulatory framework for digital assets, does not advance, he would direct CFTC staff to move swiftly to propose crypto market structure rules under the CFTC’s existing authority. Specifically, Selig directed CFTC staff to explore rules that could enable current registrants, as well as unregistered crypto exchanges, to be designated by the CFTC as a type of designated contract market (DCM) known as a “crypto asset market” and offer crypto asset trading on a leveraged or margined basis under the CFTC’s regulatory oversight.

Selig also directed staff to engage with developers of on-chain finance protocols to establish pathways for developers to offer their protocols in a legal and compliant manner in the United States. Selig’s remarks came a day after President Donald Trump noted in a White House press conference attended by crypto industry leaders that the CFTC was working to bring Hyperliquid, the most prominent perpetual swap exchange, into the United States.

On prediction markets, Selig outlined a three-part roadmap, which is reflected in a series of recently or soon-to-be proposed rules and amendments:

First, proposed amendments to CFTC Rule 40.11 to define key terms, such as “gaming,” and enumerate public interest criteria for evaluating certain event contracts, seeking to provide clarity on issues that have been hotly debated in connection with sports and election event contracts.
Second, a proposed rule to modernize the reporting framework for fully collateralized event contracts.
Third, anticipated amendments to Parts 38 and 40 of the CFTC’s regulations to modernize the core principles and listing rules governing DCMs that list event contracts, and to institute consumer protection requirements, including clearer expectations for product governance, market design and incentive programs.

Selig also reiterated the CFTC’s position that federally regulated event contracts fall within its exclusive jurisdiction and stated that the CFTC would continue defending that jurisdiction against efforts by states to apply state gaming laws to DCMs.¹

As part of the roadmap’s AI agenda, Selig highlighted a request for comment on compute markets issued earlier that week, describing plans to develop a regulatory framework supporting transparent markets for compute capacity as a commodity with reliable price discovery and effective hedging.

Industry feedback and recommendations

Throughout the meeting, Committee Chair Walt Lukken, president and CEO of the Futures Industry Association, posed questions to participants seeking feedback for the CFTC’s policy and rulemaking priorities. The discussion reflected both frustration with prior regulatory uncertainty and regulation by enforcement and appreciation for the CFTC’s shift toward engagement and regulatory action.²

1. Harmonization and speed to market

Industry participants were candid about their experiences under the prior administration. Several described facing investigations, Wells notices, litigation, de-banking, and overlapping federal and state requirements without clear rules governing their products. Participants said these conditions caused companies to move personnel and products overseas, incur significant legal costs, or discouraged entrepreneurs from building crypto businesses in the United States.

Against this backdrop, participants welcomed collaboration between the CFTC and Securities and Exchange Commission (SEC)³ and called for greater harmonization to reduce the costs and friction associated with overlapping regulatory regimes. Certain cross-agency products were cited as needing coordinated guidance, including equity perpetual contracts, KPI event contracts referencing company earnings and Bitcoin index options. Participants also noted that emerging structures, such as vaults, may require a collaborative approach given their mixed securities, commodities and derivatives characteristics.

One participant called for clarity on whether futures commission merchants may self-custody customer segregated funds in tokenized form, while another highlighted the value unlocked by the joint SEC-CFTC conditional exemptive orders issued in April 2026 permitting customer cross-margining across treasury cash positions and futures positions. More broadly, several participants noted their support for the CLARITY Act, but urged the CFTC to continue using its existing authority rather than wait indefinitely for market structure legislation. Speed was a recurring concern, with participants arguing that regulatory uncertainty and state-by-state requirements have placed US firms at a competitive disadvantage to offshore firms, and urging faster regulatory decision-making within a principles-based framework capable of keeping pace with changing technology.

2. Balancing innovation and market integrity in prediction markets

Prediction markets generated the sharpest debate of the meeting. Several participants urged the CFTC to defend its federal jurisdiction, preserve the ability of DCMs to self-certify contracts, and maintain a unified federal framework rather than subject federally regulated platforms to differing state regimes. Supporters argued that prediction markets can provide price discovery, risk-management tools and useful information while offering consumer protection that may not exist on offshore or state-regulated venues.

Much of the discussion focused on where the CFTC should draw the line on permissible event contracts. The CFTC’s proposed amendments to Rule 40.11 would define terms such as “gaming” and establish criteria for determining when contracts involving enumerated activities may be prohibited as contrary to the public interest. Participants differed over how restrictive those standards should be. Some argued that these sensitive markets may provide valuable information to the public, while others emphasized that contracts whose outcomes can be materially influenced by a single person or small group raise significant market integrity concerns.

One participant proposed a presumption in favor of listing novel contracts unless an identifiable public harm exists, coupled with consideration of whether the contract bears a direct causal relationship to that harm and the degree to which the outcome is susceptible to manipulation. The discussion exposed a broader divide between traditional exchange operators and novel prediction market platforms over whether the existing self-certification framework provides adequate safeguards against manipulation, particularly for sports, “mention” and other event contracts whose outcomes may be influenced by individual actors. Prediction market operators emphasized the importance of rapid self-certification for markets tied to current events, while other participants urged closer scrutiny of contracts that may present heightened manipulation risks.

The discussion also extended to retail safeguards and competitive parity. Participants raised concerns regarding potential regulatory arbitrage between direct-to-DCM and Futures Commission Merchant-intermediated retail access, including differences in know your customer (KYC) and customer identification requirements, and several supported applying comparable protections regardless of the access model.

Participants also raised concerns about US users accessing offshore platforms through VPNs and discussed the need for clearer and more consistent expectations regarding surveillance, product governance, responsible trading and other consumer protections. The debate underscored the CFTC’s challenge in facilitating innovation while maintaining consistent market integrity and customer protection standards across rapidly evolving prediction market business models.

3. AI: Focus on conduct, not technology

In respect of AI’s growing role in algorithmic trading and market operations, participants urged the CFTC to regulate conduct rather than specific models or tools. One participant cited the prior Regulation Automated Trading proposal, and the controversy surrounding proposed access to source code, as a cautionary example, recommending that the CFTC focus on attribution and accountability so that a responsible person or entity remains identifiable regardless of whether an order originates from an AI model, traditional algorithm or other automated system.

Cybersecurity and operational resilience of market infrastructure were a related focus. Participants described AI as both a threat vector and a defensive tool (useful for automated code review, formal verification of on-chain smart contracts, vulnerability detection and market surveillance) and suggested that advances in formal verification could over time support more stringent software reliability expectations. Others cautioned against restricting access to frontier AI models, arguing that broad access helps security researchers find vulnerabilities before attackers do, and that restrictions offer limited benefit where comparable models remain available offshore.

What’s next?

The meeting reflected a shift in the CFTC’s approach toward facilitating innovation through rulemakings and engagement with industry. Market participants should watch three developments in particular:

Potential crypto-market-structure rulemaking under the CFTC’s existing authority if the CLARITY Act stalls.
The pending Rule 40.11 proposal and forthcoming Parts 38 and 40 amendments governing prediction markets, including retail protections, product governance and market-design standards.
Continued CFTC-SEC coordination on products that implicate both securities and derivatives regulation.

The CFTC’s parallel work on compute markets also bears watching, as it considers how its existing commodity and derivatives framework may apply to an emerging market for compute capacity.

Notes

On April 2, 2026, the CFTC, together with the Department of Justice, filed lawsuits against Arizona, Connecticut and Illinois challenging state efforts to apply state law to CFTC-registered designated contract markets. On April 24, the CFTC sued New York to halt the state’s application of state gambling laws to CFTC-regulated markets, and it subsequently brought similar actions against Wisconsin, Minnesota, New Mexico and Kentucky. The CFTC also moved to intervene in litigation in Rhode Island and has filed amicus briefs in prediction-market litigation involving Nevada, Massachusetts and Ohio.
For example, on May 29, 2026, the CFTC issued a policy statement addressing the listing of perpetual contracts. On June 10, 2026, it proposed amendments to its rules governing event contracts involving enumerated activities; on June 18, 2026, the CFTC and SEC jointly requested comment on opportunities to clarify and harmonize derivatives product definitions and related jurisdictional issues; on June 22, 2026, the CFTC requested comment on 24/7 trading and perpetual contracts referencing certain energy commodities; and, on August 19, 2026, the CFTC requested comment on the listing of derivatives contracts referencing computing capacity.
This collaborative posture may in part reflect Selig’s prior service as a senior advisor to SEC Chairman Paul Atkins.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Mon, 31 Aug 2026 15:25:00 Z

Despite uncertainty heading into the 2026 proxy season (January 1 – June 30 meetings), final voting results largely continued established patterns. Governance proposals attracted the strongest support, while environmental and social (E&S) proposals and proposals from anti-environmental, social and governance (ESG) proponents received considerably less support. Director elections and say-on-pay proposals continued to receive strong shareholder support, and ISS recommendations were again associated with sharp differences in voting outcomes across shareholder and management proposals.

This alert precedes the SEC’s expected September proposal to rescind Rule 14a-8. This proposal is currently under review by the White House, and Cooley’s June alert includes a discussion of how such a proposal may impact the 2027 proxy season.

Shareholder proposals

Although the SEC staff’s withdrawal from its traditional role in the Rule 14a-8 no-action process created substantial uncertainty, 2026 voting results largely followed recent patterns. Governance proposals remained the best-supported category, averaging 34% support, compared with 16% for environmental proposals, 15% for social proposals and 5% for proposals from anti-ESG proponents. The results reinforce a familiar divide: proposals addressing core governance and shareholder rights matters continue to attract materially more investor support than E&S proposals. Looking ahead, the forthcoming SEC proposal to rescind Rule 14a-8 and the SEC staff’s recent decision to end no-action responses entirely could produce more significant change in 2027, including more aggressive efforts by proponents to challenge exclusions or other actions to preserve access to companies’ proxy materials.

2026 shareholder proposals at Russell 3000 companies

ISS recommendations and shareholder support

ISS recommendations were closely associated with voting outcomes across every proposal category. Across all Russell 3000 companies, proposals backed by ISS averaged 33% support for environmental matters, 34% for social matters, 41% for governance matters and 24% for proposals from anti-ESG proponents, compared with 14%, 10%, 17% and 3%, respectively, when ISS opposed them. Although these results reflect correlation rather than causation, they underscore the continuing importance of proxy advisor recommendations to voting outcomes.

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

2026 shareholder proposals at tech companies

Life sciences companies

2026 shareholder proposals at life sciences companies

Recently public company trends

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election vote results by support level

Variance in director election support levels by ISS recommendation

Say-on-pay

Say-on-pay vote results by support level

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

Shareholder support remained relatively steady, averaging 79% for declassification proposals and 77% for supermajority-elimination proposals, compared with 80% for both proposal types in 2025. However, passage rates notably declined, from 75% to 68% for declassification proposals and from 70% to 57% for supermajority-elimination proposals. The lower passage rates appear to reflect stringent charter or bylaw amendment thresholds rather than declining shareholder support. Many such amendments require approval by a supermajority of outstanding shares, and in each of 2025 and 2026, only one proposal to eliminate a supermajority vote requirement failed to receive support from a majority of outstanding shares.

DExit reincorporation proposals

Officer exculpation proposals

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focus exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

Senators Press FINRA on ACATS Fraud: What Broker-Dealers Should Do Now

Mon, 24 Aug 2026 07:00:00 Z

On August 20, 2026, US Senators Ron Wyden and Elizabeth Warren sent a letter to FINRA President and CEO Robert W. Cook urging immediate regulatory action on fraud involving the Automated Customer Account Transfer Service (ACATS), the system used to move customer securities and cash between brokerage firms. The letter was also sent to Securities and Exchange Commission (SEC) Chairman Paul Atkins and Depository Trust & Clearing Corporation (DTCC) President and CEO Frank La Salla, underscoring that congressional concern extends beyond FINRA’s direct regulatory perimeter. The letter identifies specific ACATS security gaps, names individual firms based on their current protections and calls for new rules on customer notification, transfer locks, transaction authentication and phishing-resistant multifactor authentication (MFA). FINRA must respond by September 17, 2026.

Although directed at FINRA rulemaking rather than any single firm, the letter signals where regulatory and reputational scrutiny is heading. Broker-dealers and other financial institutions handling ACATS transfers should assess their transfer-security controls, authentication practices and customer communications now rather than wait for a final rule.

The vulnerability

Administered by the US National Securities Clearing Corporation and governed by FINRA Rule 11870, ACATS gives an outgoing firm only one business day to validate or object to a transfer request and, if validated, three business days to complete it. The letter explains that this speed – designed to stop firms from obstructing customers who want to leave a brokerage firm – has created a gap: The outgoing firm does not need to notify or authenticate the actual account holder before a transfer proceeds. Fraudsters have exploited this gap by opening fraudulent accounts elsewhere using stolen information and pulling the victim’s assets before the victim knows a transfer occurred. Wyden and Warren’s letter cites an October 2025 New York Times investigation reporting on incidents at firms including Vanguard and Merrill.

Compounding the problem, the letter claims many firms do not reliably notify customers when a transfer is initiated. FINRA’s Regulatory Notice 23-06, published in 2023, recommended but did not require such notification. The letter states that certain firms currently give no notice at all, eliminating the window customers would otherwise have to stop a fraudulent transfer.

Firm-by-firm findings

The letter reports firm-by-firm findings across multiple controls, including self-managed transfer-block features and support for phishing-resistant MFA, based on a review conducted by the senators’ offices and direct outreach to major brokerages. The findings show substantial variation across the industry, with some firms offering robust, customer-controlled protections and others offering little or none.

Firms named in the letter should expect this level of public, comparative detail to be referenced in follow-on inquiries, press coverage or state regulatory attention, independent of what FINRA ultimately does with the rulemaking request.

What the letter asks FINRA to do

The letter’s near-term request is to codify Regulatory Notice 23-06 into a binding rule requiring transfer notifications and a self-managed, opt-in transfer lock. Longer term, the request is to require verified outgoing-holder confirmation via a dual-track framework, plus mandatory phishing-resistant MFA (passkeys), citing NIST SP 800-63 and 800-53, OMB M-22-09, and Japan’s recent passkey mandate as a model.

Why it matters

Congressional letters of this kind do not themselves create binding legal obligations, and FINRA is not required to adopt any of the specific proposals described above. However, the letter is a meaningful signal for several reasons:

It follows FINRA’s own 2023 guidance identifying transfer notification as an “effective practice,” meaning FINRA has already laid analytical groundwork that could support converting guidance into a rule.

It references federal cybersecurity authentication standards (NIST SP 800-63 and 800-53, OMB M-22-09) that already exist and could be invoked in examinations, enforcement referrals or private litigation irrespective of a new FINRA rule.

It creates a public record, firm by firm, of which institutions do and do not currently offer self-managed transfer locks and phishing-resistant MFA, which could be used by regulators or plaintiffs’ counsel regardless of the rulemaking outcome.

It highlights account-takeover and new-account fraud typologies that intersect with existing broker-dealer regulatory obligations, including Regulation S-P safeguarding requirements, SEC and FINRA Identity Theft Red Flags obligations under Regulation S-ID, FINRA Rules 3110 and 3120 supervisory obligations, and state data breach notification and safeguards laws that may be triggered if customer accounts are compromised.

Recommended actions

We recommend that broker-dealers and other financial institutions handling ACATS transfers take the following steps:

Inventory ACATS transfer-lock controls and assess moving to a self-managed, customer-controlled model. Firms should evaluate whether they can deploy a comparable feature before any FINRA mandate.

Confirm whether outbound transfer requests trigger customer notification, and if they do not, consider implementing a notification protocol.

Benchmark MFA offerings against phishing-resistant standards (NIST SP 800-63 and 800-53, OMB M-22-09), with particular attention to passkey deployment.

Review fraud-monitoring and escalation procedures for the account-opening/ACATS-pull typology described in Wyden and Warren’s letter.

Prepare for possible interest from regulators, plaintiffs’ counsel and the media, including SEC examination inquiries, state attorney general and state securities regulator inquiries, and update board/risk-committee reporting as needed.

Monitor FINRA’s response, due September 17, 2026, and any resulting notice-and-comment rulemaking.

How we can help

Our cyber/data/privacy practice advises broker-dealers, banks, investment management firms and other financial institutions on FINRA and SEC cybersecurity and authentication obligations, incident response, and regulatory engagement. We can help benchmark your current controls against the protections highlighted in the letter, prepare for examination inquiries and, if useful, submit comments in any resulting FINRA rulemaking.

FTC Court Win Blocks Henkel’s Acquisition of Liquid Nails

Fri, 21 Aug 2026 18:48:40 Z

On August 17, 2026, the Federal Trade Commission (FTC) announced it had secured a win in court to block the merger of two of the largest construction adhesive brands. The ruling is a significant triumph for the FTC and a useful data point for dealmakers evaluating how the agency is litigating – and where it is choosing to litigate – merger challenges under Chairman Andrew Ferguson.

On August 14, 2026, the US District Court for the Southern District of New York granted the FTC’s request for a permanent injunction to block Henkel’s proposed $725 million acquisition of Liquid Nails from private equity firm American Industrial Partners. Henkel is the manufacturer of the industry-leading Loctite brand of construction adhesives. In December 2025, the FTC sued to block Henkel’s proposed acquisition of Liquid Nails, Loctite’s chief rival in the construction adhesives market, alleging that combining the two brands would eliminate significant head-to-head competition and lead to higher prices, lower quality and reduced innovation for a product widely used in home building and maintenance.

After a seven-day trial, the district court sided with the FTC and issued a permanent injunction blocking the deal outright, rather than referring the matter back to the agency’s administrative process. Announcing the result, FTC Bureau of Competition Director Daniel Guarnera framed the case as a straightforward horizontal competition problem: “Anyone who looked at the construction adhesives shelves of a hardware store or home improvement retailer could see that a merger between Loctite and Liquid Nails would be a bad deal for Americans.” He added that the decision “will ensure that Americans benefit from continued competition between Loctite and Liquid Nails, including lower prices and higher quality.”

Beyond the substantive result, the agency was explicit that it views this case as validating a procedural shift, describing the win as marking “the Commission’s new approach to seeking permanent injunctions to block anticompetitive mergers without the need to continue cases in administrative proceedings,” or litigating merger challenges to a final, binding result in federal district court rather than pursuing a preliminary injunction in federal court while the underlying merits proceed in the FTC’s own administrative tribunal.

The Loctite/Liquid Nails result, along with public comments from Ferguson that the agency should bring its merger challenges directly in federal court rather than through the FTC’s in-house administrative process, signals a departure from the agency’s traditional two-track model. Taken together with the outcome in this case, the FTC seems to be making an intentional choice: Rather than seeking a preliminary injunction to preserve the status quo while an administrative case proceeds on a separate track, the agency litigated this matter through trial in district court to a final, appealable injunction.

Why this matters

For parties contemplating mergers that raise potential horizontal overlap concerns, several practical takeaways emerge:

Prepare for federal court, not the FTC’s administrative docket. If the agency is committed to litigating merger challenges to final judgment in federal district court, merging parties should plan for full-blown federal litigation – including trial – as the primary (not merely preliminary) battleground, including the associated discovery burden, timeline and evidentiary standards that this entails.
Building materials and other consumer-facing input markets remain a priority. The agency’s public messaging ties this enforcement action to housing affordability and cost-of-living themes, signaling continued scrutiny of consolidation in building products and other markets seen as directly affecting household costs.
Brand concentration arguments retain force. The FTC’s theory here rested on eliminating direct competition between two well-known, closely positioned brands within the same category – a straightforward horizontal theory that remains a core enforcement priority regardless of procedural reforms.

Q2 2026 Venture Financing Report – Record $85.7 Billion Invested; Up Rounds Remain Strong

Mon, 17 Aug 2026 19:41:25 Z

Cooley handled 166 reported venture capital financings in Q2 2026, representing $85.7 billion of invested capital, driven by a large late-stage tech deal. Compared to Q1 2026, deal volume declined for Series Seed, Series B, Series D and later rounds, while Series A and Series C rounds increased. Overall invested capital more than doubled from Q1 2026, reaching the highest level recorded in the history of this report (since 2014), with invested capital rising across all stages.

Median pre-money valuations increased for Series Seed and Series B rounds but decreased for Series A, Series C, Series D and later rounds. Series B rounds showed the greatest increase, with the median pre-money valuation rising from $152.5 million in Q1 to $185.2 million in Q2. Series D and later rounds showed the greatest decrease, with the median pre-money valuation dropping from $2.4 billion in Q1 to $600 million in Q2. The percentage of deals with pre-money valuations above $100 million (across all stages) remained elevated, increasing from 41% in Q1 to 48% in Q2.

Up rounds decreased to 83.6% of deals, while flat rounds and down rounds increased to 4.3% and 12.1%, respectively. By comparison, Q1 saw 86.6% up rounds, 2.5% flat rounds and 10.9% down rounds.

Recapitalizations increased from 1.75% in Q1 to 1.81% in Q2, while the percentage of deals with pay-to-play provisions increased from 7% to 8.4%.

Liquidation preference structures remained favorable to companies, with 95.8% of deals having a “1x” liquidation preference, and 96.4% of deals having nonparticipating preferred stock. Redemption provisions decreased from 6.4% in Q1 to 5.4% in Q2, and accruing dividends increased from 2.3% in Q1 to 3% in Q2.

In PitchBook’s Q1 2026 Global League Tables, Cooley was ranked the #1 law firm in the US and globally for representing companies raising venture capital, a ranking the firm has held for more than six consecutive years. PitchBook also ranked Cooley #1 for deals overall in the US and globally based on company representation across venture capital financings, IPOs, M&A and private equity transactions.

Additionally, LSEG’s Global Venture Capital Review for Q1 2026 named Cooley the #1 firm for representing companies raising venture capital based on deal count. LSEG also named Cooley the #1 law firm for venture capital firm representations based on overall deal count and overall deal value.

Spotlight on technology

Tech company venture financing deal volume increased slightly, from 94 deals in Q1 to 95 deals in Q2. Invested capital doubled from $36.7 billion in Q1 to $73.9 billion in Q2. This increase in invested capital was primarily driven by one large late-stage tech deal that closed this quarter. The median reported deal size of venture financings for tech companies increased, from $18.5 million in Q1 to $30.5 million in Q2.

Spotlight on life sciences

Life sciences deal activity declined in Q2, with 27 reported deals and $1.1 billion of invested capital, compared to 32 reported deals and $1.8 billion of invested capital in Q1. Median reported deal sizes of venture financings for life sciences companies increased in Q2 to $25 million, compared to $22.2 million in Q1. The percentage of life sciences company venture financings structured in tranches increased from 28.1% of reported deals in Q1 to 29.6% of reported deals in Q2.

Unlocking the Weights: What Enterprises Should Know Before Deploying Open-Weight AI Models

Wed, 12 Aug 2026 07:00:00 Z

Does every task in the enterprise really call for the biggest model on the market? That’s the question more companies are now asking. Frontier models set a high standard for pushing the boundaries of what AI can do, but as token fees climb and many everyday tasks turn out not to need frontier-level horsepower, companies are increasingly adding open-weight models to the mix as a complementary option. Deploying them, however, raises legal and governance questions that differ from those raised by hosted AI services or traditional open-source software procurement. This alert is intended to help companies and their general counsel understand and navigate those differences.

Open weight, not open source

“Open weight” is not “open source.” Open-source software is generally distributed under standardized, well-understood licenses that grant broad rights to use, modify and redistribute. Open-weight models simply make a model’s weights – the numerical settings a model learns during training that shape how it responds – available for download and local deployment. They require integration through a separate software platform to run and manage the model, and often remain subject to bespoke contractual terms on commercial use, intellectual property (IP), redistribution, attribution and downstream deployment.

Key legal risk areas

Organizations considering open-weight models should evaluate the legal framework governing deployment, not just technical performance. Licensing, IP, privacy, security and an evolving regulatory landscape all affect how these models can be used and what safeguards should accompany their deployment.

A. Licensing is the threshold issue

For many organizations, the first legal issue in evaluating an open-weight model is not copyright or regulation, but the license itself. Unlike traditional open-source licenses, open-weight licenses are increasingly customized. They typically permit downloading, deploying and modifying weights, but may impose obligations well beyond preserving copyright notices or attribution.

Depending on the model, organizations may encounter provisions addressing commercial use limitations, acceptable use restrictions, volume restrictions, and attribution or branding requirements. Some licenses also restrict using the model, its outputs or derivative works to train, develop or improve a competing AI model. Like traditional open-source licenses, organizations may also occasionally encounter “copyleft” provisions requiring that derivatives thereof be made available on the same open-source terms, which may conflict with commercial objectives of keeping the organization’s software source code a trade secret. The same issue can arise with training datasets, such as those licensed under the Creative Commons ShareAlike license, which requires that new works built from the same data be shared under the same license. That said, this concept has traditionally applied to creative works that are direct derivatives of other creative works and how it applies to models trained on those works remains a fact-specific analysis.

Intended deployment matters too. Internal productivity use may carry different obligations than incorporating the model into a customer-facing product or platform. Organizations planning to fine-tune, redistribute derivative weights or build downstream products should confirm that the license permits this, and check for added obligations, taking into account how their product’s use may evolve.

B. IP questions continue to evolve

Open-weight models also raise IP questions that courts and regulators are still working through as generative AI develops. Much of the current litigation asks whether using copyrighted material for AI training infringes copyright or falls within doctrines such as fair use. These disputes generally involve developers rather than downstream deployers, but organizations should recognize that training data provenance is not always transparent, and the governing standards remain unsettled. Questions also arise over AI-generated outputs: ownership of generated content, resemblance to protected third-party works, risk of incorporation of open-source code and security vulnerabilities into AI-generated software, and contractual allocation of IP risk.

Unlike many hosted AI services, self-hosted open-weight deployments may lack provider indemnification or related contractual and technical protections – not only for IP-infringing outputs, but also more broadly for harmful, inaccurate or discriminatory outputs. Organizations should therefore build governance around AI-generated outputs, including human review, documentation, and technical validation and safeguards, and consider how liability for AI-related risks is addressed when a model provider offers no contractual indemnities or other protections.

C. Privacy, security and deployment architecture

A principal advantage of open-weight models is deployment flexibility. Unlike provider-hosted models, which require transmitting prompts and data to a third party, open-weight models can run entirely within enterprise-controlled environments – a meaningful benefit for organizations handling sensitive commercial information, proprietary IP, or regulated data subject to sector-specific privacy and data-handling rules. That flexibility comes with a trade-off: It shifts responsibility for securing and operating the AI environment to the deploying organization. That includes integration, access controls, infrastructure maintenance, usage monitoring, safeguards against inappropriate content, vulnerability management, output optimization, and compliance with privacy, breach-notification and cybersecurity requirements that a hosted provider’s data processing terms might otherwise help address.

Conversely, managed inference providers – companies that host and run a model on their own infrastructure so customers can access it without operating it themselves –may offer contractual protections, support and established security controls, but they introduce their own vendor-management and data privacy-governance considerations. The right approach depends on the use case, legal obligations, risk tolerance and governance capability, not just technical requirements.

D. Regulatory landscape continues to develop

The legal framework for advanced AI continues to evolve, as lawmakers weigh AI governance, export controls, national security, computing restrictions, consumer protection and cross-border deployment. Many regulatory frameworks do not yet distinguish open-weight from proprietary models. One notable exception is the European Union AI Act, which exempts open-source general-purpose AI model providers from certain technical documentation and downstream information obligations. It does not exempt them from all requirements; they must still implement a policy to respect EU copyright law and rightsholders’ text and data mining opt-outs and publish a sufficiently detailed public summary of the content used for training. Recent reporting likewise suggests that the White House’s voluntary, nonpublic frontier model review guidelines do not apply to open-weight models – further evidence that this remains an evolving area of AI governance and national security policy.

Adding to this complexity, a substantial share of today’s top open-weight models are developed outside the United States, including by developers based in China. That reality has drawn its own share of policy attention. The US and other governments have begun considering supply-chain provenance, data-handling practices and security review as part of a broader conversation about foreign-developed AI models generally, separate and apart from the quality or utility of any particular model. Organizations evaluating an open-weight model of foreign origin should treat these considerations as part of standard diligence – alongside licensing and IP review – rather than as a bar to adoption, while staying alert to guidance that may apply specifically to models associated with certain jurisdictions or certain entities.

Open-weight model deployments may therefore raise a broader, and in some respects more nuanced, range of legal considerations than traditional software procurement, and even hosted frontier models.

Lawmakers have also begun examining the cross-border movement of advanced AI models, weights and related technology. Organizations should monitor developments affecting cross-border deployment and jurisdiction- or provider-specific restrictions, which remain highly dynamic and may affect deployers and developers.

Pre-deployment checklist

Before deploying an open-weight model, organizations should, at a minimum:

Carefully review the applicable license to confirm it permits the intended deployment, and identify any restrictions on commercial use, redistribution, fine-tuning, downstream deployment, attribution or other contractual obligations that may apply.
Assess the jurisdiction, ownership and supply chain associated with the model’s developer and any upstream contributors, including where the model was trained and hosted; confirm whether the developer or model is subject to export control classification, entity-list or other trade restrictions; and where the deployment involves sensitive, regulated or government-related data, consider whether additional national security or cross-border review is warranted before proceeding.
Evaluate whether a self-hosted or managed inference architecture is more appropriate given the organization’s data sensitivity, operational needs, risk tolerance, customer commitments and available contractual protections.
To the extent possible, diligence the provenance and licensing history of any third-party model weights before deployment, particularly where the model has been modified, fine-tuned or obtained through an intermediary, to understand what rights and obligations accompany the model.
Implement governance around AI-generated outputs, including human review, technical safeguards and code-scanning to help catch and prevent potential IP issues, open-source software, security vulnerabilities and other material errors before outputs are deployed or relied upon.
Build a process to keep policies current as fast-moving export controls, AI regulation and other legal rules continue to evolve.
Develop contingency plans that account for changes to licensing terms, model availability or regulatory requirements that could affect continued deployment or commercial use.

As enterprise adoption of open-weight models grows, the legal questions surrounding deployment – from bespoke licenses to IP risk, governance and emerging regulation –will keep evolving. Organizations that evaluate these issues early in procurement and deployment will be better positioned to fold open-weight models into their AI strategies while managing legal and operational risk.

Cooley combines experience in AI, technology transactions, IP, privacy, cybersecurity, national security and global AI regulation to help clients evaluate, deploy and govern AI systems across the company.

The UPC Three Years In

Tue, 11 Aug 2026 18:13:25 Z

The Unified Patent Court (UPC) opened its doors in June 2023 as a single, centralised judicial forum to handle patent disputes across participating EU countries. During a seven-year transitional period, it is possible to opt European patents out of the UPC’s jurisdiction, i.e. up to May 2030. This period can potentially be extended once by another seven years, up to May 2037. However, the consultation on whether to extend this period is due to start in June 2028, so we cannot expect to have certainty regarding the possible extension until relatively late in the current period. As such, it is possible that within a few years the UPC could become the mandatory forum for enforcement and revocation of European patents in EU Member States participating in the UPC’s system, irrespective of whether a unitary patent is requested upon grant.

In the first six months of the UPC, roughly half of newly granted European patents remained within the system. This has increased as the court has matured and case law has developed and, as of June 2026, about two-thirds of newly granted European patents are not being opted out. Of the patents under the UPC’s jurisdiction, about half are unitary patents, with the remainder being European patents validated by the traditional route. This split has been fairly consistent throughout the UPC’s lifespan. For example, in 2025, 62% of patents remained under the UPC’s jurisdiction and 29% of granted patents were registered as unitary patents. As such, it appears that patentees are becoming more accepting of the UPC and unitary patent system, with the growing use of unitary patents reflecting increasing confidence in the combined UPC/unitary patent framework, including its simplified administration and, in many cases, more cost‑efficient structure (including renewals). This trend may be explained by the UPC’s practical advantages, notably the speed of its procedures and the availability of remedies (including injunctions) with effect across multiple EU Member States in a single action.

Perhaps surprisingly, patents in the medical or veterinary science space now have a higher uptake of unitary patents than average for European patents. Whilst the expectation has been that the pharmaceuticals space would be more risk-averse, patentees are choosing strategies that involve unitary patents. That said, the still-evolving unitary supplementary protection certificate framework introduces uncertainty that may continue to influence how life sciences patentees approach unitary patents. Curiously, the smallest proportion of unitary patents is in the electronics space. This space also sees the lowest proportion of opt-outs, so this lack of unitary patents is presumably driven by cost, countries of interest and expected patent lifespan, rather than any concerns about the UPC itself.

One reason patentees may be more willing to make use of the UPC is that the revocation rates at the UPC and European Patent Office (EPO) are broadly comparable. In 2025, 32% of revocation actions or counterclaims for revocation at the UPC resulted in the patent in suit being revoked. At the EPO, there was a revocation rate of 29% at the first instance during opposition in 2025, which rises to 31% on appeal (and to 48% on appeal if dismissed appeals are excluded). The risk of a central revocation of a European patent post-grant, therefore, does not appear to significantly differ between the UPC and EPO systems.

However, it is important to recognise that the nature of this risk differs between the systems. At the UPC, revocation can arise quickly within infringement proceedings and applies across all participating EU Member States in a single decision, whereas EPO opposition follows a different procedural track and typically operates over a longer time frame. As such, the practical commercial impact of revocation risk may be more acute in the UPC context.

The case law of the UPC is developing and there are indications of greater consistency in approach between divisions, as guidance from the Court of Appeal of the UPC emerges. The Court of Appeal has overturned approximately a third of first-instance decisions, whereas the EPO Boards of Appeal at least partially overturned 64% of cases in 2025.

Overall, it appears that the UPC is gaining prominence and credibility as a forum. This may be contributing to the increasing willingness to remain within its jurisdiction.

What does this mean for patentees?

Ultimately, a more nuanced, portfolio‑based approach is now appropriate when interacting with the UPC and choosing between traditional European patent validation and the unitary patent system. As UPC case law becomes more settled and the court is used by more patentees, keeping selected cases within the UPC and considering unitary patents rather than national validations potentially becomes more attractive. This is especially true as the end of the initial transition period approaches.

In practice, many patentees are using the UPC, often in conjunction with a unitary patent, alongside the traditional national validation route and opt-outs. This is not purely a question of patent strength or importance, and the sensitivities depend both on subject matter and business model. It is not uncommon to see a blended approach even within the same patent family, for instance with commercially valuable “picture claim” patents opted out and broader offensive patents kept within the UPC’s jurisdiction.

The key balance is therefore between the UPC’s enforcement advantages (including speed and pan‑European relief) and the risk of central revocation, with the appropriate approach depending on the strength of the patent, its commercial footprint and the patentee’s risk tolerance.

For patentees with interests in the UK and other significant European markets not participating in the UPC (such as Spain and Poland), a parallel national patent strategy will remain appropriate.

If you wish to discuss any specifics of post-grant patent strategy, especially around staying in or opting out of the UPC’s jurisdiction, please contact a member of the patent counselling and prosecution group’s London team for bespoke advice.

FCC Adopts Rules Overhauling Space Station Licensing Rules

Mon, 10 Aug 2026 13:56:23 Z

The Federal Communications Commission (FCC) adopted a Report and Order and Further Notice of Proposed Rulemaking on July 22 overhauling its space and earth station licensing framework. The rules aim to provide entities with a more efficient, predictable and flexible process to support commercial deployment of space infrastructure.

Updated licensing framework

The FCC establishes a “licensing assembly line” to provide space companies a clearer and quicker process for obtaining authorizations. The framework adopts a modularized, certification-based application designed to only collect necessary information and streamline the review and approval process.

Removal of surety bond requirements

The new rules eliminate the surety bond requirements for all systems, except for non-geostationary orbit (NGSO) systems involved in processing rounds (i.e., fixed satellite service and mobile satellite service systems). For NGSO systems subject to processing rounds, the FCC will require a bond set at an initial amount of $10 million, with the bond amount being reduced based on the percentage of the total authorized satellites deployed.

Elimination of streamlined small satellite and small spacecraft rules

The FCC eliminates the streamlined small satellite and small spacecraft rules, stating that those processes are no longer necessary. The FCC does not, however, address how it will handle current streamlined small satellite or small spacecraft licenses, or how it intends to calculate annual fees for such licenses moving forward, which historically have been less than 1/20 of the annual fees of other NGSO systems.

New ‘variable trajectory space stations’ licensing category

Recognizing the continuous development and use of new space technologies, the FCC creates a new category for space stations that does not readily fit into the traditional NGSO or geostationary orbit (GSO) space station categories. The variable trajectory space stations (VTSS) category is for systems “of one or more space stations either operating beyond the geosynchronous orbit or operating without fixed or predictable patterns over the course of its lifetime and operating under one space station call sign.” These systems include, but are not limited to, orbital transfer vehicles, rendezvous and proximity operations platforms, in-service servicing systems and missions involving transit to, orbiting of, or operations on the moon or other celestial bodies.

Conditional grants

Under the new rules, the FCC will issue conditional grants of authorization to further streamline and expedite the licensing process. These conditional grants will allow applicants to move forward with launch and/or certain operations prior to obtaining full authorizations from the FCC.

Revised processing rounds

The FCC updates its processing-round framework to provide NGSO systems greater predictability. Under the new framework, the FCC will open annual processing rounds and review applications on a rolling basis for each year. The Space Bureau will initially open processing rounds for Ka-, Ku-, V- and Q-bands and then add additional bands.

Further notice of proposed rulemaking

In addition to adopting new licensing rules, the FCC seeks comments on additional rules and revisions to further modernize its licensing framework to promote deployment of space operations. Some of these proposed rules include creating a new space-based experimental license; allowing currently operating NGSO satellite systems to combine authorized satellites under a single call sign; and permitting space station licensees to change or add radio frequency sensing capabilities through a minor modification or notification process.

If you are interested in learning more about the rules and their potential impact, please register for a Lunch & Learn panel on these and related topics on August 13 from 12:00 to 2:00 pm ET, or reach out to one of the Cooley lawyers listed below.