News Briefs

Regulating AI Like a Doctor: FDA Floats Competency-Based Path for Generative AI-Enabled Devices

Mon, 28 Sep 2026 07:00:00 Z

On August 18, 2026, the US Food and Drug Administration (FDA) Center for Devices and Radiological Health (CDRH) released a discussion paper proposing new approaches to regulating medical devices enabled by generative artificial intelligence (genAI), and requesting stakeholder feedback, which must be submitted by October 19, 2026. The paper is not guidance, but it offers insight into how the agency is thinking about the unique risks and evidentiary challenges posed by genAI-enabled devices. The paper presents two main ideas: a two-axis framework for assessing risk and a “competency-based” model for premarket evaluation inspired by how human clinicians are evaluated and credentialed.

Background

CDRH has been concerned about genAI-enabled medical devices for some time. Following a November 2024 public meeting of its Digital Health Advisory Committee, CDRH identified two categories of regulatory challenges posed by these devices:

Challenges associated with applying a risk-based approach to classifying and determining regulatory requirements for genAI-enabled devices.
Challenges associated with determining the types of valid scientific evidence for FDA’s evaluation of the safety and effectiveness of such devices across the total product life cycle.

This discussion paper offers potential ideas to address these challenges and requests stakeholder feedback.

The two-axis framework

CDRH proposes organizing risk assessment for genAI-enabled software functions in a chart with the horizontal axis representing the degree and independence of the device’s activity and the vertical axis representing the severity of consequences if a user relies on an incorrect output. Risk increases moving from the lower left toward the upper right of the line chart. (See Figure 1)

Figure 1: FDA’s two-axis framework for risk

Within that framework, CDRH puts forth several specific factors that it suggests should shift a function’s risk classification, including, for example:

Measurement and signal processing functions. FDA claims that genAI-enabled in vitro diagnostic, measurement and signal processing functions raise increased concern as their outputs typically cannot be independently assessed by the user. Even though such functions do not direct users to perform an action (a function CDRH considers higher risk than simply providing nondirective information), CDRH proposes to treat them as higher risk because a user cannot identify and avoid relying on an incorrect result.
Patient-facing versus HCP-facing informational functions. CDRH also proposes to weigh whether informational functions delivered directly to patients should be treated as higher risk than the same functions delivered to healthcare professionals (HCPs), since FDA believes that HCPs are generally better positioned to interpret an output, recognize limitations, spot an error and avoid over-relying on it.

Interestingly, both of these considerations appear to come directly from concepts that are structural to FDA’s clinical decision support (CDS) software guidance. The CDS guidance’s nondevice carve-out excludes software that acquires, processes or analyzes signals from an in vitro diagnostic device or a signal acquisition system and requires devices meeting the carve-out to enable an HCP (explicitly not a patient or caregiver) to independently review the basis for a recommendation. CDRH draws that connection itself in the discussion paper, in a footnote where it notes that its concern about measurement and signal processing functions “seems consistent with the independent- review criterion of the clinical decision support exclusion.”¹ Despite criticism that the CDS guidance significantly narrows the statutory carve-out from the 21st Century Cures Act, it appears CDRH proposes to import some of the CDS guidance’s risk logic into a broader framework for genAI-enabled devices generally.²

CDRH also flags other factors it is considering, including how to treat “action-directing” versus “action-taking” functions – terms CDRH uses descriptively as part of its proposed risk framework rather than as terms with fixed regulatory definitions. CDRH has not defined these categories with precision and is specifically asking stakeholders to help refine the distinctions between them. Other factors under consideration include generalist HCP-facing functions versus specialist-facing ones, multi-turn conversations that migrate from informational to action-directing over time and care escalation functions. CDRH specifically requests feedback on this proposed risk framework.

Competency-based model for premarket evaluation

CDRH also previews a possible shift in how genAI-enabled devices could be evaluated by FDA before they are permitted to be marketed. Traditional software device evaluation has relied on testing across a representative sample of defined inputs and outputs. However, CDRH notes that this approach likely will not work for genAI-enabled devices as the range of possible inputs and outputs may be too large for such testing to be practical. Instead, citing recent academic papers that propose evaluating genAI more like a clinician than an unchanging product, CDRH is considering a two-part “competency-based” evaluation model, which includes device benchmarking and clinical confirmation. CDRH anticipates that the scope of benchmarking and the rigor of clinical confirmation would scale with the device’s position on the two-axis risk framework.

Device benchmarking. CDRH envisions device benchmarking as a scalable, nonclinical evaluation to assess whether the device, in its deployed configuration, demonstrates the clinical knowledge, analytic capabilities, safety behavior, communication and generalizability to support reasonable assurance of safety and effectiveness of the device for its intended use. CDRH proposes evaluating devices across categories of competencies, including safety (e.g., recognizing safety-critical situations and communicating uncertainty), clinical proficiency (e.g., clinical knowledge and analysis), generalizability (e.g., robustness, reliability and reproducibility) and additional agentic-specific competencies for agentic AI functions.
Clinical confirmation. CDRH also believes that device benchmarking alone may not fully establish how a genAI-enabled device will perform in actual clinical use, since such devices interact with users, workflows and patient populations in ways that testing may not capture. CDRH therefore contemplates an additional clinical confirmation step, noting that this would not necessarily require a prospective clinical study in every case. Instead, the type and rigor of evidence would be consistent with the device’s risk profile and could range from retrospective evaluation on real patient data to prospective clinical studies or randomized controlled trials.

This competency-based evaluation model would represent a significant departure from traditional premarket review, which has generally relied on testing a device against a defined set of inputs and comparing its outputs to a known standard, such as the paradigm underlying the 510(k) substantial equivalence framework. Under the competency-based approach, by contrast, evaluation would center on whether a device demonstrates proficiency across prespecified categories of clinical knowledge, safety behavior and real-world generalizability – an assessment framework modeled less on product testing and more on how human clinicians are credentialed.

The shift is consequential because it would move FDA toward a qualitative, multidimensional evaluation of device capability. If adopted, this model could fundamentally reshape the FDA’s marketing authorization policy for genAI-enabled devices, replacing conventional input-output testing with a credentialing-style assessment of device competency, paired with clinical evidence scaled to risk. Whether and how these proposals take shape can still be influenced by industry engagement during the comment period and beyond.

Postmarket monitoring

Through the introduction of the competency-based model, CDRH recognizes that the novel capabilities of genAI-enabled devices can make it difficult for premarket testing alone to fully capture device performance. CDRH states that it is therefore considering whether it may be appropriate to accept greater premarket uncertainty regarding a genAI-enabled device’s benefit-risk profile, and instead place greater reliance on postmarket monitoring. The discussion paper identifies a handful of potential approaches to postmarket monitoring that are intended to be proportionate to a device’s risk profile:

Periodic device benchmarking

The manufacturer would reassess the device against the same prespecified benchmarking thresholds used in the premarket evaluation, on a defined cadence and after defined triggering events, including changes to the underlying model or other components of the deployment architecture. This approach is conceptually similar to FDA’s existing Predetermined Change Control Plan (PCCP) framework, under which preauthorized modifications can be implemented without new premarket submissions.

Periodic sample-based clinician review. Qualified, independent clinician adjudicators would review samples of real-world inputs and outputs against prospectively defined criteria, sampled to reflect device encounters in actual use. Although the discussion paper contemplates the use of qualified independent third parties as clinical adjudicators and describes a general methodology for comparing device outputs against independent clinician assessments, it does not address the institutional infrastructure for this process – for example, how adjudicators would be credentialed, whether they would operate under FDA oversight or institutional review board supervision, or what contractual or governance arrangements would apply. These implementation details remain open questions, consistent with the paper’s discussion-only status.
Performance degradation monitoring. The manufacturer would monitor for drift resulting from changes in the input population, data environment or underlying model components.

CDRH also asks for feedback on whether machine-based supervisory agents could help facilitate some aspects of postmarket monitoring, effectively raising the concept of AI agents evaluating AI device functions. This is a notable step for the agency: There does not appear to be precedent for FDA endorsing machine-based oversight of regulated devices, even at the discussion stage, and the proposal underscores the extent to which genAI-enabled devices may require fundamentally different regulatory approaches. Additionally, CDRH proposes a “shared ecosystem responsibility” for postmarket oversight, noting that clinicians, healthcare institutions, payors, professional societies and other stakeholders each may have roles to play in the deployment, monitoring, reporting and ongoing evaluation of genAI-enabled devices.

This framing reflects a broader pattern in FDA’s current thinking: Rather than concentrating all oversight within the agency, FDA is increasingly exploring models that leverage external institutions and stakeholders. For example, FDA’s Expedited IND Pilot, announced on September 15, 2026, under the Department of Health and Human Services’ Operation TrialBlazer initiative, pairs drug sponsors with qualified research institutions to accelerate first-in-human clinical trial timelines through rolling investigational new drug (IND) review – a model that, while structurally different from CDRH’s postmarket vision, similarly relies on distributing regulatory functions across a network of qualified participants within the clinical trial ecosystem rather than handling them entirely within FDA. However, it is unclear under what authority FDA could compel such parties to engage with FDA on these issues.

Foundation model master files

Because many genAI-enabled devices are built on third-party foundation models, CDRH is also exploring whether the existing Device Master File program could be leveraged to improve the agency’s visibility into those underlying models. Specifically, CDRH seeks feedback on the feasibility of voluntary Foundation Model Master Files (MAFs), under which foundation model developers and platform providers could submit information on their models to FDA. These files would be held confidentially by FDA and could be referenced by device sponsors, with the file holder’s authorization, in support of individual premarket submissions. Importantly, CDRH emphasizes that submission of a Foundation Model MAF would not constitute authorization of the underlying model for any device intended use, and device sponsors would remain independently responsible for demonstrating the safety and effectiveness of their own devices.

The voluntary nature of this proposal raises an obvious question: Foundation model developers may have limited commercial incentive to disclose safety-relevant information to a regulator, particularly where doing so could expose limitations or failure modes. CDRH itself acknowledges this tension and asks commenters whether the program could be made sufficiently useful for premarket review given that participation would be optional. If adopted, however, Foundation Model MAFs could streamline premarket review by giving FDA reviewers a baseline understanding of the models underlying multiple device submissions, potentially reducing duplicative information requests and promoting more consistent review across devices built on the same foundation model.

Themes from public comments

Stakeholders filing comments to date have raised a few recurring points. Many commenters, including AI developers, health systems and individual physicians, argue that the two-axis framework should be supplemented with additional risk considerations – such as the detectability of an incorrect output, its reversibility and traceability to the underlying data or specific model – rather than relying on device activity and consequences alone. A similar group cautioned that postmarket monitoring is not an adequate substitute for premarket evidence where harm may be severe, fast-acting or irreversible, and several commenters urge CDRH to require sponsors to affirmatively state what failure modes a monitoring program can and cannot detect before any such trade-off is accepted. Some commenters questioned the feasibility and reliability of the Foundation Model MAFs, given that some models are continuously changing and updated hundreds of times a day. These comments, along with others addressing agentic AI oversight, human-in-the-loop design and foundation model change management, suggest that industry feedback may be helpful and ultimately shape CDRH’s eventual approach.

Practical considerations

As this is a discussion paper, not guidance, CDRH does not propose any new regulatory policy concerning the marketing authorization process or evidentiary requirements at this stage. However, the paper offers a meaningful preview of the agency’s thinking, and stakeholders should not underestimate its significance, particularly given the novelty of its proposals. CDRH discussion papers have historically foreshadowed the agency’s regulatory direction, and stakeholders who engage early in this process will be better positioned to shape the framework before it solidifies into formal policy, guidance for industry or regulation. Companies developing, deploying or investing in genAI-enabled medical devices should consider several near-term actions:

Submit comments by the October 19, 2026, deadline. The open feedback period is one of the most direct ways for stakeholders to influence CDRH’s regulatory approach to genAI-enabled products. Comments submitted through regulations.gov during this window carry particular weight, as CDRH has specifically requested input on its proposed risk framework, competency-based evaluation model and postmarket monitoring approaches. Companies should consider engaging individually or through industry associations.
Map existing and pipeline products against the two-axis framework. Even though the framework is not yet final, companies should begin assessing where their genAI-enabled devices fall along CDRH’s proposed risk axes – degree of device activity and severity of consequences from incorrect outputs. This exercise can identify products that may face heightened scrutiny and help prioritize regulatory strategy and resource allocation accordingly.
Evaluate evidence generation strategies. The competency-based evaluation model, if adopted, would provide guidance for companies to demonstrate device proficiency across defined competency categories rather than relying solely on traditional input-output testing. Companies should assess whether their current clinical evidence and testing infrastructure can support device benchmarking and clinical confirmation at the rigor CDRH envisions.
Review foundation model supply chain arrangements. CDRH’s proposed Foundation Model Master File program, coupled with its emphasis on deployment architecture and model change management, underscores the importance of contractual and operational visibility into third-party foundation models. Companies that rely on third-party models should evaluate whether their existing agreements provide sufficient access to the safety, performance and change-management information that CDRH may expect device sponsors to possess or reference.
Prepare for expanded postmarket obligations. CDRH’s discussion of periodic benchmarking, sample-based clinician review and performance degradation monitoring signals a potentially significant expansion of ongoing compliance obligations for marketed genAI-enabled devices. Companies should consider how these proposals would affect their quality systems, postmarket surveillance capabilities and operational costs.

Cooley’s life sciences and healthcare regulatory team will continue to monitor CDRH’s approach to genAI-enabled devices and is available to discuss how this discussion paper may affect product roadmaps, regulatory strategies or premarket submission planning. We also can assist in preparing a comment letter to FDA in response to the proposals outlined in this paper.

Notes

Discussion paper at 11 n.17 (noting that genAI-enabled measurement and signal processing functions raise concerns “seem[ing] consistent with the independent-review criterion of the clinical decision support exclusion”).
For more information regarding FDA’s CDS guidance, read Cooley’s January 2026 client alert.

The Law of Neural Data Licensing: The State Law Landscape and the De-Identification Question

Mon, 28 Sep 2026 07:00:00 Z

Over the past few years, one of the more visible trends among neurotech companies has been the emergence of neural data licensing as a business model. Companies collect neural data – sometimes from consumer wearables, sometimes from participants in clinical or research studies – and then license that data to third parties, such as developers of “brain foundation models” and other neuroscience companies. What began as an incidental use of research datasets has, in some quarters, become a revenue thesis: “Brain-data-as-a-service” providers now standardize and license neural datasets for others to train large-scale “mental models.” That commercial arc has the potential to intersect with efforts by states to give consumers more control over their personal data.

Five states have laws that make it unlawful or practically impossible to license neural data because they either almost prohibit it (Connecticut, Delaware and Vermont), or they require the consent of the individual whose neural data is to be sold (Colorado and Montana). Since in many cases, companies that hold neural data do not know what states the individuals reside in, licensing out neural data can be prohibitive.

In addition to state laws that prohibit or require consent for the licensing out of neural data, there are additional states that require companies that license out neural data to register as data brokers, which carry a host of operational and legal burdens. Six states run stand-alone data broker registration regimes: California, Oregon, Texas, Vermont, Connecticut and New Jersey. A seventh state, Nevada, regulates a narrower set of data brokers without requiring registration with the state, but affording individuals an ability to opt out of their data being sold or licensed.

Each of the states that regulate the licensing of neural data has different definitions of neural data and different scopes of applicability. Each of the registration laws has its own definition of who is a “data broker,” what kind of data triggers the registration requirement and what thresholds and exemptions apply.

Four structural models of data broker laws are now in play.

Model 1: California

California’s long-standing data broker law defines “data broker” as a business that knowingly collects and sells to third parties “the personal information of a consumer with whom the business does not have a direct relationship.” The law applies to a broad definition of “personal information” – any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

The law classifies neural data as a category of “sensitive personal information,” which is a subset of personal information under the law. The definitional path is short: Neural data that is identifiable to an individual is sensitive personal information; sensitive personal information is personal information; and personal information triggers the data broker regime. As a result, selling identifiable neural data about individuals with whom the business has no direct relationship falls within California’s data broker regime, even when the neural data is transferred without accompanying identifiers – unless the neural data has been de-identified to the California Consumer Privacy Act’s (CCPA) exacting standard, in which case it is excluded from “personal information” and out of scope of the law. Whether neural data can meet that de-identification standard is a threshold question discussed later in this article.

The operational obligations are substantial. For example, registered data brokers must:

Post a privacy policy that contains certain disclosures and offers certain consumer rights.
Pay a $6,000 annual registration fee (increased to $9,500 in 2027), plus payment processing fees, during the January 1 – 31 registration period.
Create and maintain a Delete Request and Opt-Out Platform (DROP) account, download the CPPA’s consumer deletion list at least every 45 calendar days, and delete the consumer’s personal information (including deletion by service providers and contractors) upon match.
Process every deletion request received during the previous access session and report a response code back to the DROP (“Record deleted,” “Record opted out of sale,” “Record exempted” or “Record not found”) at each subsequent access.
Make enhanced disclosures during registration, including whether the data broker has shared for purposes of cross context behavioral advertising, or sold data to specific recipient categories, in the past year and identifying the most common types of personal information collected.

The CCPA regulations also refine the “direct relationship” question in a way that matters for neurotech companies: For the data broker law not to apply, a consumer must have intentionally interacted with the business to access, purchase, use, request or obtain information about the business’s products or services. Collecting data “directly from the consumer” does not, by itself, create a direct relationship if the consumer’s intent to interact with the business is missing – a distinction that matters for research-participant and clinical-trial datasets that later flow into licensing arrangements. The California law affords data brokers some exceptions from consumers’ deletion rights.

Model 2: Connecticut, Oregon and Vermont – Enumerated ‘brokered personal data’

Three states – Connecticut, Oregon and Vermont – apply to a specifically enumerated list of “brokered” personal data information. The list varies in the details, but the shape is consistent: name; address; date of birth; place of birth; mother’s maiden name; unique biometric data used to identify or authenticate the consumer; the name or address of a member of the consumer’s immediate family or household; Social Security or other government-issued identification number; and a catch-all for “other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty” (Connecticut and Vermont), or “can reasonably be associated with the individual” (Oregon).

Neural data is not one of the enumerated categories in any of these three statutes. It is pulled into these regimes only in three specific circumstances:

Bundling with enumerated identifiers. The license package also contains one or more of the enumerated identifiers (name, address, date of birth, Social Security number or the like) alongside the neural data.
Biometric identification or authentication. The neural data is itself being used by the licensor or licensee to identify or authenticate the consumer, bringing it under the “unique biometric data” prong. This prong requires an actual identification or authentication use – not merely that the data could theoretically be used that way. Neurotech companies whose license value proposition is training AI, not identifying users, are typically outside this prong. However, the Oregon law leaves a possibility that biometric information need not be used to identify an individual in order to be covered by the Oregon data broker law.
The identifiability catch-all. The neural data itself, alone or in combination with other data, would allow a reasonable person to identify the consumer with reasonable certainty (Connecticut/Vermont) or can reasonably be associated with the individual (Oregon). This is where the de-identification question lands.

The registration and mechanics vary across these three states. Oregon has required registration since January 1, 2024, with a $600 annual fee paid through the Oregon Division of Financial Regulation, an opt-out disclosure requirement and no state-run deletion mechanism. Vermont has required registration since January 1, 2019 – the first-in-the-nation data broker registration law – with a $100 annual filing to the secretary of state, security-program requirements and enforcement by the Vermont attorney general. Connecticut’s new regime turns on January 1, 2027; the Commissioner must stand up the state’s accessible deletion mechanism by July 1, 2028, and data brokers must begin honoring deletion requests received through it by October 1, 2028; annual public transparency statements begin July 1, 2029; and the first triennial independent audits must be completed by July 1, 2031.

In Connecticut and Vermont, separate laws, if they apply to a business, prohibit the sale of neural data absent the consent of the individuals whose neural data is to be sold. If these laws apply to a business, and they do not have the requisite consent, they cannot license neural data, and therefore the data broker registration requirement becomes moot.

Model 3: The Texas outlier – A revenue-based test

Texas takes a structurally different approach. The Texas Data Broker Act defines “data broker” as a business entity that collects, processes or transfers personal data that the business entity did not collect directly from the individual to whom the data is linked or linkable. “Personal data” for these purposes is broad and includes information linked or reasonably linkable to an identified or identifiable individual.

But Texas layers a materiality test on top of the definition. The law applies only to a business that, in a 12-month period, derives more than 50% of its revenue directly from processing or transferring personal data not collected by the data broker directly from the individuals to whom the data pertains, or any amount of revenue directly from processing or transferring the personal data of more than 50,000 individuals. Registration is a $300 filing with the Texas secretary of state. Obligations include a website notice identifying the business as a data broker, a comprehensive information security program, and civil penalties of $100 per day, capped at $10,000 per year, plus unpaid registration fees for noncompliance.

The practical implication for neurotech companies: Texas structurally protects businesses whose principal revenue is from selling another product or service, even where they engage in some downstream neural data licensing. The Texas law applies to pure-play “data-as-a-service” licensors of identifiable neural data and businesses with sizeable licensed-out populations. Texas also expressly exempts genuinely de-identified data, on essentially the CCPA-style standard: reasonable technical measures to prevent re-identification, a public commitment not to re-identify and contractual downstream controls.

Model 4: New Jersey – Highest fees in the nation and a novel ‘data collector’ concept

New Jersey enacted its data broker law on June 30, 2026 – introduced, passed and signed within a 48-hour window – making it the sixth state with a stand-alone data broker registration regime and, by a wide margin, the most expensive and structurally most disruptive. Unlike every other state’s data broker law, the New Jersey law regulates not only “data brokers” (the traditional definition) but a novel second category called “data collectors” – first-party businesses that sell or license their own customers’ personal data to data brokers. The law also imposes a categorical prohibition on the sale or licensing of “sensitive data,” which took effect immediately upon enactment. But this ban does not apply to neural data, unless it is swept into the prohibition where the neural data reveals mental or physical health condition, treatment or diagnosis of an individual, or where the neural data is processed for the purpose of biometrically identifying an individual. Enforcement rests with the New Jersey attorney general through the Division of Consumer Affairs, and the law contains exceptions that apply in certain circumstances.

Within days of enactment, however, the law drew immediate backlash over its unusually high fees, severe penalties and novel coverage of “data collectors.” A senior official from the administration of Gov. Mikie Sherrill confirmed to the press that the state would not enforce the law until the legislature fixes “certain defects that have come to light,” and, on July 10, 2026, the Division of Consumer Affairs issued a public alert stating that covered data brokers and data collectors will not be required to register or pay any registration fees until the registry launches in spring 2027. The sensitive data sale prohibition, by contrast, has not been paused and remains enforceable now, although that ban does not expressly apply to neural data.

The “data collector” category is the structural novelty. A “data broker” is defined much as in other states – an entity that knowingly collects or purchases the personal data of consumers with whom it has no direct relationship, and sells or licenses that data to third parties. A “data collector,” by contrast, has no analog in any other state’s data broker statute. A data collector is a business that has a direct relationship with the consumer (the individual is or was a customer, subscriber, research subject or similar counterparty) but sells or licenses those consumers’ personal data to a data broker downstream. A consumer neurotech company (for example, a wearable manufacturer that sells or licenses its own users’ neural data downstream to a data broker) is a data collector under New Jersey law, and it is subject to the same registration, fee, disclosure and sensitive data sale prohibition obligations as a traditional broker.

Registration fees are graduated based on the number of New Jersey residents whose personal data is sold or licensed: $5,000 for 100,000 residents or fewer; $10,000 for 100,001 to 499,999; $100,000 for 500,000 to 999,999; $500,000 for 1,000,000 to 1,499,999; $750,000 for 1,500,000 to 2,499,999; $1,000,000 for 2,500,000 to 4,499,999; and $1,500,000 for 4.5 million or more. These are the highest data broker registration fees enacted by any state – the top tier alone is 250 times California’s $9,500 2027 fee. Failure to register or pay the fee is a civil penalty of $2,500 per day; failure to submit or update required disclosures is the same. The law separately bans the sale, offer for sale or licensing of “sensitive data,” carrying a civil penalty of $50,000 per record.

The shared thread: The ‘direct relationship’ carve-out

Most of the state data broker regimes turn on the presence or absence of a direct relationship between the business and the individual whose data is at issue. Under California, Connecticut, Oregon, Texas and Vermont, if the neurotech company sits at the source – the individual is (or was) a customer, a research subject under contract, an investor, a donor or in a similar direct relationship – the business is not a data broker when it licenses out that data. New Jersey is the outlier because of its additional category of “data collector.” As discussed above, New Jersey’s “data collector” category closes the direct relationship exception for any first-party neurotech company that sells or licenses personal data to a downstream data broker. Whether the New Jersey law applies to a business that has a relationship with the individuals whose data is being licensed depends on what the licensee does with the data downstream. Therefore, diligencing (and contractually constraining) the recipient's own resale and relicensing conduct is central to the New Jersey analysis.

State restrictions on sale of neural data

In addition to state data broker registration requirements and consumer opt-out rights, two states (Colorado and Montana) have separate laws that, if they apply, prohibit the sale of neural data of their state residents absent consent from the individuals whose neural data is to be sold, or impose such restrictions on the sale of neural data that it is impractical even with consent (Vermont, Delaware and Connecticut).

Colorado and Connecticut

The Colorado and Connecticut laws apply to essentially any business that sells or licenses out neural data.

Vermont

The Vermont law only applies to businesses that conduct business in Vermont or produce products or services that are targeted to residents of Vermont, and control or process the personal data of 35,000 or more Vermont residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the sensitive data (including neural data) of 3,000 or more Vermont residents, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or offer for sale in trade or commerce the personal data of 3,000 or more Vermont residents

Many businesses that wish to license neural data will likely not be covered by the Vermont law because they do not have a consumer-facing business and do not have a business presence in Vermont or do business with Vermont entities.

Delaware

The Delaware law applies to businesses that conduct business in Delaware or produce products or services that are targeted to residents of Delaware, and control or process the personal data of 10,000 or more Delaware residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; control or process the personal data of 5000 or more Delaware residents, and derive more than 20% of their gross revenue from the sale of personal information; or acquired personal data from another entity that is covered by the law

Some businesses that wish to license neural data will not be covered by the Delaware law because they do not have a consumer-facing business and do not have a business presence in Delaware or do business with Delaware entities.

Montana

The Montana law applies to entities that either offer consumer genetic testing products or services directly to a consumer or that collect, use or analyze genetic data. Many businesses that wish to license neural data will likely not be covered by the Montana law because they are not in the genetic testing business.

If neural data is health or biometric information

Neural data might possibly be considered health information if an individual’s health information can be derived from the neural data. Neural data might possibly be considered biometric information if an individual’s identity can be derived from the neural data. If neural data is considered health information or biometric information under applicable laws, additional legal protections are afforded to such data. These additional laws would further regulate data licensing, including by imposing requirements in some additional states to obtain consent before selling or licensing such data.

Federal regulation of the sale of health information

The Federal Trade Commission (FTC) has taken actions against businesses that have sold health information to adtech companies and sensitive location information to third parties. The FTC has reasoned that consumers were not told about the sale and not given a method to decide whether their data would be included in the sale, and thus this practice was an unfair trade practice under federal consumer protection law. To date, the FTC has not applied the same rule to neural data, but it is conceivable that it would if faced with the question.

The federal Health Insurance Portability and Accountability Act (HIPAA) and the Food and Drug Administration regulations on research studies apply to neural data depending on the context in which it is collected – and the nature of the business that has collected it. If these federal laws apply, the state laws do not, but the federal laws come with their own compliance burdens. Businesses that have a choice should architect their way of doing business to either operate under HIPAA or the state laws depending on their preferred regulatory regime.

Two threshold questions: ‘For free’ licensing and revenue/volume gates

Before turning to the de-identification question, two questions of statutory scope cut across every one of the state regimes and are worth flagging together.

1. Does licensing data for free take you out of the regimes?

For most of the state data broker regimes, no. A purported “free” license usually does not remove the arrangement from scope. California defines “sale” broadly to include “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating” a consumer’s personal information to a third party “for monetary or other valuable consideration.” California courts and the state attorney general have consistently interpreted “other valuable consideration” through the lens of California’s general contract law concept of consideration – any bargained-for benefit conferred on the transferor, whether or not money changes hands. In-kind exchanges of neural data for services, joint research outputs, model access or reciprocal datasets are therefore likely to qualify as a “sale.” Connecticut takes a similar approach, defining “license” as granting access to or distributing personal data “in exchange for consideration” – the Connecticut statute expressly contemplates nonmonetary consideration. Vermont and Oregon both use “sells or licenses” without a narrower monetary limitation, and the market has consistently read those terms to reach nonmonetary bargained-for exchanges as well.

Texas is broader still. Its data broker definition captures any business entity that “collects, processes, or transfers” personal data it did not collect directly from the individual. “Transfer” does not require consideration at all, so even a genuinely gratuitous handoff of neural data to a third party can trigger the Texas regime (subject to Texas revenue and volume thresholds, discussed next). New Jersey uses “sells or licenses” without a defined monetary limit, and “licenses” in this context is likely to be read as encompassing noncash arrangements.

The one narrow off-ramp that runs through all of these regimes is a true one-way transfer of data with no benefit flowing back to the transferor – for example, a pure charitable donation of a research dataset to an academic institution with no reciprocal services, no access rights, no attribution and no other consideration. Companies should not assume that framing a license as “no fee” or “complimentary” removes it from scope.

2. Do the state data broker laws apply only to businesses with a certain amount of revenue or volume of data?

The answer depends materially on the state.

California. The data broker regime imports the CCPA’s definition of “business,” which itself has thresholds – in general terms, annual gross revenue in excess of $26,625,000; buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information. A neurotech company below all three thresholds is not a “business,” and therefore not a “data broker,” under the California regime. That said, the 100,000-consumer prong is easy to trip for consumer-facing neurotech, and the 50%-of-revenue prong bites hard for pure-play neural data licensors.
Connecticut, New Jersey, Oregon and Vermont. No revenue or data-volume thresholds.
Texas. Subject to the 50%-of-revenue and 50,000-individual thresholds described above in Model 3.

The upshot: Outside of Texas (and the narrower California “business” threshold), state data broker regimes are not size-gated. A small neurotech company licensing neural data of persons with whom it has no direct relationship can be a data broker, subject to the full compliance stack, in Connecticut, Oregon, Vermont and New Jersey. And in New Jersey, even a first-party neurotech company is regulated as a data collector regardless of size.

The de-identification question

Under every one of these regimes, data that is not identifiable to a specific person, or that has been genuinely de-identified, is out of scope. The California law excludes de-identified data from “personal information;” Connecticut’s law excludes de-identified data from “personal data;” Vermont and Oregon exclude de-identified data through parallel mechanisms; and Texas has an explicit de-identification exception. The statutory standard is broadly similar across the states: The data must not be reasonably capable of being linked to an identifiable individual, and the controller must take reasonable technical measures to prevent linkage, publicly commit not to re-identify and contractually bind recipients to the same standard.

The threshold legal question for neurotech companies pursuing a licensing model is therefore whether their neural data can be de-identified to the applicable legal standard. That question is not settled. Reasonable technical experts disagree. What follows is the best case for each position.

The argument that neural data can be de-identified (and data laws therefore do not apply)

The strongest argument that neural data can be adequately de-identified runs through a simple fingerprint analogy: A fingerprint lifted from a crime scene identifies no one on its own. It becomes identifying only when a fingerprint database exists and the lifted print can be matched against it. Neural signatures work the same way. A neural signal “lifted” from an anonymized dataset can identify a specific individual only where a reference database exists that ties known individuals to their neural signatures. That kind of reference database does not exist today for the general population, and in most licensing scenarios it does not exist for the licensed-out population either. Where the reference set does not exist, the neural signal cannot be linked to any particular person as a matter of fact, regardless of how unique it is in theory. If the reference set does exist, but is not accessible to the entity that holds the neural data, then the neural data is not identifiable from that entity’s perspective.

The statutory standards support this reading. Connecticut requires that the data “cannot reasonably be used to infer information about, or otherwise be linked to,” an identifiable individual. The CCPA requires that the data “cannot reasonably be used” to identify or associate with a consumer. Both standards are grounded in reasonableness, and reasonableness is calibrated to the state of the world today, not to speculative future capabilities. If linking a neural signal to a person requires access to a reference dataset that no one has built for the population in question, the linkage is not reasonably available, and the data satisfies the statutory de-identification test.

The technical picture also cuts more finely than the skeptics allow. Neural signatures are not stable in the way that traditional biometrics are. A fingerprint is essentially fixed for life; a neural signature varies with sleep, mood, attention, age, medication and disease state. The high identification accuracy rates in the research literature are typically achieved within a single session and cohort, on high-fidelity recordings, using algorithms tuned to the specific data. Licensed-out neural datasets can be downsampled, aggregated, cropped to short windows or transformed into derived features that discard much of the individuating detail.

In practice, de-identification measures can combine several techniques at once: removing hidden identifying tags from files (metadata scrubbing), reporting group-level figures instead of individual records (aggregation), adding small amounts of random “static” to obscure exact values (statistical noise), ensuring each described group is large enough that no one person stands out (k-anonymity-style controls), and dropping unusually rare records that would be recognizable on their own (outlier suppression). And where the underlying data is already coarse to begin with – for instance, a summary index (such as an attention or workload score) rather than a raw, moment-by-moment brain signal – the remaining risk of identifying a person can be substantially lower, and in some cases may fall below what the applicable law counts as personal or neural data.

The statutory de-identification standard also depends on business controls that neurotech companies can and do implement. Public commitments not to re-identify, contractual undertakings from downstream recipients, technical safeguards against linkage and monitoring for compliance are all feasible in commercial licensing arrangements. Where those controls are in place and the underlying data is not intrinsically identifying to the population in question, it can be said that the data satisfies the statutory de-identification test, or that it was not identifiable to start. In short, the de-identification off-ramp is available for neural data – it just requires a defensible technical basis and disciplined contractual architecture, not a blanket assumption.

The arguments that neural data cannot be de-identified (and data laws therefore apply)

The identifiability skeptics rest on a growing body of neuroscience research suggesting that neural signatures function as biometric fingerprints. A widely-cited 2015 fMRI study identified individuals from their whole-brain functional connectivity patterns with 93 – 94% accuracy in cohorts drawn from the Human Connectome Project (Finn et al., Functional Connectome Fingerprinting: Identifying Individuals Using Patterns of Brain Connectivity, 18 Nature Neuroscience 1664 (2015)). Each target scan was matched to the most similar entry in a database of prior scans from the same subjects, so the result speaks to the risk of linking a new scan to an existing record rather than to identification from a neural recording alone.

A 2014 EEG study achieved 100% accuracy in matching people to their brain recordings by looking at how different parts of the scalp “talked to” one another at specific frequencies, rather than at any single sensor on their own (La Rocca et al., Human Brain Distinctiveness Based on EEG Spectral Coherence Connectivity, 61 IEEE Transactions on Biomedical Engineering 2406 (2014)). As with the fMRI work described above, that accuracy was measured against a closed reference set – each new recording was matched to the most similar entry in a database of prior recordings from the same people – so the result speaks to the risk of linking a new scan to an existing record rather than to identifying a stranger from a brain recording alone. Later reviews of the EEG-identification literature report similar or slightly lower accuracy figures, typically in the high-80s to high-90s, across a range of methods and datasets.

And identification does not require long recordings. A 2021 MEG study reported that just thirty seconds of resting-state brain activity was enough to correctly pick a participant out of a closed cohort roughly 84% of the time – compared with about 95% when longer segments were used (da Silva Castanheira et al., Brief Segments of Neurophysiological Activity Enable Individual Differentiation, 12 Nature Communications 5713 (2021)).

There is also a distinct identifiability pathway that has nothing to do with neural fingerprinting. In speech and communication brain-computer interfaces (BCIs), the decoded output is not a signal signature but the user’s own words. Everyday speech and messaging routinely surface autobiographical detail – the speaker’s own name, references to family members, an employer or workplace, a medical diagnosis, or other personal facts – that identifies the person on the face of the transcript, without any comparison to a reference dataset. For that class of neural product, the identifying information is embedded in the content itself.

That distinction – between recognizing someone by the pattern of their brain activity and identifying them from what they said – is one instance of a broader point that the current debate tends to skip past: Not all “neural data” is the same thing, and different forms of it carry very different re-identification risk. A raw recording taken directly from the electrodes; a set of summary measurements calculated from that recording (for example, how much activity is present in different frequency bands, or how strongly different brain regions move together); the trained software model that translates brain activity into speech, movement or a category label; the decoded output itself (the actual text, speech or cursor movement the system produces); and a high-level conclusion drawn from the data (for example, a single “alertness” or “focus” score) each sit at a different point on the identifiability scale, even when they all come from the same recording session. What is enough to strip identifying information out of an alertness score will not be enough for a raw recording, and the reverse is equally true. The same regulated term – “neural data” – is doing very different work as the information moves through these stages, and any workable de-identification analysis has to look at the specific form at issue, not just at the category label.

The intrinsic uniqueness of neural data has three consequences under the statutory de-identification tests. First, small datasets are trivially re-identifiable within their own populations: A neurotech company holding neural recordings from 200 research subjects may be able to associate neural data with specific individuals without any external reference. Second, reference datasets are actively being built. Large-scale consumer neurotech products, invasive BCI companies and academic-industrial collaborations are generating neural datasets at scale, and open science initiatives are publishing sizable reference corpora, which means that even a “bare” neural sample that is not identifying today may be identifiable tomorrow through comparison to a growing reference base. Third, neural data reveals sensitive attributes – cognitive state, health conditions, emotional response profiles – that themselves can be linked with other data to re-identify a specific person, especially in small populations with distinctive clinical characteristics.

Finally, the regulatory apparatus is unusually demanding on the de-identification side. It requires reasonable technical measures to prevent re-identification, a public commitment not to re-identify, contractual downstream controls that flow those obligations to every recipient and ongoing monitoring of the recipient’s compliance. Neural data licensing arrangements need to be designed to meet those requirements in practice, particularly the downstream contractual and monitoring components. On the other hand, under the California law for example, if data de-identification has rid a business of any of the personal identifiers that consumers can use to request data brokers to delete their data, such as email addresses and phone numbers, the data broker will be hard-pressed to delete data even in the face of a deletion request, possibly making it impossible for the business to comply with the law.

Where this lands

Reasonable minds will continue to differ, and the answer for any particular licensing arrangement is fact specific. It depends on the type of neural data – identification accuracies vary meaningfully across modalities, and EEG, fMRI, MEG and fNIRS each carry different identifiability profiles even before considering feature engineering, so the answer for a raw EEG recording is not the answer for a downsampled fMRI feature vector. It also depends on the amount of neural data per subject. The size and distinctiveness of the licensed-out population, the availability of a reference dataset that could support linkage, and the technical and contractual architecture the licensor puts around the data round out the analysis. What is clear is that a blanket “we’ll de-identify” strategy is not a substitute for the analysis. Companies pursuing a de-identification path should pressure-test it with both technical experts and privacy counsel – dataset by dataset, modality by modality and duration by duration – and paper the required public commitments, contractual controls and monitoring practices before treating the licensed data as out of scope.

A note on the parallel state consumer privacy law regimes

Separate from the state data broker registration laws discussed above, the sibling comprehensive state consumer privacy laws in 23 states will apply independently to any business that qualifies as a “controller” of neural data, and meets the triggering metrics of the law, meaning a business that (alone or jointly with others) determines the purposes and means of processing that neural data. “Processing” in each of those statutes is defined broadly to include the collection, use, storage, disclosure, sale and licensing of personal data, so licensing neural data downstream is a processing activity that a controller performs. Controllers of neural data are subject to notice, consent, purpose-limitation, minimization, sensitive-data opt-in and data protection assessment obligations under those laws (subject to the state-by-state applicability thresholds), regardless of whether the business is also a “data broker” under the state’s data broker regime. In short, a neurotech company that stays below a data broker regime’s coverage line can still be a controller of neural data subject to the parallel privacy law’s substantive obligations.

Practical takeaways for neurotech companies

Map your data flows against each state’s definitional model. Identify every neural dataset your company licenses, sells or grants access to, and separate them into datasets about individuals with whom you have a direct contractual or similar relationship and datasets about individuals with whom you do not. Also, identify the states of residence of the individuals whose neural data is to be licensed, so that the applicable laws’ requirements can be met.
Do not rely on de-identification as an off-ramp without stress-testing it. Confirm the type of neural data you are licensing, the size and distinctiveness of the licensed-out population, whether a reference dataset exists (or is plausibly being built) that could support linkage, and whether your technical and contractual controls meet the applicable statutory standards. Paper the public commitments and downstream contractual undertakings the statutes require.
Choose your regulatory regime. If your business has a choice between HIPAA and the state data law regime, examine both carefully, choose which regime best meets your data needs, and architect your way of doing business to fit into, and comply with, your preferred regulatory regime.

DOL Finalizes Rescission of EO 11246 Affirmative Action Rules, Narrows Section 503, Updates VEVRAA Thresholds

Thu, 24 Sep 2026 07:00:00 Z

On August 21, 2026, the Department of Labor (DOL) published three final rules in the Federal Register modifying federal contractors’ affirmative action obligations: formally rescinding the implementing regulations for Executive Order (EO) 11246, following EO 11246’s rescission last year; narrowing Section 503 of the Rehabilitation Act of 1973 to align with applicable law and recent EOs; and making technical changes to the Vietnam Era Veterans’ Readjustment Assistance Act (VEVRAA), including updating jurisdictional thresholds.

Rescission of EO 11246 implementing regulations – effective October 26, 2026

EO 11246 has long required covered contractors to maintain written affirmative action programs (AAPs) addressing race- and sex-based criteria. Following EO 11246’s rescission in January 2025, the DOL now formally rescinded the implementing regulations for EO 11246, which include placement goal and utilization analysis requirements for nonconstruction contractors. The agency cited additional rationales for the rescission, including eliminating legal vulnerabilities, improving efficiency of the government contracting process, decreasing employer burden and aligning the regulations with recent EOs.

Section 503 regulations modifications – effective September 21, 2026

The rule makes the following key changes to contractors’ disability affirmative action obligations under Section 503 of the Rehabilitation Act:

Eliminates the requirement that contractors invite applicants and employees to self-identify their disability status.
Rescinds the 7% utilization goal for individuals with disabilities and the corresponding utilization analyses.
Updates the Section 503 coverage threshold from $15,000 to $20,000 for inflation.
Removes references to EO 11246 and adds administrative procedures at 41 CFR Part 60-30, effective December 21, 2026.

The DOL stated the modifications fulfill EO 14219’s mandate to rescind regulations not authorized by clear statutory authority. The agency noted that the disability self-identification requirement and utilization goal were inconsistent with the Americans with Disabilities Act (ADA), and that the utilization analysis requirements were “now unworkable” given their dependence on the revoked EO 11246.

Importantly, the rule does not change reasonable accommodation requirements or the obligation to develop and maintain an AAP as to individuals with disabilities or protected veterans. Nondiscrimination provisions also remain intact, along with outreach requirements (Subpart C), complaint procedures (Subpart D) and most recordkeeping requirements.

VEVRAA regulations revisions – effective September 21, 2026

The VEVRAA revisions are modest. They remove cross-references to EO 11246, relocate administrative enforcement procedures to 41 CFR Part 60-300, and codify the coverage threshold increase from $150,000 to $200,000 (which had already been implemented in October 2025).

Next steps

The three rules have different effective dates and should be tracked accordingly. By September 21, 2026, contractors should discontinue use of the CC-305 disability self-identification form and review policies and HR systems for compliance with remaining disability affirmative action obligations. By October 26, 2026, contractors should retire any remaining race- and sex-based AAP obligations. Contractors should also consult employment counsel regarding previously collected self-identification data and remain mindful that Title VII, the ADA, and applicable state and local antidiscrimination laws continue in full force. VEVRAA obligations remain largely unchanged.

If you have any questions about these developments, please reach out to a member of the Cooley employment team.

Permission to Innovate: SEC Carves Out Path for On-Chain Stock Trading

Tue, 22 Sep 2026 15:00:00 Z

Temporary relief creates a notice-based pathway for qualifying tokenized securities venues and certain AMM liquidity providers while the SEC considers permanent rules

Bottom line: The SEC is opening a controlled pathway for secondary trading of tokenized US equities through permissioned automated market makers, but the relief is temporary and conditional.

Introduction and policy context

On September 17, 2026, the Securities and Exchange Commission (SEC) issued the long-awaited “Innovation Exemption,” an order under Section 36(a)(1) of the Securities Exchange Act of 1934 granting two forms of temporary, conditional relief. The first exempts qualifying tokenized securities venues (TSVs) from the definition of “exchange,” while the second exempts qualifying liquidity providers, termed “Covered Firms,” from the definition of “dealer” with respect to specified activity in a TSV’s automated market maker (AMM) liquidity pool. The relief expires five years after its publication, subject to earlier modification by the SEC, and the SEC has solicited comment on whether and how to revise, extend or make it permanent.^{^[1]}

The Innovation Exemption arrives at a pivotal moment. Just two days before the order was issued, the Senate rejected cloture, 49 – 50, on the motion to proceed to HR 3633, the CLARITY Act. In an accompanying statement, SEC Chair Paul Atkins expressly linked the two events, describing the exemption as a “bridge toward durable rulemaking.”^{^[2]} The implication is clear: With market-structure legislation stalled, the SEC intends to use rulemaking, exemptive orders and staff-level relief to facilitate on-chain securities activity within its existing authority. Commissioner Hester Peirce struck a similar chord, emphasizing that the exemptions should permit experimentation, self-custody and greater investor autonomy while generating the practical experience needed to inform permanent rules. Commissioner Mark Uyeda likewise characterized the order as a controlled, data-producing experiment designed to advance technology-neutral rulemaking without compromising investor protection or market integrity.^{^[3]}

Notably, the order comes on the heels of the SEC’s separate June 2026 proposal to rescind Regulation National Market System (NMS) rules 611 and 610(e), reinforcing the view that the existing NMS framework may warrant broader structural reform.^[4] The SEC’s central premise is that the NMS framework is fundamentally incompatible with AMM-based trading – including because pool-ratio pricing may not accommodate Rule 611’s trade-through requirements; continually shifting pool compositions and asset allocations complicate Rule 602(a)’s quotation obligations; and AMMs may quote at increments finer than Rule 612 permits. At the same time, the order acknowledges that the transaction, price movement and participant interaction transparency provided by AMMs may potentially obviate the need for certain existing regulations, and it identifies a range of potential benefits that AMM trading can provide for market participants, including self-custody, around-the-clock trading, fractional ownership, near-instantaneous settlement, improved sanctions screening, enhanced auditability and recordkeeping, lower operating and transaction costs, and reduced information asymmetries.^{^[5]}

The order also builds on a series of recent SEC staff statements addressing securities intermediaries and the trading of tokenized securities. First, the December 2025 custody statement identified conditions under Rule 15c3-3(b)(1) for broker-dealer physical possession or control of crypto asset securities. Second, the January 2026 statement set out a taxonomy of tokenized securities, including the distinction between issuer-sponsored and third-party-tokenized securities; further distinguished custodial third-party tokenization from synthetic third-party products; and confirmed that tokenization changes form, but not legal status. Third, the April 2026 interface statement provided a conditional, time-limited staff position for certain self-custodial interfaces used to prepare crypto asset securities transactions. Together, these statements address custody, product characterization and interfaces; the order addresses venues and liquidity providers.^{^[6]}

It is also noteworthy how the order marks a sharp departure from the prior commission’s approach. In 2022, the SEC proposed amendments to Exchange Act Rule 3b-16 that would have expanded the definition of “exchange” to encompass systems using non-firm trading interest and “communication protocols” – capturing a broad range of blockchain and decentralized finance systems, among them the very AMMs that the Innovation Exemption now seeks to accommodate. That proposal drew extensive comment and calls for clarification and was formally withdrawn effective June 17, 2025.^{^[7]}

TSV exemption from definition of ‘exchange’

The order defines a “TSV” as an organization, association or group of persons that brings together buyers and sellers of “Tokenized NMS Stock” by providing one or more AMM liquidity pools for permissioned participants and setting standards for access. The definition is functional: a website, browser extension or other software application that enables a participant to enter, display or agree to trade terms may itself form part of the TSV.^{^[8]}

A TSV that satisfies the order’s conditions is exempt from the definition of “exchange” for Exchange Act purposes and is therefore not required to register as a national securities exchange or operate under the alternative trading system (ATS) exemption. Because the TSV also falls outside the definitions of “trading center” and “market center” under Regulation NMS, the trade-through, access and other provisions of Regulation NMS applicable to those categories do not apply.^{^[9]}

The Innovation Exemption incorporates extensive guardrails designed to ensure investor protection, maintain fair, orderly, and efficient markets, and facilitate capital formation. These include:

Limited eligible securities and issuer objections. Eligible Tokenized NMS Stock encompasses both issuer-sponsored stock and third-party-tokenized stock, but excludes synthetic linked securities, security-based swaps, rights and warrants. Before listing a third-party-tokenized security, the TSV must notify the issuer of the underlying stock and allow at least 30 calendar days to elapse following receipt. A timely issuer objection bars trading, and the TSV must publicly disclose the objection within five business days.^{^[10]} The offshore issuance and trading of synthetic linked securities without issuer consent has generated significant recent controversy; the SEC accordingly scoped the order narrowly to exclude synthetic instruments and to afford issuers an objection right with respect to third-party tokenization of their stock.
Equivalent holder rights. The TSV must verify that each Tokenized NMS Stock confers the same rights and privileges as the equivalent traditional share, including economic, dividend, voting and liquidation rights. For third-party-tokenized stock, related proxy materials and issuer communications must be made available at no cost to the issuer or its shareholders. Notably, the order does not expressly require that the Tokenized NMS Stock be convertible or redeemable into a conventionally recorded share.
Permitted pairs. Tokenized NMS Stock may be paired against another Tokenized NMS Stock, a nonsecurity crypto asset (including a payment stablecoin) or a tokenized money market fund. A nonsecurity crypto asset or tokenized money market fund may trade on the TSV only when directly paired with a Tokenized NMS Stock.
Secondary trading only; registration and participant status unchanged. A TSV may facilitate only secondary trading; primary issuances and initial offerings of securities are not permitted. All offers and sales of Tokenized NMS Stock on a TSV must be registered or exempt under the Securities Act, and the TSV Exemption does not alter the registration status or other regulatory obligations of TSV Participants.^{^[11]}
Permissioned access, US nexus and eligibility. Only verified or credentialed participants and wallet addresses may trade on a TSV, though participation is not limited to institutions or registered entities. Where a third-party provider performs permissioning services on a TSV’s behalf, the TSV retains responsibility for compliance. The TSV itself must be a US person and must comply with applicable Office of Foreign Assets Control (OFAC) sanctions requirements. A TSV generally may not rely on the exemption if it includes a person subject to statutory disqualification, unless the SEC or the relevant self-regulatory organization has approved that person’s continued participation.^{^[12]}
Volume limits and broader market controls. The order categorizes Tokenized NMS Stock into two tiers that mirror the established Limit Up-Limit Down Plan and sets separate symbol and volume caps for each. A TSV may trade up to 75 Tier 1 Tokenized NMS Stock symbols, with volume in each capped at 0.25% of its prior-month average daily share volume, and up to 250 Tier 2 Tokenized NMS Stock symbols, with volume in each capped at 2.5%. Affiliated TSVs must aggregate both their trading volume and their symbol counts. These differentiated thresholds are designed to reflect liquidity differences across stocks, permit meaningful experimentation, and contain potential price dislocations or other spillovers between tokenized and conventional markets during the data-gathering period. Enforcement follows a stepped approach: The first time a TSV exceeds a volume threshold for a given stock, no action is required beyond ensuring future compliance; any subsequent breach triggers an immediate three-month pause in trading of the affected security.^{^[13]}
Transparency and recordkeeping. A TSV must make US-dollar-denominated transaction data – including symbols, price, size, time and direction – freely and publicly available in machine-readable format, updated within 10 minutes of each transaction. The TSV must also maintain comprehensive books and records covering, among other things, trading interest, execution details, permissioning information, fees, stoppages and daily share volume. In addition, the TSV must immediately notify “TSV Participants,” and promptly notify the SEC, of any event that has a significant impact on the operation of the TSV or on its participants.
Stoppages. Although a TSV may offer around-the-clock trading, it must stop trading in a Tokenized NMS Stock concurrently with any halt or suspension of the underlying stock on its primary listing exchange and immediately notify TSV Participants of the stoppage.
No leverage. A TSV may not borrow securities or nonsecurity crypto assets (whether on a secured or unsecured basis), directly or indirectly hypothecate or arrange for the hypothecation of any such assets, or extend credit to a TSV Participant for the purpose of purchasing Tokenized NMS Stock.
Built on public infrastructure. The distributed ledger applications (i.e., smart contracts) used by a TSV must be auditable, publicly available and deployed on a public, permissionless distributed ledger – meaning anyone can read or write to the ledger without authorization. This condition is designed to enhance transparency, support market integrity, and reduce systemic and operational risk by enabling TSV participants and third parties to inspect the applications, audit how trades are effected, report vulnerabilities and better assess the risks of trading on a particular TSV.^{^[14]}

Reliance on the TSV Exemption is notice-based and does not require affirmative SEC approval. It creates no presumption that the TSV would otherwise constitute an “exchange.” In order to qualify for the TSV Exemption, the TSV must publish a detailed notice on its website at least 30 calendar days before commencing operations and, within one business day after publication, notify the SEC by email providing contact information and the notice URL. The notice must disclose, among other things, that the TSV is not registered with the SEC, is not subject to Regulation NMS, and is not subject to the fair-access requirements applicable to registered exchanges and certain ATSs. Once operational, the TSV must update its notice within five business days for new or ceased listings, volume-related pauses, issuer objections and material inaccuracies; 20 calendar days before material operational changes; and within 30 calendar days after quarter-end for nonmaterial changes.^{^[15]}

Covered firm exemption from definition of ‘dealer’

The order also establishes the “Covered Firm Exemption,” which provides temporary, conditional relief from the definition of “dealer” under Section 3(a)(5) of the Exchange Act for certain AMM liquidity providers. As a threshold matter, the SEC recognizes that merely supplying liquidity to an AMM pool does not, standing alone, constitute dealer activity; absent additional indicia, an AMM liquidity provider would ordinarily be characterized as a “trader” rather than a “dealer.”[16] The analysis may become less clear cut, however, where a provider also quotes prices to customers, exercises control over pricing or inventory, enters into market-making arrangements, or enters into agreements, arrangements, or understandings to provide committed capital.^{^[17]}

The Covered Firm Exemption is therefore designed to provide additional certainty for liquidity providers that deploy proprietary capital into Tokenized NMS Stock in an AMM pool operating under the TSV Exemption and that may engage in those additional activities. To qualify, a Covered Firm must: trade solely for its own account; refrain from holding customer assets; maintain records documenting its financial resources, liquidity commitments, agreements and compensation arrangements; disclose on any public-facing website that it is not a registered broker-dealer and may receive liquidity incentives; notify the SEC in writing regarding its business model, controls, arrangements and compensation; confirm that neither it nor its affiliates is subject to statutory disqualification; and consent to SEC requests for information. As with the TSV Exemption, the notification is notice-based and does not require affirmative SEC approval, and reliance creates no presumption that the firm would otherwise be a dealer.^{^[18]}

What the order does not cover

Notwithstanding the breadth of the relief granted, the Innovation Exemption leaves several significant areas of securities regulation undisturbed. The following obligations and limitations remain fully in effect and are not modified, waived or otherwise affected by the order:

Antifraud and anti-manipulation laws. The order provides no relief from Section 10(b), Rule 10b-5, insider-trading restrictions, or any other federal antifraud or anti-manipulation provision. A TSV must also disclose whether and how it monitors for spoofing, wash trading, front-running, pump-and-dump schemes and other manipulative or abusive conduct.^{^[19]}
No broader registration safe harbor. The relief is limited to the exchange status of a qualifying TSV and the dealer status of a qualifying Covered Firm. It does not exempt securities offerings from Securities Act registration, provide relief under the Investment Company Act, determine the regulatory status of token issuers or TSV Participants, or extend to securities activity conducted outside the TSV.
Broker registration unaffected. The Covered Firm Exemption applies solely to the definition of “dealer.” Any person effecting securities transactions for others, soliciting transactions, receiving transaction-based compensation or otherwise acting in a broker capacity must independently assess its broker-dealer registration obligations. The April 2026 interface statement offers only a narrow, time-limited staff position for qualifying self-custodial interfaces that prepare user-directed transactions and satisfy detailed conditions. It does not extend to interfaces that negotiate transaction terms, solicit specific securities transactions, make recommendations or provide advice, arrange financing, process trade documentation, conduct independent asset valuations, handle user assets, execute or settle transactions, or take or route orders.^{^[20]} Registered broker-dealer participants remain subject to all applicable SEC and FINRA requirements; the order solicits comment on whether additional Regulation NMS relief may be warranted but grants none.
Model- and product-specific relief. The exemption does not extend to primary offerings, synthetic tokenized products, unrestricted securities trading, leveraged activity or every on-chain trading model.

The Innovation Exemption represents a welcome and meaningful step toward enabling experimentation and innovation in the trading of tokenized securities, but significant regulatory work remains – both in refining the contours of this relief and in establishing the durable, comprehensive framework that market participants will ultimately need. Peirce separately stated that the order is “not about decentralized finance,” expressed the view that truly decentralized, permissionless systems may not require the relief, and invited market participants operating under alternative models to engage directly with the SEC.^{^[21]}

^{^[1]} SEC, Order Granting Temporary Conditional Exemptive Relief, Exchange Act Release No. 34-106402, at 1 – 7, 57, 60 (Sept. 17, 2026) (the “order”); 15 USC § 78mm(a)(1).

^{^[2]} Paul S. Atkins, Chairman, SEC, Statement on the Innovation Exemption: A Bridge Toward Durable Rulemaking (Sept. 17, 2026); US Senate, Roll Call Vote No. 234 (Sept. 15, 2026).

^{^[3]} Hester M. Peirce, Commissioner, SEC, Slumber Number: Innovation Exemption Statement (Sept. 17, 2026); Mark T. Uyeda, Commissioner, SEC, Statement on the Innovation Exemption (Sept. 17, 2026).

[4] SEC, “The Trade-Through Rule and Locked and Crossed Markets Provisions of Regulation NMS,” Exchange Act
Release No. 34-105655, 91 Fed. Reg. 36,656 (June 17, 2026) (proposed June 11, 2026).

^{^[5]} Order at 11 – 14, especially 12 – 13 (discussing Rules 602(a), 611, and 612, the potential redundancy of certain regulations, and potential benefits of TSVs and distributed-ledger technology).

^{^[6]} SEC divisions of Corporation Finance, Investment Management, and Trading and Markets, Statement on Tokenized Securities (Jan. 28, 2026); SEC Division of Trading and Markets, Statement on the Custody of Crypto Asset Securities by Broker-Dealers (Dec. 17, 2025); SEC Division of Trading and Markets, Staff Statement Regarding Broker-Dealer Registration of Certain User Interfaces Utilized to Prepare Transactions in Crypto Asset Securities (Apr. 13, 2026). Staff statements have no legal force or effect and do not alter applicable law.

^{^[7]} SEC, Amendments Regarding the Definition of “Exchange” and Alternative Trading Systems (ATSs) That Trade US Treasury and Agency Securities, National Market System (NMS) Stocks, and Other Securities, Exchange Act Release No. 34-94062, 87 Fed. Reg. 15,496 (Mar. 18, 2022); SEC, Supplemental Information and Reopening of Comment Period for Amendments Regarding the Definition of “Exchange,” Exchange Act Release No. 34-97309, 88 Fed. Reg. 29,448 (May 5, 2023); SEC, Notice of Withdrawal of Proposed Regulatory Actions, Release Nos. 33-11377, 34-103247, IA-6885, and IC-35635 (June 12, 2025) (withdrawal effective June 17, 2025).

^{^[8]} Order at 1 – 3, 7 – 10 and n.28. By comparison, the prior Rule 3b-16 proposal would have replaced “orders” with the broader concept of “trading interest” and added “communication protocols” as an example of an established, nondiscretionary method, potentially reaching systems such as AMMs. See Rule 3b-16 Fact Sheet.

^{^[9]} Order at 14 – 15.

^{^[10]} Order at 8, 21 – 23; SEC divisions of Corporation Finance, Investment Management, and Trading and Markets, Statement on Tokenized Securities (Jan. 28, 2026) (distinguishing custodial third-party tokenization from synthetic linked securities and security-based swaps); Atkins, “Bridge Toward Durable Rulemaking” (identifying “No Synthetics” and “Issuers Can Object” as key conditions). The order notes that issuers may be concerned about shareholder-register administration, price dislocation and adverse effects on the underlying stock. Order at 21 – 22.

^{^[11]} Order at 15 – 17, 22 – 23. The order also does not provide Investment Company Act relief. Id. at 7 n.22.

^{^[12]} Order at 16 – 19. The exemption is unavailable if an organization, association or person within the TSV group is subject to statutory disqualification, unless the SEC or relevant self-regulatory organization has permitted continued participation. Id. at 16. Permissioned trading may be deployed on a public, permissionless blockchain. Id. at 18 n.55.

^{^[13]} Order at 23 – 28. The SEC used the established Limit Up-Limit Down tiers, set separate symbol and volume limits to reflect liquidity differences, and explained that the limits are intended to reduce the risk that price dislocations in tokenized stock affect the broader NMS market while still allowing meaningful trading. The stepped approach applies to volume breaches, not symbol-limit breaches; affiliated TSVs must pause the same security after a subsequent breach. Id. at 26 – 28 and nn.74 – 75.

[14] Order at 10 n.31, 18 – 19 and nn.54 – 55. Required applications must be auditable, public and deployed on a public, permissionless ledger, but access to the TSV remains permissioned. Public deployment is intended to facilitate independent review, vulnerability reporting, transparency, market integrity and operational resilience. A TSV remains responsible for a third-party permissioning provider.

^{^[15]} Order at 13 n.37, 19 – 21, 28 – 47. The public notice must cover operations, access standards, assets, technology, conflicts, fees, risks, safeguards, market oversight and trading stoppages. Material changes require 20 calendar days’ advance notice; nonmaterial changes must be reported within 30 calendar days after quarter-end. Id. at 20 – 21.

[16] Section 3(a)(5)(B) excludes from “dealer” a person that buys or sells securities for its own account, individually or in a fiduciary capacity, but not as part of a regular business – the so-called “trader” exception. Dealer status remains a facts-and-circumstances inquiry. Order at 52 – 54 and nn.111 – 12; 15 USC § 78c(a)(5)(B).

^{^[17]} Order at 52 – 54.

^{^[18]} Order at 54 – 57. The Covered Firm Exemption runs in parallel with the TSV Exemption and expires on September 17, 2031. Id. at 55, 57.

^{^[19]} Order at 15 – 16, 45 – 46, 55. The order requires disclosure of whether a TSV monitors for specified forms of fraudulent or manipulative activity but does not itself mandate a particular surveillance model. Id. at 45.

[20] SEC Division of Trading and Markets, Staff Statement Regarding Broker-Dealer Registration of Certain User Interfaces Utilized to Prepare Transactions in Crypto Asset Securities (Apr. 13, 2026). The statement is a time-limited staff position under Section 15 and has no legal force or effect.

^{^[21]} Peirce, Slumber Number. Peirce’s statement reflects her individual views and is not an additional condition of the order.

FTC Challenges Interlock Tied to Beretta-Ruger Minority Investment

Tue, 22 Sep 2026 07:00:00 Z

Last week, the Federal Trade Commission (FTC) announced another “interlocking directorate” enforcement action, demonstrating the antitrust agencies’ continued aggressive enforcement of Section 8 of the Clayton Act. The proposed consent order resolves antitrust allegations arising from Beretta Holding’s minority acquisition of shares in Sturm, Ruger & Co. The order settles allegations that the agreement, which allowed Beretta to appoint two members to Ruger’s board of directors, would create an illegal interlocking directorate since the parties are direct competitors in the production and sale of firearms. This action follows the FTC’s announcement that three individuals resigned from the board of Sevita Health in September 2025 due to FTC scrutiny and recent unconfirmed reports that the Department of Justice (DOJ) is investigating a venture capital firm for potential Section 8 violations.

In the Beretta-Ruger matter, the FTC alleged that under the parties’ agreement, Beretta, a subsidiary of Upifra, agreed to increase its stake in Ruger to as much as 25% of Ruger’s outstanding shares. In exchange, Beretta obtained contractual board designation rights: The agreement provided that Ruger’s board “shall” appoint two directors sourced by Beretta to the board, with those directors included on Ruger’s slate of nominees for the 2027 and 2028 annual meetings.

Section 8 of the Clayton Act is a strict liability statute that prohibits the same person from serving as an officer or director of two competing companies, known as an interlocking directorate, regardless of whether the arrangement has any actual anticompetitive effect. The antitrust agencies have interpreted the statute, which refers to the same “person” sitting on the board of competitive corporations, to extend to “representatives” of the relevant corporations.

The rule applies when the companies compete with one another and exceed certain statutory size thresholds, unless one of the statute’s de minimis exceptions applies. Those exceptions generally exempt interlocks where the companies’ overlapping sales are relatively small, either in absolute terms or as a percentage of total sales. Section 8 also provides a one-year grace period to unwind an interlock that becomes unlawful due to changed circumstances, such as a transaction that increases competitive sales above the relevant threshold.

The FTC’s complaint alleged that this arrangement would create an illegal interlocking directorate in violation of Section 8 of the Clayton Act and an unfair method of competition under Section 5 of the FTC Act. According to the complaint, Beretta and Ruger are horizontal competitors across multiple lines of firearms, which the FTC alleged Ruger had acknowledged in its securities filings.

The FTC took particular issue with the fact that, although the agreement nominally required Beretta’s board designees to be “independent,” it lacked robust independence safeguards and permitted waiver of certain independence requirements, potentially allowing Beretta personnel or other non-independent individuals to sit on Ruger’s board. Of note, the FTC did not allege that Beretta intended to appoint an officer or director of Beretta to the Ruger board – the apparent focus was on the alleged lack of “fulsome requirements” on independence for any director. Also of note, the order does not eliminate the appointment right altogether.

The proposed consent order permits the transaction to proceed but imposes structural safeguards on Beretta’s board rights, including that Beretta:

May not appoint, nominate or otherwise cause any person to be appointed or nominated to Ruger’s board unless that person is a genuinely “Independent Director,” as defined to exclude anyone with a “Material Relationship” with Beretta or its parent.
Must give the FTC at least 15 days’ advance written notice before any board appointment, designation, nomination or election involving Ruger.
May not hire or enter into any financial or other relationship with an independent director it nominates that would compromise that director’s fiduciary duties, or that would facilitate the flow of Ruger’s nonpublic information to Beretta, for one year after that director leaves the Ruger board.
May not otherwise seek or receive Ruger’s nonpublic information from any director it nominates.

The order runs for five years, with interim and annual compliance reporting obligations, and requires Beretta to circulate the order to new board members and officers on an ongoing basis.

Why this matters

The enforcement action extends beyond officers or directors of competing corporations to appointed “representatives” and requires that those representatives be “independent.” The FTC scrutinized the substance of the independence protections in the agreement, not just the label. Contractual board rights that merely describe designees as “independent,” without a robust definition and without limits on waiver, will not insulate an interlocking directorate arrangement between competitors from scrutiny.
The current administration has shown it is broadly open to remedies, including Section 8 enforcement. Often companies remedy interlocking directorate concerns by having the offending director step down from the relevant board, but without signing a consent. Here, the FTC required a consent order, but the order does not block the appointment power outright. The FTC’s consent order provides a framework for parties considering investments in competitors, including independence requirements, information-sharing restrictions and a cooling-off period for departing directors.
The FTC is prepared to use its administrative complaint and consent order process to address board interlocks proactively, before they are ever seated. The FTC press release announcing the Beretta enforcement action stated, “This latest enforcement action serves as a warning that the FTC will take action to prevent anticompetitive board of director overlaps between competitors.”
Building on increased enforcement activity in the Biden administration, the current administration has also been focused on interlocking directorate issues, and Section 8 enforcement remains a priority. In announcing the September 2025 Sevita enforcement action that resulted in three individuals resigning from the Sevita Health board, the FTC noted, “We are committed to enforcing the Clayton Act’s prohibition on interlocking directorates, which risk suppressing competition.” This action follows attention from the DOJ and FTC to interlocking directorates, including a wave of board resignations obtained by the DOJ in 2022 and 2023 without formal litigation. Given this continued scrutiny, it is important for companies to ensure that their boards comply with Section 8, including reviewing board memberships when board members are added as a result of new investments.

Out With the Old: SEC Proposes to Trim Long-Standing Proxy Requirements

Tue, 22 Sep 2026 07:00:00 Z

On September 16, 2026, the Securities and Exchange Commission (SEC) proposed amendments intended to modernize several proxy solicitation rules under Regulation 14A of the Securities Exchange Act of 1934, as amended (Exchange Act), by eliminating the delivery deadline that applies when documents are incorporated by reference into a proxy statement (or Form S-4/F-4 prospectus), eliminating the requirement to file soliciting material for certain exempt solicitations, shortening the minimum broker search period for proxy solicitations and eliminating the requirement to deliver an annual report to security holders (proxy solicitation proposal). These changes eliminate or shorten fixed timing deadlines and duplicative filing requirements that the SEC views as outdated in light of EDGAR access and electronic communications.

The same day, the SEC also proposed separate amendments that would eliminate the federal rule allowing shareholders to include their proposals in a company’s proxy statement (Exchange Act Rule 14a-8) and would broaden companies’ ability to exercise discretionary voting authority on timely received shareholder proposals submitted outside of the Rule 14a-8 process (Exchange Act Rule 14a-4(c)). The proposing release raises distinct and significant questions of its own, including the shift of shareholder proposal rights to state law and company bylaws, and is addressed separately in our September 17 alert on that topic – SEC Proposes Rescission of Rule 14a-8: What Comes Next?

Comments on the proxy solicitation proposal and proposal to rescind Exchange Act Rules 14a-8 and 14a-4(c) are due on or before November 20, 2026.

At a glance: Current framework versus proposed changes

The proxy solicitation proposal would make several changes as follows:

Eliminate minimum delivery period for proxy statements (or Form S-4/F-4 prospectuses) incorporating documents by reference Schedule 14A (Note D.3); Forms S-4/F-4
Current framework	Proposed change
A proxy statement (or Form S-4/F-4 prospectus) that incorporates information by reference generally must be sent to shareholders at least 20 business days before the meeting	Eliminate the 20-business-day minimum delivery period entirely, on the rationale that the incorporated filings are readily accessible on EDGAR
Eliminate ‘Notice of Exempt Solicitation’ requirement Rule 14a-6(g)
Current framework	Proposed change
Shareholders beneficially owning more than $5 million of a company’s securities at the start of a written exempt solicitation must file a “Notice of Exempt Solicitation” on EDGAR	Rescind Rule 14a-6(g) in full, eliminating both the mandatory notice for large shareholders and the practice of voluntary notices by shareholders with beneficial ownership below the threshold
Shorten broker search period Rule 14a-13
Current framework	Proposed change
A company must commence its broker search – identifying how many sets of proxy materials record holders must forward to beneficial owners – at least 20 business days before the meeting’s record date¹	Shorten the minimum broker search period to five business days, citing technological advances that the SEC notes can now often be completed in as few as three days
Eliminate annual report to security holders and stock performance graph Rule 14a-3; Item 201(e) of Regulation S-K
Current framework	Proposed change
Companies electing directors must accompany or precede the proxy statement with a separate annual report to shareholders, including a stock performance graph²	For companies with a Form 10-K already on file, eliminate the separate annual report and stock performance graph requirements given their substantial overlap with Form 10-K disclosure
Addition of cover page contact information Schedule 14A/14C cover pages
Current framework	Proposed change
No requirement to identify a company representative or contact information on the cover page	Require Schedule 14A/14C cover pages to identify a company representative, including that person’s contact information – an approach similar to that taken with registration statements under the Securities Act of 1933, as amended

Why this matters: A consistent theme of technology-driven modernization

The proxy solicitation proposal is perhaps best understood as part of a broader and consistent pattern under the current SEC administration to revisit disclosure and delivery requirements designed for a paper-based world, and to recalibrate such requirements to match how investors and market participants share and process information today, primarily through EDGAR and electronic channels.³ Several recent, related developments illustrate the same underlying logic:

Tender offer timing and dissemination methods. In April 2026, the SEC’s Division of Corporation Finance (Corp Fin) issued an exemptive order halving the minimum tender offer period for qualifying negotiated, all-cash tender offers from 20 to 10 business days.⁴ Corp Fin conditioned that relief in part on the offeror issuing a widely disseminated press release with a hyperlink to the complete offer materials at commencement, rather than relying on the traditional tombstone advertisement, reflecting the same view that modern information dissemination has outpaced decades-old delivery assumptions.⁵ In July 2026, Corp Fin expanded the permissible dissemination methods for certain tender offer materials at commencement to allow a press release through a widely disseminated news or wire service containing a hyperlink to the full offer materials in lieu of a summary newspaper advertisement or a mailing to shareholders.⁶
Default electronic delivery. On July 16, 2026, the SEC proposed Regulation E-Delivery, which would make electronic delivery the default method for satisfying disclosure delivery obligations across the federal securities laws, reversing the current opt-in framework. As part of that same proposal, the SEC would eliminate the 40-calendar-day e-proxy deadline in Rule 14a-16 under the Exchange Act, on the reasoning that the deadline existed to give shareholders time to receive a paper notice, request paper materials and review them before voting – a rationale that falls away once the paper notice itself is eliminated.⁷

This same rationale drives the proxy solicitation proposal’s most significant delivery change: eliminating the 20-business-day delivery period for proxy statements and Form S-4/F-4 prospectuses that incorporate documents by reference. That period predates EDGAR and the current regime of mandatory electronic filing, and assumed shareholders needed extra time to track down materials that were not otherwise in their hands. The SEC notes that the filings eligible for incorporation by reference are now freely available on EDGAR, that it has taken numerous steps to facilitate electronic delivery, and that investors increasingly expect, and often prefer, electronic delivery of required disclosures.⁸

Those developments, the SEC concludes, have made the 20-business-day period unnecessary today independent of any other reform. The pending Regulation E-Delivery proposal reinforces the same point from another direction: Once electronic delivery becomes the default method of satisfying delivery obligations generally, including for business combination transactions, the case for retaining a paper-era mailing buffer weakens further. Rather than merely shortening the period, the SEC has proposed eliminating it outright, though it has also asked whether a shorter period should be retained instead. A company would still need to deliver a copy of any incorporated document promptly upon a shareholder’s request, preserving a paper-copy option for shareholders who want one.

Eliminating the notice of exempt solicitation

The proxy solicitation proposal would also rescind Rule 14a-6(g), eliminating the requirement for shareholders beneficially owning more than $5 million of a company’s securities to file a Notice of Exempt Solicitation on Form PX14A6G when conducting certain written exempt solicitations. This change follows a sequence of related developments:

Rising voluntary filings. The SEC cited data showing that voluntary filings had grown increasingly common: Proportion of Notices of Exempt Solicitation filed on a voluntary basis grew from roughly 40% of such filings in 2018 to roughly 80% in 2025.⁹ That rising share of voluntary filings suggests many filers were using the notice to publicize their campaign, not because the proxy rules required it.
Corp Fin’s January 2026 guidance. Corp Fin sought to curb voluntary filings by issuing guidance objecting to voluntary Form PX14A6G filings by shareholders below the $5 million threshold, reversing a long-standing practice of not objecting to such filings.¹⁰
The proxy solicitation proposal takes a different approach. Rather than continuing to police who may file voluntarily, the proxy solicitation proposal would eliminate the notice requirement for mandatory and voluntary filers alike, on the conclusion that the distinction between the two no longer serves a meaningful purpose.

Since Corp Fin’s January 2026 guidance, market participants have already turned increasingly to press releases, other media and third-party platforms to publicize campaigns – all still subject to the proxy rules’ antifraud provisions. If the notice requirement is eliminated entirely, companies will need to monitor these channels with greater frequency rather than principally relying on EDGAR to learn they are the target of an exempt solicitation.

Next steps

Companies and investors should continue to comply with the current proxy solicitation rules, including the existing 20-business-day delivery period and the Notice of Exempt Solicitation requirement, unless and until the SEC adopts final rules. Corp Fin has already signaled comfort with a shorter broker search timeline through interpretive guidance, so companies should confirm their current practice reflects that guidance in addition to monitoring this rulemaking.

The SEC has invited commenters to submit feedback before the public comment period closes on November 20, 2026. Given the 60-day comment period, final rules may not take effect before most companies have already locked in their 2027 annual meeting timelines, so proxy statement preparation and meeting planning for the 2027 proxy season should proceed on the assumption that the current framework will remain in place. Companies should nonetheless track the rulemaking closely and start thinking now about how their delivery practices, exempt solicitation monitoring and broker search procedures would need to change if the proxy solicitation proposal is adopted substantially as proposed, and companies should expect these topics to come up in shareholder engagement over the months ahead.

Cooley’s corporate governance and securities regulation attorneys are available to discuss these issues with you.

Notes

In January 2026, the SEC’s Division of Corporation Finance issued guidance stating that the Staff will not object to a broker search commenced in less than 20 business days before the record date, provided the company reasonably believes its proxy materials will be timely disseminated to beneficial owners and otherwise complies with Rule 14a-13. Proxy Rules and Schedules 14A/14C, Corporation Finance Interpretation Question 133.02 (Jan. 23, 2026).
Smaller reporting companies are not currently required to include the stock performance graph in their annual reports to security holders. See Instruction 6 to Item 201(e) of Regulation S-K and Proxy Solicitation Modernization, Proposing Release No. 34-106385 at Footnote 22 in II.A.2 (Sept. 16, 2026).
This theme is not limited to the current SEC administration. The 2023 amendments to Regulation 13D-G, adopted under the prior SEC administration, accelerated Schedule 13D and 13G filing deadlines based on a similar premise that modern systems and market infrastructure support faster information dissemination and processing. See Cooley alert, SEC Adopts Amendments to Beneficial Ownership Reporting Rules: What Investors Need To Know (Oct. 30, 2023).
The order applies to negotiated, all-cash, fixed-price tender offers for all outstanding shares of the target class, subject to a prompt target recommendation and other conditions, and does not extend to going-private transactions or cross-border offers relying on the Exchange Act’s cross-border exemptions. SEC Division of Corporation Finance, Exemptive Order for Tender Offers for Equity Securities (April 16, 2026
Corp Fin cited market efficiency, technological modernization and reduced exposure to intervening market volatility as the policy rationale for the shortened period. See Cooley M&A’s blog post SEC Exemptive Order Halves Minimum Tender Offer Period for Negotiated All-Cash Transactions (May 7, 2026).
Tender Offer Rules and Schedules, Corporation Finance Interpretation Questions 104.03 and 131.04 (July 9, 2026).
For additional information regarding Regulation E-Delivery, please refer to this Cooley alert, From Opt In to Opt Out: SEC Proposes Electronic Delivery as Default for Required Disclosures (July 22, 2026).
See Proxy Solicitation Modernization, at II.B.2.
See Proxy Solicitation Modernization, at II.C.2.
Proxy Rules and Schedules 14A/14C, Corporation Finance Interpretation Question 126.06 (Jan. 23, 2026).

SEC Proposes Rescission of Rule 14a-8: What Comes Next?

Thu, 17 Sep 2026 07:00:00 Z

On September 16, 2026, the Securities and Exchange Commission (SEC) proposed to rescind Rule 14a-8 under the Securities Exchange Act of 1934 in its entirety. If adopted, the proposal (proposed amendments) would eliminate the federal mechanism that for more than 80 years has allowed qualifying shareholders to require public companies to include their proposals in company proxy materials. In the same release, the SEC also proposed amendments to Rule 14a-4(c) that would expand companies’ ability to exercise discretionary voting authority on shareholder proposals submitted outside of the Rule 14a-8 process.

In a separate proposal issued the same day, the SEC proposed to modernize other aspects of the proxy rules, including to: eliminate the requirement that companies deliver an annual report to security holders, eliminate the delivery deadline when documents are incorporated by reference into a proxy statement, eliminate the requirement to include a stock performance graph in annual reports, eliminate the requirement and the ability to submit Notices of Exempt Solicitation (both required and voluntary filings), and shorten the minimum broker search governing the period by which record holders forward proxy materials to their customers (the beneficial owners of a company).

These are proposals, not immediate rule changes. The SEC must complete the public notice and comment process and, if it decides to proceed, adopt final rules. Any final rescission of Rule 14a-8 would likely face substantial litigation. We therefore expect that Rule 14a-8 will remain in effect through the 2027 proxy season. Even so, the proposed amendments could affect proponent behavior now. If proponents view 2027 as a possible last opportunity to use Rule 14a-8, they may use it more aggressively, including to seek company-specific proposal rights that would survive Rule 14a-8’s rescission.

Comments on the proposed amendments are due 60 days after publication of the proposing release in the Federal Register.

Key takeaways

The proposed amendments would rescind the federal shareholder proposal framework of Rule 14a-8. This would eliminate long-standing rules that allow qualifying proponents to include their proposals in a company’s proxy materials.
Do not expect proposed rules to be effective for the upcoming proxy season. The proposed amendments must move through the public notice and comment period and survive other hurdles, including likely litigation, before becoming effective. Companies should therefore plan for the 2027 season under the existing rules.
2027 could become a “last chance” season. The prospect of rescission may drive a surge in shareholder proposal submissions under Rule 14a-8, including both traditional governance proposals and proposals designed to create a shareholder proposal proxy access right that would survive a rescission of Rule 14a-8. Some companies have already received such proposals for this upcoming proxy season. Cooley’s June early proxy season alert previewed many of these themes.
Private ordering may become the central battleground. The closest analogy may be proxy access for director nominations by shareholders. After the SEC’s mandatory proxy access rule was vacated in 2011, shareholder proposals submitted under Rule 14a-8 drove company-by-company adoption of proxy access for director nominations by shareholders. Given the proposed rescission of Rule 14a-8, proponents may have only a limited window to use the Rule 14a-8 process to establish company-specific proxy access rights for shareholder proposals.
State law and governing documents would take on greater significance. Texas has already enacted an opt-in statutory framework addressing shareholder proposal rights more broadly. In Delaware, whether shareholders have an inherent right to bring precatory proposals remains unsettled; the debate could move to the legislature and the courts.
Rescission of Rule 14a-8 would redirect activism, not eliminate it. Activism efforts are likely to shift toward other strategies, including director “vote no” campaigns, proxy contests, litigation, direct engagement and targeted publicity campaigns. If adopted, the proposed Rule 14a-4(c) amendments would provide companies with greater flexibility to exercise discretionary voting authority on shareholder proposals submitted outside of the Rule 14a-8 process, subject to disclosure and an affirmative shareholder opt-out election. Importantly, however, while the proposed amendments to Rule 14a-4(c) are intended to address the concern that “zero slate” campaigns can pressure companies to include in their proxy materials shareholder proposals that might otherwise be excludable under Rule 14a-8, effectively circumventing the Rule 14a-8 process, the amendments would not prohibit zero slate campaigns. Indeed, if adopted and Rule 14a-8 is rescinded, they could further elevate zero slate campaigns as a prominent activist tool, providing a means for bringing shareholder proposals to a vote.

Rule 14a-8 in brief: An 80-year federal shareholder proposal mechanism under pressure

The SEC first adopted the federal shareholder proposal mechanism in 1942. Rule 14a-8 generally requires a company subject to the federal proxy rules to include, at the company’s expense, a qualifying shareholder proposal and any accompanying supporting statement in its proxy materials if the shareholder satisfies minimum ownership, holding period and other procedural requirements. The rule also provides procedural and substantive bases for exclusion, including ordinary business or micromanagement, substantial implementation, duplication of another proposal and resubmission of a substantially duplicative proposal.

The proposing release rests principally on the SEC’s view that Rule 14a-8 exceeds the agency’s statutory authority under Section 14(a) of the Exchange Act. The SEC takes the position that Section 14(a) authorizes regulation of the proxy solicitation process but does not authorize it to displace state law on the corporate governance question of which matters shareholders may present or require to be included in company proxy materials.

The SEC also cites independent policy reasons for rescission, including its view that some of Rule 14a-8’s original justifications are unsubstantiated in practice or less compelling today, that the rule requires the SEC to make judgments about state law, and that a uniform federal regime has inhibited development of state law and private ordering.

The proposed amendments follow the dismantling of the SEC staff’s long-standing Rule 14a-8 no-action process. For decades, companies seeking to exclude proposals routinely sought SEC staff concurrence, creating a substantial body of interpretive precedent. In November 2025, the SEC staff largely stepped back from substantive no-action responses, and on August 14, 2026, it announced that it would stop responding to shareholder proposal no-action requests altogether, while leaving companies’ obligations to provide notice of exclusions pursuant to Rule 14a-8(j) in place. See the SEC staff’s August 14, 2026, statement.

The proposed amendments also follow years of debate over the politicization of the shareholder proposal process. Proposal volume rose sharply over the past decade, with submissions approaching 1,000 at Russell 3000 companies in recent peak seasons. A relatively small group of serial individual proponents, policy-focused investment funds, labor and advocacy organizations, and, more recently, anti-ESG proponents have accounted for a significant share of submissions. Many proposals address contested social or political topics, including climate, diversity, equity and inclusion (DEI), and other environmental, social and governance (ESG) matters. SEC staff guidance has also shifted across administrations, particularly on environmental and social (E&S) proposals (see Cooley’s February 2025 client alert).

More broadly, the proposed amendments reflect the SEC’s current willingness to revisit long-standing rules it views as imposing unnecessary cost and complexity for public companies or making the public markets less attractive. Alongside other recent initiatives to reduce public company burdens and facilitate capital formation, rescinding Rule 14a-8 would be a significant step in that agenda.

What the proposed amendments would do

Rescind Rule 14a-8

The proposed amendments would rescind Rule 14a-8 in its entirety. Once effective, public companies would no longer have a federal obligation under Rule 14a-8 to include qualifying shareholder proposals in company proxy materials, and the rule’s ownership thresholds, procedural requirements, substantive exclusions and Rule 14a-8(j) exclusion notice framework would fall away with it.

Rescission would not prevent shareholders from raising matters at meetings or conducting their own solicitations. It would instead shift the default away from a uniform federal inclusion right and toward state corporate law, company charters and bylaws, advance notice provisions, and the remaining federal proxy rules governing independent solicitations.

Expand discretionary voting authority under Rule 14a-4

The proposed amendments also would amend Rule 14a-4 to broaden companies’ ability to exercise discretionary voting authority on timely received shareholder proposals submitted outside of the Rule 14a-8 process. Under current Rule 14a-4(c)(2), a proponent can prevent the company from exercising that authority by furnishing its own proxy materials to holders of at least the percentage of shares needed to approve the proposal. The proposed amendments would eliminate that solicitation threshold. Instead, a company could exercise discretionary voting authority if it satisfies the following three conditions:

Its proxy statement briefly describes the proposal and states how it intends to exercise that authority.
Its proxy card cross-references that disclosure.
It includes a check box on its proxy card allowing shareholders to prevent the company from exercising discretionary authority with respect to their individual shares. A company could use a single opt-out box for multiple proposals.

The proposed amendments to Rule 14a-4(c) are intended to address the concern that zero slate campaigns, first employed at Warrior Met Coal during the 2024 proxy season, can pressure companies to include in their proxy materials shareholder proposals that might otherwise be excludable under Rule 14a-8, effectively circumventing the Rule 14a-8 process. However, the amendments would not prohibit zero slate campaigns. Indeed, if adopted and Rule 14a-8 is rescinded, they could further elevate zero slate campaigns as a prominent activist tool, providing a means for bringing shareholder proposals to a vote. See Cooley’s 2024 proxy season alert for additional background on zero slate campaigns.

Clarify application of advance notice deadlines and amend related disclosure requirements

Proposed amendments to Rule 14a-4(c)(1) would clarify that a company’s advance notice provision, or an applicable state law provision, generally determines whether a proposal is timely received for purposes of exercising discretionary voting authority. The current 45-day federal default deadline would apply only if no such provision exists. Similarly, the proposed amendments to 14a-4(c)(1) provide that if a company did not hold an annual meeting during the prior year, or if the date of the meeting has changed more than 30 days from the prior year, any deadline established under the company’s advance notice provision, or an applicable state law provision, would govern instead of the default deadline in the current rule (which is “a reasonable time before the registrant sends its proxy materials”). Proposed amendments to Rule 14a-5(e) would, if Rule 14a-8 is rescinded as proposed, align proxy statement deadline disclosures with governing documents or applicable state law for proposals seeking inclusion in a company’s proxy materials and with amended Rule 14a-4(c)(1) for proposals not seeking inclusion. If the date of the next annual meeting changes by more than 30 days, proposed amendments to Rule 14a-5(f) would also require companies to disclose updated shareholder proposal and director-nomination deadlines, to the extent applicable.

Change preliminary proxy filing requirements

The proposed amendments also would amend Rule 14a-6 so that the submission of a shareholder proposal outside the 14a-8 process would not itself trigger a preliminary proxy filing. A preliminary filing instead would only be required when the company knows, or reasonably should know, that a nonexempt “solicitation in opposition” is being conducted by the shareholder proponent. A “solicitation in opposition” would be broadly defined to include any solicitation (other than a solicitation exempt under Rule 14a-2): subject to Rule 14a-19, to vote against or withhold votes from any of the company’s director nominee(s), to vote against a proposal that the company expressly supports in its proxy materials, and to vote in support of a proposal that the company does not expressly support in its proxy materials.

Do not expect an overnight change

The proposed amendments do not change Rule 14a-8 today. The SEC must solicit public comment, review the resulting record, and, if it decides to proceed, adopt a final rule that addresses the significant issues raised by commenters. Companies should therefore continue planning for the 2027 proxy season under the existing rule.

Significant or controversial rulemakings can take time. The SEC’s 2026 proposal to permit optional semiannual reporting, for example, reportedly generated roughly 200,000 comments and form letter submissions. A proposal to eliminate an 80-year-old federal shareholder proposal framework likewise is likely to attract substantial participation.

Any final rescission also would likely face substantial litigation. The now-stayed climate disclosure rules illustrate how rulemaking and litigation can extend the timeline: The SEC proposed the rules in March 2022, adopted them in March 2024 and stayed them after legal challenges were filed. The SEC later changed course after the 2024 election. Similar litigation here could delay effectiveness, and challengers could seek a judicial stay. With the 2028 presidential election approaching, the process could extend into another administration.

2027 could be the ‘last chance’ Rule 14a-8 season

While Rule 14a-8 is expected to remain in effect through the 2027 proxy season, the proposed amendments could have an immediate effect on proponent behavior. Many calendar-year companies begin receiving shareholder proposals in the fall, and a credible prospect of rescission could create a rush to use the federal process while it remains available, potentially reversing the recent decline in proposal volume.

That dynamic would arrive against an already unsettled backdrop. As discussed in our June 2026 shareholder proposal season review, the SEC staff’s retreat from the no-action process altered company-proponent negotiations during the 2026 season and was accompanied by increased proponent litigation. The staff’s August 2026 decision to stop responding to no-action requests entirely means companies should expect to enter the 2027 season without the substantive staff concurrence that historically provided greater predictability around exclusion decisions. As a result, exclusion decisions may require a more litigation-focused approach. Companies should identify potentially excludable proposals early, preserve the Rule 14a-8(j) notice deadline (generally 80 calendar days before filing definitive proxy materials), develop a robust legal analysis supporting any exclusion decision, and assess in advance their risk tolerance for excluding a proposal without SEC staff concurrence. Companies should also anticipate that exclusion decisions could prompt litigation, public campaigns or director-focused pressure, and consider whether early engagement with proponents may help mitigate those risks.

Under these circumstances, some companies may prefer to skip the exclusion or negotiation process and simply allow many proposals to go to a vote, particularly on less sensitive topics or where low support is expected. Conversely, the SEC’s stated view in the proposing release that Rule 14a-8 exceeds its statutory authority may cause some companies to view both the litigation risk and the reputational consequences associated with exclusion as more manageable and, as a result, take more aggressive positions on whether particular proposals may be excluded.

The most consequential submissions may not be ordinary E&S or governance proposals, but proposals designed to preserve shareholder proposal rights in a post-Rule 14a-8 world. Proponents may pursue precatory proposals asking boards to adopt a shareholder proposal bylaw and, where permissible, binding bylaw amendments creating a company-specific right to submit proposals independent of Rule 14a-8. Those proposals could address ownership and holding thresholds, notice and procedural requirements, permissible subject matter, supporting statements, resubmission standards and bases for exclusion. Some companies have already received proposals on this topic for the upcoming proxy season, including proposals from a prominent conservative proponent, one of which is scheduled for a vote in October.

That makes timing particularly important. If Rule 14a-8 is rescinded and a company has no contractual or bylaw-based proposal right, shareholders may no longer have a comparable low-cost mechanism to force a proposal onto the company’s proxy card. Moreover, if the proposed Rule 14a-4 amendments are adopted, companies would have broader discretion to vote proxies on shareholder proposals submitted outside of the Rule 14a-8 process, subject to disclosure and an affirmative shareholder opt-out election. Proponents may therefore place greater emphasis on securing company-specific proposal rights while Rule 14a-8 remains available.

Private ordering: Proxy access redux?

Proxy access provides a useful precedent for company-by-company governance change. In 2010, the SEC adopted Rule 14a-11, which would have created a mandatory federal proxy access regime for shareholder director nominees. The US Court of Appeals for the District of Columbia Circuit vacated that rule in 2011. But amendments to Rule 14a-8 permitting shareholders to submit company-specific proxy access proposals survived, and those proposals became a defining governance campaign of the 2015 proxy season and ultimately drove widespread adoption of proxy access bylaws through private ordering.

The dynamic here would differ in one important respect. Proxy access private ordering was enabled by Rule 14a-8 after the mandatory federal rule disappeared. Here, Rule 14a-8 itself is the federal mechanism that may disappear. That makes the coming proxy season potentially more consequential: Proponents may seek to use Rule 14a-8 one last time to create the company-specific proposal rights that will replace it. If those proposals gain broad institutional support, market-standard terms could develop quickly, just as they did with proxy access.

Companies receiving these proposals would face strategic choices beyond a simple include-or-exclude decision. Depending on the proposal and shareholder base, a company could oppose the proposal, negotiate more tailored terms or adopt its own framework. Boards should be prepared for proposal access rights to become a mainstream governance topic rather than a niche procedural issue.

Could alternative shareholder proposal rights attract investor support?

That possibility warrants attention. Overall support for shareholder proposals, particularly E&S proposals, has declined from prior peaks, and institutional investors and proxy advisory firms have become more selective. Governance proposals involving traditional shareholder rights have proved more resilient. Proposals addressing special meeting rights, written consent, board declassification and supermajority voting requirements continue to attract comparatively strong support, and several categories achieved majority support during the 2026 season.

Tesla’s November 2025 annual meeting provides a potentially relevant data point on investor sentiment. Shareholders considered a proposal requesting that the board seek shareholder approval before adopting any bylaw amendment, as permitted under Texas law, that would impose ownership thresholds or solicitation requirements for shareholder proposals above those specified in Rule 14a-8. The proposal received approximately 49% support overall and, assuming all insiders voted against it, approximately 67% support from non-insider shareholders. Although the proposal would not itself have created a new shareholder proposal right, the result suggests that a proposal framed around preserving shareholder access to the Rule 14a-8 process could attract significant – and potentially majority – support.

There is no established market model for a Rule 14a-8 replacement bylaw today, and investor and proxy advisor views would likely depend heavily on the terms. The combination of durable support for traditional shareholder rights proposals and a perceived “now or never” dynamic means companies should treat these proposals as a real voting risk, not a theoretical one.

A key variable will be how major institutional investors and proxy advisory firms respond. If influential investors or proxy advisors adopt policies favoring shareholder proposal access bylaws, or otherwise press companies to adopt them, private ordering could accelerate quickly. If they do not, proponents may need to build support company by company.

State law could become the next battleground

Rescission would immediately raise a state law question that Rule 14a-8 has largely allowed companies and proponents to avoid: What right does a shareholder have to require that a matter be presented for a shareholder vote? Rule 14a-8 is a federal proxy rule governing when a company must include a qualifying proposal in its own proxy materials. It does not resolve all questions regarding the underlying state law right to present a proposal at a meeting. That question received relatively little attention while a broadly available federal mechanism existed, but it could become central if that mechanism disappears.

Texas has already moved in this direction. Its corporate law permits certain public companies to impose materially higher ownership and solicitation requirements for submitting shareholder proposals than those under Rule 14a-8. Those provisions were directly implicated in the Tesla proposal discussed above and provide an early example of how state law can shape shareholder proposal access.

Other states could respond by creating their own shareholder proposal regimes. Those regimes need not mirror the federal rule: States could provide a proposal right while setting ownership, holding period, solicitation or other eligibility thresholds materially different from Rule 14a-8. That could make state of incorporation and governing documents even more important to shareholder proposal access, and differences between states could become another factor in reincorporation decisions.

Delaware presents a different and still unsettled question. Delaware courts have not squarely resolved whether shareholders have an inherent right to bring precatory proposals for a vote. Recent commentary has argued that no such right exists absent a right created by statute, the certificate of incorporation, bylaws or board action; other scholars have reached the opposite conclusion. If Rule 14a-8 is rescinded, pressure may build for Delaware to address that uncertainty legislatively. One possible approach would be to codify that shareholders have no inherent right to submit precatory proposals unless the corporation affirmatively provides one, leaving the issue principally to private ordering.

Rule 14a-8 may disappear – shareholder pressure won’t

Rescission of Rule 14a-8 would eliminate a widely used tool of shareholder activists, but companies should not expect the underlying pressure to disappear. Proponents and other activists are likely to redirect their efforts toward director “vote no” campaigns, proxy contests, opposition to say-on-pay and other management proposals, litigation, direct engagement and targeted publicity campaigns. Companies also could face pressure to adopt shareholder proposal rights voluntarily.

Publicity and board-focused campaigns may become especially important. Rule 14a-8 gives proponents a relatively low-cost way to place an issue in a company’s proxy statement, attract public attention and engage the board. If that channel disappears, proponents may try to recreate the same pressure through targeted media campaigns, dedicated websites, open letters and other public pressure tactics, as well as campaigns aimed directly at directors. Some of these tactics are already emerging: During the 2026 season, proponents litigated exclusions, threatened or pursued Rule 14a-4 zero slate campaigns, and used director elections and public campaigns as alternative pressure points.

Rescission of Rule 14a-8 therefore may change the channel for shareholder activism more than the level of activism itself. For now, companies should continue preparing for the 2027 proxy season under the existing Rule 14a-8 framework while considering whether their advance notice bylaws, shareholder engagement approach, state of incorporation and broader activism preparedness remain appropriate if the federal shareholder proposal framework ultimately disappears.

Ninth Circuit Comet Ruling Spotlights Trade Secret Proof Burdens

Wed, 16 Sep 2026 19:30:00 Z

Cooley partners Amanda Main, Bobby Ghajar, Mark Lambert, Heidi Keefe and Erin Trenda co-authored an article for Law360 examining the Ninth Circuit’s decision to reverse a $40 million trade secret verdict in Comet Technologies USA Inc. v. XP Power LLC based on an erroneous jury instruction. The article discusses the differing burdens of proof under the federal Defend Trade Secrets Act and California’s Uniform Trade Secrets Act, as well as key considerations for litigants involving jury instructions, damages models and remedies in trade secret cases.

Read the article

Bulk-Power System Order: What Utilities and Industry Players Need to Know

Wed, 16 Sep 2026 18:23:00 Z

On August 26, 2026, President Donald Trump signed Executive Order 14421 (EO), declaring a national emergency arising from foreign exploitation of vulnerabilities in the bulk-power system and imposing new restrictions on transactions involving that system. While framed in country-neutral terms, the EO’s operative definitions, historical precedent and underlying threat assessment make clear that Chinese companies and China-linked supply chains likely are its principal targets. Companies that source equipment, components, software, firmware or maintenance services from Chinese manufacturers – or from joint ventures, subsidiaries or contract manufacturers with Chinese ownership or jurisdictional ties – face the most immediate exposure and should be evaluating their risk now.

China is expressly listed among countries subject to a policy of denial under International Traffic in Arms Regulations (ITAR) section 126.1 – the specific provision the EO incorporates to define “Covered Foreign Entities.” The Department of Energy’s (DOE) only prior implementing action under the predecessor 2020 order exclusively targeted Chinese-linked equipment. As discussed in detail below, final regulations implementing the EO must be published by the DOE in December; however, now is the time for companies with any Chinese nexus in their bulk-power supply chains to conduct supply chain audits, review financing contracts and assess their exposure. Companies should also consider participating in the rulemaking process to shape key definitions and provisions.

The EO prohibits “any acquisition, importation, transfer, or installation of any foreign-produced bulk-power system electric equipment (transaction) by any person, or with respect to any property, subject to the jurisdiction of the United States,” where:

A foreign country or national has any interest in the transaction (including through a supply contract).
The transaction was initiated after August 26, 2026.
The secretary of energy determines that:
1. The equipment (or associated components, software, firmware, digital services, maintenance services or remote-access capabilities) was designed, developed, manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of a “Covered Foreign Entity.”
2. The transaction poses an undue risk of sabotage, subversion, unauthorized access, supply disruption or catastrophic effects on US critical infrastructure or the economy, or otherwise poses an unacceptable risk to US national security or the safety of US persons.

Scope of covered infrastructure

The “bulk-power system” encompasses facilities and control systems necessary to operate an interconnected electric energy transmission network, plus generation facilities needed for reliability, including transmission lines rated at 69 kV or higher. Local distribution facilities are expressly excluded.

Scope of covered equipment

“Bulk-power system electric equipment” is defined by a detailed illustrative list: reactors, capacitors, substation transformers, utility-scale and grid-connected inverters, battery energy storage systems, uninterruptible power supply (UPS) systems supporting critical infrastructure, generators, generation turbines, high-voltage circuit breakers, protective relaying, metering equipment and industrial control systems – including remote terminal units (RTUs), programmable logic controllers (PLCs) and intelligent electronic devices (IEDs). Agencies may also consider associated software, firmware, remote-access capabilities, life cycle maintenance and supply chain dependencies. Equipment with broader application unrelated to the identified national security concerns is excluded.

‘Foreign produced’

An article is “foreign produced” if it is not manufactured, produced or assembled in the United States. The EO provides no customs-style rules for substantial transformation, country of origin or de minimis foreign content. A product assembled domestically from foreign components may have a textual argument that the final article is not “foreign produced,” but this is not a categorical safe harbor. DOE may examine critical components, firmware, remote access and supply chain dependencies, and the EO separately prohibits transactions structured to evade its requirements.

Existing equipment

The secretary of energy may impose conditions on the continued use, operation, maintenance, servicing or updating of qualifying foreign equipment already installed before August 26, 2026, including requiring its identification, isolation, monitoring, disconnection, replacement or removal. Before ordering the more disruptive remedies, the secretary must consider reliability and safety effects, replacement availability and continuity of essential service, and may phase compliance. This does not create an immediate fleetwide “rip-and-replace” mandate, but installed assets may become subject to technical conditions, increased monitoring, restricted maintenance arrangements or accelerated replacement requirements – creating potentially material exposure for asset owners, lenders and project buyers.

Impacted industries

The EO’s practical reach will depend on DOE’s implementing rules, but its express terms create direct exposure for utilities and transmission owners/operators (particularly those procuring or operating equipment rated 69 kV or above from higher-risk jurisdictions); energy infrastructure developers across all generation technologies; grid technology, storage and inverter suppliers (the most significant expansion relative to 2020); data center developers and operators to the extent their equipment ties into the bulk-power system; equipment manufacturers and supply chain vendors facing expanded country-of-origin and ownership disclosure demands; investors, lenders and M&A participants who should add the EO to regulatory and R&W insurance diligence; and federal contractors who may be affected by forthcoming Federal Acquisition Regulation (FAR) revisions prioritizing US-manufactured energy infrastructure.

Mitigation, pre-qualification and anti-evasion

The secretary may negotiate mitigation measures as a precondition to approving an otherwise prohibited transaction and may publish a pre-qualified equipment and vendor list exempt from the prohibition, while retaining authority to later regulate even pre-qualified equipment or suppliers. Any transaction that evades, avoids or attempts to violate the order – and any conspiracy to do so – is separately prohibited. Companies should document sourcing determinations and business rationales and avoid restructurings designed to obscure country, ownership or service provider connections.

Implementation timeline

Within 120 days (by December 24, 2026), the secretary of energy – in consultation with the Office of Management and Budget, the secretaries of war and homeland security, and the national intelligence director – must publish implementing rules, including criteria for identifying Covered Foreign Entities and licensing procedures for otherwise prohibited transactions. Within 180 days (by February 22, 2027), the secretary must submit recommended FAR revisions to integrate national security screening into federal energy infrastructure procurement and prioritize US-manufactured equipment; the FAR Council then has 90 days to consider proposing those revisions for notice and comment.

As a first step toward implementation, on September 9, 2026, DOE published a request for information (RFI) seeking stakeholder input on key implementation questions, including the scope of covered equipment and transactions, risks associated with Covered Foreign Entities, supply chain and remote-access practices, mitigation of existing equipment, licensing and pre-qualification procedures, domestic manufacturing capacity, federal procurement, and potential economic, reliability, safety and small-entity impacts. Written responses are due by October 9, 2026.

Broader scope than prior bulk-power regulation

The EO is not the first attempt to regulate foreign equipment in the bulk-power system. On May 1, 2020, the first Trump administration declared a similar national emergency and authorized DOE to prohibit transactions involving equipment connected to “foreign adversaries.” DOE implemented that order in December 2020 with a Prohibition Order targeting limited transmission-level equipment from China at critical defense facilities. However, full implementation of this effort was suspended in January 2021 with the change in administration. Several features distinguish the 2026 EO from its predecessor.

First, existing, already-installed equipment is now in scope. The 2020 order applied only to transactions initiated on or after specified effective dates; neither it nor the Prohibition Order reached previously installed equipment. The 2026 order expressly authorizes the secretary to require isolation, disconnection, replacement or removal of qualifying equipment installed before the order, subject to reliability and phased-compliance safeguards – materially expanding reach into the existing installed base.

Second, the covered entity standard has broadened. The 2020 order turned on “foreign adversary.” The 2026 order uses “Covered Foreign Entity,” defined to include countries or persons connected to a government subject to a US arms embargo or sanctions regime under ITAR, or that the secretary determines is engaged in conduct detrimental to US national security or foreign policy. This is broader in structure – embracing sanctions- and embargo-linked jurisdictions generally – and gives the secretary considerable discretion to designate additional countries or entities case by case.

Third, equipment coverage now expressly reaches grid modernization technology. The 2026 order’s illustrative list calls out utility-scale and grid-connected inverters, battery energy storage systems, UPS systems supporting critical infrastructure, and associated software, firmware, digital services and remote-access capabilities – categories not covered by the 2020 order or its narrower Prohibition Order (which centered on transformers, circuit breakers and reactive power equipment at 69 kV and above).

The order also follows the Federal Communications Commission’s (FCC) recent addition of foreign-produced power inverters to its Covered List. The FCC and DOE frameworks use different legal authorities and triggers; companies procuring or supplying inverters should conduct a parallel analysis rather than assuming compliance under one regime resolves the other.

Ambiguities and open interpretive questions

Several aspects of the EO are unresolved and will depend on DOE’s implementing rules, due by December 24, 2026. We flag these because they bear directly on near-term considerations:

When is a transaction “initiated”? The EO does not define this term, nor does it explain whether acquisition, importation, transfer and installation are separate transactions for timing purposes. It is unclear how the term applies to purchase orders placed but not yet performed before August 26, 2026, deliveries or payments under pre-existing master supply agreements, or change orders and amendments. This is especially important for equipment with multistage procurement: A contract may have been signed before August 26 while manufacturing, importation and installation occur afterward. Because the EO applies “notwithstanding any contract entered into or any license or permit granted prior to the date of this order,” pre-existing contractual protections may not shield a transaction that DOE treats as “initiated” after the effective date. Companies should not assume a pre-August 26 contract places all subsequent performance steps outside the EO’s reach.
Which countries and entities will be designated Covered Foreign Entities? The definition combines an objective prong (countries subject to a US arms embargo or ITAR-referenced sanctions regime) with a discretionary prong (persons the secretary determines are engaged in conduct detrimental to US national security or foreign policy). Until DOE publishes designations, affected companies cannot be certain which suppliers, countries or ownership structures are covered – even though the underlying prohibition is already in effect.
How will DOE apply the “owned by, controlled by, or subject to the jurisdiction or direction of” standard? This test is not further defined – no percentage ownership threshold, no guidance on indirect or minority ownership, joint ventures or contractual control. Several additional undefined concepts will determine practical reach: “critical component,” “critical infrastructure” for covered UPS systems, “foreign manufactured or operated” for existing equipment, and the degree of foreign component, software or service content sufficient to establish a Covered Foreign Entity nexus. These questions are particularly significant for minority investments, joint ventures, third-country subsidiaries, contract manufacturers, dual-sourced products, and equipment assembled domestically but reliant on foreign firmware or ongoing foreign technical support.
What does the pre-qualified vendor list process look like? The EO allows, but does not require, the secretary to publish a pre-qualified list and expressly reserves authority to later regulate even pre-qualified equipment. It is unclear whether or when DOE will publish such a list, what certification process vendors would follow, and how much reliance companies can place on it given that reserved authority.

China-specific implications

The order does not name China in its operative text; “Covered Foreign Entity” is defined generically by reference to US arms embargo or sanctions status or through a case-by-case determination. However, China is expressly listed among countries subject to a policy of denial under ITAR section 126.1, the specific provision incorporated into the definition. On its face, this may reach beyond Chinese state-owned enterprises or companies on US sanctions and export-control lists, creating potential exposure for privately owned companies organized in China and certain subsidiaries, joint ventures, and suppliers whose relationship to China is jurisdictional rather than equity-based. Several additional features point to particular relevance for China-linked entities and supply chains.

Direct historical precedent targeting China

DOE’s only prior implementing action under the 2020 order targeted equipment manufactured or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of China, based on DOE’s assessment that the Chinese government was “equipped and actively planning to undermine the electric power system in the United States.” Companies should expect DOE to draw on this factual record when implementing the 2026 order, making Chinese-linked equipment and suppliers a likely early focus of forthcoming designations.

China-linked AI and grid-technology intersections

The order’s threat rationale explicitly ties bulk-power system security to “advanced manufacturing, data centers, artificial intelligence, and defense production.” Given the administration’s broader scrutiny of Chinese involvement in AI infrastructure, DOE may initially focus on grid technologies with Chinese-origin software, cloud or remote-access components. Potential targets include grid-connected inverters, battery management software and remote-monitoring or predictive-maintenance platforms, particularly when integrated with AI-driven grid optimization or data center energy management.

Potential transaction restrictions

Because the prohibition reaches any transaction where a foreign country or national has any interest – including through a contractual interest in equipment supply – transactions with Chinese equipment manufacturers, joint venture partners or component suppliers initiated after August 26, 2026, are at risk of being deemed void or subject to unwinding if DOE later designates the relevant entity or country as a Covered Foreign Entity, notwithstanding any prior contract, license or permit. Companies with pending or planned procurement from Chinese-linked suppliers should treat this as an active transaction risk during the pre-implementation period.

Practical guidance and action steps

Inventory pipeline transactions and the existing installed base

Identify all pending, planned or recently initiated (on or after August 26, 2026) acquisitions, imports, transfers or installations of qualifying bulk-power system equipment, mapping each supplier’s country of manufacture, ultimate ownership, and the origin of associated software, firmware, maintenance services and remote-access capabilities. In parallel, compile an inventory of currently installed equipment by manufacturer, country of origin and ownership/control chain so the company can quickly assess exposure if DOE designates a Covered Foreign Entity.

Build supply chain disclosure into contracts and do not assume pre-existing contracts provide protection

Update procurement templates and requests for proposals (RFPs) to require supplier certifications on country of manufacture, beneficial ownership, and origin of embedded software, firmware, remote access and maintenance services. New and amended contracts should address notification obligations, audit rights, product substitution and domestic sourcing rights, cooperation with DOE inquiries, and allocation of removal, replacement and delay costs. Because the EO applies “notwithstanding any contract entered into or any license or permit granted prior to the date of this order,” companies should not treat existing master supply agreements, purchase orders or long-term contracts as insulating a transaction from the prohibition.

Monitor DOE’s implementing rulemaking and vendor list developments

DOE’s rules are due by December 24, 2026, and will define Covered Foreign Entities, identify equipment warranting scrutiny and establish licensing procedures. Companies with material exposure should build a process to reassess procurement and vendor decisions promptly after publication. If DOE publishes a pre-qualified vendor list, treat qualification as an increasingly important procurement input – while recognizing that DOE retains authority to regulate even listed equipment or vendors.

Coordinate diligence across overlapping regimes

This order operates alongside the Committee on Foreign Investment in the United States (CFIUS), Federal Energy Regulatory Commission/North American Electric Reliability Corporation (FERC/NERC) supply chain standards, the FCC’s Covered List for foreign-produced power inverters, and other China-specific restrictions (such as foreign entity of concern rules for certain tax credits). Compliance under one regime does not resolve the others; companies should coordinate workstreams rather than treating them as independent silos.

Develop technical mitigations and incorporate the EO into deal diligence

For higher-risk equipment, evaluate whether remote access can be eliminated, firmware independently validated, networks segmented and maintenance localized. Transaction teams should assess potential DOE restrictions as part of regulatory, sanctions and supply chain diligence; purchase agreements and financing documents may need specific disclosure schedules, covenants, closing conditions, indemnities, and reserves for remediation or replacement.

Engage counsel before initiating higher-risk transactions

Given uncertainty around when a transaction is “initiated” and which entities will be designated Covered Foreign Entities, companies contemplating significant procurement of foreign-manufactured bulk-power system equipment – particularly equipment with any China nexus – should seek legal input before signing or performing the transaction.

DOJ Announces ‘Historic’ $250 Million Penalty for HSR Filing Violations

Fri, 04 Sep 2026 20:39:00 Z

On August 26, 2026, the US Department of Justice (DOJ) announced a proposed settlement with private equity firm KKR & Co. to resolve a complaint alleging repeated and “systemic” Hart-Scott-Rodino (HSR) Act violations. Under the settlement, KKR will pay a “historic” civil penalty of $250 million – “more than 20 times any prior HSR penalty,” as noted by Associate Attorney General Stanley Woodward.

The DOJ’s January 2025 complaint alleged that KKR violated the HSR Act in at least 16 separate transactions during 2021 and 2022. According to the DOJ, KKR altered documents in HSR filings for eight transactions, omitted required documents for 10 transactions and failed to make the required HSR filing in two transactions. In a statement, KKR disagreed with the DOJ’s position, noting that it believed it had “acted in good faith … consistent with industry practice” in its HSR filings but wanted to resolve the matter without further litigation. Notably, KKR also added that outside law firms would fully reimburse KKR for the civil penalties.

This settlement comes weeks after the Federal Trade Commission (FTC) announced $12 million in penalties against Edwards Lifesciences Corp. and Genesis MedTech Group Limited for HSR Act violations. At the time, that penalty was the largest ever for failure to make an HSR filing. The FTC alleged that the parties structured the transaction with the aim of avoiding an HSR filing requirement by splitting the consideration between a purchase price for the target below the HSR threshold coupled with a separate investment into the seller. The combined value would have triggered an HSR filing.

Why this matters

HSR Act violations can result in significant penalties. The maximum civil penalty for an HSR Act violation is currently $53,088 per day per violation, and the DOJ initially sought more than $650 million in penalties in the KKR complaint. With the recent settlements, the DOJ and the FTC are signaling that both agencies take HSR evasion and incomplete filings seriously. Given the time that may pass between agency enforcement and the required time of filing, penalties can accrue rapidly. It is essential to conduct a thorough reportability analysis at the outset of a transaction.

Ensure compliance with HSR document collection. Sweep broadly and comprehensively in the collection process for documents that should be included with the HSR filing. The DOJ’s complaint discussing alleged omitted documents underscores the importance of identifying all key custodians and ensuring that their materials are collected and reviewed.

Adhere to document creation and hygiene guidelines. In the KKR complaint, the DOJ alleged that KKR made alterations to responsive business documents in some transactions to minimize the competitive impact of the proposed deal. Altering documents is of course an immediate red flag, but not creating “hot” documents in the first instance is the best approach. Involving antitrust counsel to review drafts before broad circulation to officers or directors reduces the risk of unnecessarily inflammatory language in responsive materials.

White House Steps Up Trade Fraud Enforcement With AI

Thu, 03 Sep 2026 19:32:50 Z

The White House recently announced that “the age of untraceable illegal transshipment is over.” In an August 13 report titled, “The Great Transshipment Scam,” the White House Office of Trade and Manufacturing Policy issued what it called a “warning to the world” – “stop evading and avoiding the Trump tariffs through illegal transshipment. Those who continue will be caught.”

Illegal transshipment, which is the practice of routing goods from higher-tariff countries through lower-tariff jurisdictions to evade US tariffs, reportedly costs America tens of billions of dollars annually. To counter illegal transshipment, US Customs and Border Protection (CBP) is developing an AI-enabled “detective border” that will analyze shipment data, routing histories, product classifications and other information to purportedly “reveal[] inconsistencies that no human could catch at scale.”

On the same day the White House report was released, the US Department of Justice (DOJ) issued a memorandum identifying trade fraud as a top enforcement priority, underscoring the risk of criminal prosecution for companies and individuals engaged in tariff evasion or other fraud schemes.

The government’s focus on illegal transshipment can affect any company engaged in foreign commerce, but those connected to China supply chains should pay particular attention. Now is a good time to evaluate import practices, strengthen compliance programs and prepare for this new era of data-driven enforcement.

CBP’s new AI ‘detective border’

The White House report estimates that transshipment “is draining the US treasury” of $10 billion to $100+ billion in lost tariff revenue each year.

According to the report, since the first Trump administration imposed Section 301 tariffs on China in 2018, goods that previously moved directly from China to the US are increasingly being routed through third-country jurisdictions – including Vietnam, Malaysia, Thailand, Mexico and Cambodia – to take advantage of lower tariff rates. The report makes clear that the government is aware of these routing patterns and views them as a principal driver of tariff revenue losses. Other higher-tariff countries are allegedly beginning to adopt similar practices, but China-origin transshipment remains the enforcement priority.

One step being taken to counter transshipment is the development of an AI-enabled “detective border.” The AI detective border is described as an “AI-driven net that never sleeps, never tires, and never forgets.” The AI architecture will fuse “anomaly detection, link analysis, capacity validation, and mirrored-flow verification into a single predictive platform.” The platform will continuously analyze data to attempt to identify “anomalous routing patterns, suspicious bills of lading, false-origin claims, value mismatches, and capacity inconsistencies.” Additionally, AI will play a role in identifying potential mismatches between a product’s “digital identity” and its “physical reality” by analyzing “container markings, packaging patterns, and X-ray imaging.” CBP will leverage these findings to bring enforcement actions.

DOJ memo outlines enforcement priorities for fraud

Also on August 13, the National Fraud Enforcement Division (NFED) issued a memorandum setting forth its enforcement priorities. As we discussed previously, the NFED is a new division within the DOJ for investigating and prosecuting fraud against federal government programs.

The memo states that the NFED will utilize sophisticated data analytics tools and other new technology to build a “data-driven white-collar law enforcement” group. The NFED is expected to have 500 attorneys and other staff by late August and will “continue to rapidly grow for the next two years.”

The memo identifies five enforcement priorities:

Global trade and commerce, which will target “illicit transshipment schemes, country-of-origin fraud, the undervaluation of imported goods designed to evade duties, sanctions evasion, and foreign forced labor schemes.”
Public trust and financial integrity, including government procurement fraud (such as bid rigging, self-dealing and billing fraud), as well as benefit and grant programs (such as student loans and small business programs).
Healthcare, such as Medicare or Medicaid fraud, controlled substance diversion, home health and hospice schemes, and deceptive marketing of unsafe products and services.
Internal revenue, which will focus on criminal tax enforcement.
Corporate misconduct, which will focus on “fraud and other economic crimes.”

Echoing the White House report, the memo emphasizes that trade fraud and customs evasion “undermine American industry” and “deprive the public fisc of vital external revenue.”

Implications

With the administration viewing trade fraud as a significant threat to American industry and the broader US economy, companies with global supply chains should expect heightened scrutiny of their import practices. That scrutiny will be increasingly data-driven and take advantage of new technology. The consequences of noncompliance may extend beyond civil penalties to criminal prosecution. Companies should consider reviewing and strengthening their compliance programs to identify and address potential issues or weaknesses in their supply chain.

Companies that receive notice that they are the subject of a trade fraud investigation – whether through a CBP Request for Information, a subpoena or Civil Investigative Demand from the DOJ, or a formal notice of detention or seizure – should act quickly and deliberately to evaluate the allegations and potential defenses. Companies with China-connected supply chains should be particularly alert, as enforcement agencies are actively scrutinizing import patterns involving Chinese-origin goods routed through third countries.

As an initial matter, companies should retain experienced counsel before responding to any government inquiry or making statements to investigators. Companies should also take immediate steps to preserve all potentially relevant documents and data, including shipping records, customs filings, supplier agreements and internal communications relating to import practices. In parallel, companies should consider initiating an internal investigation to assess the scope of the issue, determine whether voluntary self-disclosure is appropriate and develop a strategy for engaging with the government. Throughout this process, companies should be mindful that trade fraud investigations often involve multiple agencies – including CBP, DOJ and the Department of Commerce – and that early coordination across enforcement tracks is critical.

How we can help

Cooley’s global tariffs task force is a team of high-stakes litigators, former prosecutors, including the former chief of the public corruption unit of the US Attorney’s office, and investigation counsel. We have extensive experience in cross-border investigations, particularly those involving Asia and China, and our team includes Mandarin-speaking lawyers who can communicate directly with clients and counterparties in their native language. Companies that receive an inquiry or notice that indicates they may be the subject of a government investigation can reach a member of our team by emailing zCooleyTariffsTeam@cooley.com.

USPTO Appeals Review Panel Reinstates Double Patenting Rejections, Limits Allergan in Examination

Wed, 02 Sep 2026 17:11:25 Z

Executive summary

In Ex parte Baurin (Appeal 2024-002920), the US Patent and Trademark Office (USPTO) Appeals Review Panel (ARP) reversed the Patent Trial and Appeal Board (PTAB) and reinstated six obviousness-type double patenting (OTDP) rejections against US Application No. 17/135,529.¹ The decision adopts a narrow reading of Allergan USA, Inc. v. MSN Laboratories Private Ltd. and confirms that a later-filed, later-expiring patent can still support an OTDP rejection, even where issuance of the challenged claims would not extend patent exclusivity.²

The decision turns on OTDP’s second rationale: preventing harassment through enforcement by separate owners of patentably indistinct patents. Relying on Fallaux, Hubbell and Cellect, the ARP held that this anti-harassment rationale independently supports an OTDP rejection, even when there is no improper extension of patent term.³

Still, the ARP was not entirely comfortable with that outcome. It said that absent binding precedent, it would not treat hypothetical future harassment as a stand-alone basis for rejection, and it sketched a more streamlined, term-focused framework it might adopt in the future. That framework is not the law yet. Until the Federal Circuit says otherwise, examiners will keep applying pre-Allergan practice, except in the narrow circumstances where the ARP found Allergan applies.

Background

The ’529 application is directed to antibody-like binding proteins, was filed December 28, 2020, and has a patent-term filing date of March 28, 2012, giving it an ordinary expiration of March 2032.⁴

The examiner rejected claims 1 – 18 for OTDP over six reference patents/applications, each combined with US 2009/0162359 A1 (the ’359 publication). The principal reference, US Patent No. 10,882,922 (the ’922 patent), was filed April 13, 2017, issued January 5, 2021, and expires April 13, 2037, after a 70-day patent term adjustment (PTA) award. The ’529 application and the ’922 patent are commonly owned by Sanofi and share several inventors; it was undisputed that the pending claims would have been obvious over the ’922 patent in view of the ’359 publication.

The anti-harassment rationale

OTDP rests on two justifications. The first, and historically dominant, one prevents a patentee from obtaining a second, later-expiring patent on a patentably indistinct invention that would unjustifiably extend exclusivity. The second, the anti-harassment rationale, guards against patentably indistinct rights ending up with separate owners, each able to assert the same technology against an infringer or licensee. A licensee that cleared rights under one patent could face a separate claim from another owner of related, indistinct claims. The common-ownership provision required in a terminal disclaimer exists to prevent that outcome, even where the patents’ terms are already aligned.

The PTAB reversed the OTDP rejections in November 2024 and denied rehearing in a 2 – 1 decision (with dissent) in December 2025. On March 5, 2026, the director sua sponte convened the ARP, inviting briefing from the applicant and 11 amici on the scope of Allergan, projected expiration dates and whether separate ownership risk independently supports an OTDP rejection. On August 6, 2026, the ARP reversed the PTAB and reinstated all six rejections.

The decision

Allergan applies only in narrow circumstances

The ARP rejected the PTAB’s broader application of Allergan. In Allergan, the Federal Circuit held that a first-filed, first-issued, later-expiring claim could not be invalidated for OTDP based on a later-filed, later-issued, earlier-expiring reference claim sharing a common priority date.

On the ARP’s reading, Allergan applies where the challenged and reference claims are in the same family and share the same patent-term filing date, and the challenged claims are first-filed, first-issued and later-expiring within that family.

The ’529 application met none of these: It lacks the first actual filing date in its family, remains pending (so is not first-issued) and does not share a patent-term filing date with the ’922 patent, which is from a different family. A pending continuation will rarely qualify as first-issued during ordinary prosecution, so the ARP instructed examiners to continue pre-Allergan practice outside this narrow fact pattern.

Anti-harassment can independently support an OTDP rejection

The PTAB treated the absence of a term extension concern as dispositive. The ARP disagreed, concluding that its reading of Federal Circuit precedent recognizes two independent OTDP rationales: preventing unjustified timewise extension and preventing multiple suits by different owners of patentably indistinct rights.

The ARP viewed Fallaux and Hubbell as controlling because the Federal Circuit affirmed OTDP rejections even where the challenged claims would have expired before the references and relied on Cellect’s recognition of divided ownership risk. It rejected the PTAB’s view that this reasoning was dicta, since that would leave those affirmances with no articulated basis at all.

The practical result: Claims in a later-filed, later-expiring patent can support an OTDP rejection of earlier-expiring foundational claims even though issuance of the foundational claims would not extend exclusivity, so long as the challenged claims are not patentably distinct from the reference claims.

The ARP questions the rule it applies

Although the ARP reinstated the rejections, it was candid about its discomfort with the rule it applied. Absent controlling precedent, the panel said it would not treat hypothetical future harassment as a stand-alone basis for rejection: Without evidence that an applicant actually split ownership and exposed the public to separate suits, the USPTO is simply speculating. The ARP also credited the amici’s concern that a broad anti-harassment rule creates a backward-looking problem, since a later improvement could threaten earlier foundational claims. That concern is particularly acute in collaborative research, licensing-driven portfolios and situations involving inventor mobility. The tension is sharpest because a terminal disclaimer requires continued common ownership: It is easiest to obtain where the harassment risk is most hypothetical, and unavailable precisely where separate ownership already exists.

A proposed new framework, but not yet the law

If the Federal Circuit determines anti-harassment cannot stand alone, the ARP outlined a term-focused alternative. For references outside the application’s family, examiners would ask only whether the reference has a later patent-term filing date than the application. If so, the term extension inquiry ends there. If earlier, the examiner would compare the claims for patentable distinctness. Examiners would rely on known facts, such as an existing terminal disclaimer or already awarded PTA, rather than speculate about future events.

Within a single family, the analysis would instead turn on actual filing (and issue) dates: A later-filed application could be rejected over an earlier-filed parent, but not the reverse. This is consistent with Allergan’s principle that the first-filed, first-issued patent sets the family’s maximum period of exclusivity. The ARP also floated narrowing any surviving anti-harassment rationale by requiring actual evidence of prior ownership-splitting, or a two-way obviousness showing, before it alone could support a rejection. None of this is presently in effect; the ARP expressly conditioned it on further Federal Circuit guidance.

Key takeaways

1. Allergan protection remains narrow and family specific.

The Allergan exception protects only a first-filed, first-issued, later-expiring claim against a later-filed, later-issued, earlier-expiring reference sharing the same patent-term filing date within the same family. That is not the fact pattern most applicants will see during original prosecution; it is more likely to come up in reexamination, reissue or a later validity dispute.

2. Anti-harassment remains a live, independent ground for rejection.

Applicants should expect examiners to keep making OTDP rejections based on later-filed, later-expiring patents, including cross-family references, wherever the claims are not patentably distinct and a common ownership or inventorship link exists. Under the ARP’s current guidance to the USPTO, an earlier expiration date will not by itself defeat that kind of rejection.

3. Terminal disclaimers deserve more strategic attention than they typically get.

A terminal disclaimer is not just a formality. It imposes a common ownership requirement that can affect licensing, assignments, acquisitions and enforcement, and it may cut short a patent term that would otherwise result from PTA. Where common ownership cannot be achieved or maintained, for example in university-industry collaborations, joint development arrangements or after an inventor leaves, a disclaimer will not cure an OTDP rejection. Prosecution strategy, inventorship and ownership provisions need to be coordinated up front in those situations.

Alignment with Federal Circuit precedent

The ARP treated its result as compelled by Fallaux, Hubbell and Cellect, while acknowledging the Federal Circuit’s more recent focus on patent term in Gilead, Cellect and Allergan. Baurin is precedential within the USPTO and binds office personnel, but it does not bind the Federal Circuit or district courts. That leaves an open question the ARP expressly asked the Federal Circuit to resolve – whether the anti-harassment rationale is, by itself, still enough to reject an earlier-expiring claim under the current patent-term regime?⁵

Recent developments in this space

That question is now squarely before the Federal Circuit in In re Ablynx N.V., Appeal No. 26-1333, arising from Ex parte Baumeister. A decision there could address the continuing force of Fallaux and Hubbell, the scope of Allergan and the ARP’s proposed framework. A further appeal from Baurin itself could offer a second vehicle for review.⁶

Notes

Ex parte Baurin, Appeal 2024-002920, Application No. 17/135,529 (USPTO Appeals Review Panel, Aug. 6, 2026) (precedential).
Allergan USA, Inc. v. MSN Laboratories Private Ltd., 111 F.4th 1358, 1369-70 (Fed. Cir. 2024).
See In re Fallaux, 564 F.3d 1313, 1318-19 (Fed. Cir. 2009); In re Hubbell, 709 F.3d 1140, 1145-48 (Fed. Cir. 2013); In re Cellect, LLC, 81 F.4th 1216, 1229-30 (Fed. Cir. 2023).
See Cooley, PTAB Rehearing Limits Double Patenting Rejections of Earlier Patent Applications From Later-Filed Family Members, Jan. 26, 2026.
See Gilead Sciences, Inc. v. Natco Pharma Ltd., 753 F.3d 1208, 1214-17 (Fed. Cir. 2014); In re Cellect, LLC, 81 F.4th at 1226-30; Allergan, 111 F.4th at 1367-70.
In re Ablynx N.V., Appeal No. 26-1333 (Fed. Cir.) (appeal from Ex parte Baumeister, Appeal 2026-000193).

OSC Releases ‘Call for Interest’ in Space Commerce Certification Pilot Program

Wed, 02 Sep 2026 07:00:00 Z

On August 20, 2026, the Department of Commerce Office of Space Commerce (OSC) announced a call for interest for companies interested in participating in a pilot phase of the newly established Space Commerce Certification (SCC) framework. Submissions are due October 5, 2026, and should be submitted to Space.Certification@noaa.gov.

Space Commerce Certification framework

Under the proposed framework, companies would apply for per-mission certification and commit to adhering to the OSC-imposed “light-touch” requirements, such as orbital debris mitigation and payload review. OSC would conduct basic due diligence while simultaneously circulating the application to relevant portions of the interagency to identify any concerns relating to national security, foreign policy or international obligations, and safety of operations. Agencies involved in the process would include OSC’s Commercial Remote Sensing Regulatory Affairs department, Federal Communications Commission, Federal Aviation Administration, National Aeronautics and Space Administration and Department of War. If no concerns are identified, certification would be granted within 120 days of submission.

The SCC framework is a process designed to facilitate approval of mission authorizations for activities not explicitly governed by existing regulatory frameworks and provide additional certainty for such operators. Novel space activities include, but are not limited to, in-space manufacturing, orbital datacenters, satellite servicing, lunar operations and commercial inhabitable stations.

Participation in SCC pilot phase

OSC is inviting expressions of interest in participating in a pilot phase intended to test and further develop the new framework. Participants will have the opportunity to provide the agencies with feedback on the process. OSC will be highly selective during this pilot phase and will prioritize missions that are critical to industry advancement, are sufficiently likely to occur and represent high-utility use cases.

Interested companies must include in their submission to OSC:

The nominated entity’s full name, any affiliations and contact information.
Evidence of US entity ownership/operation.
A clear description of the intended operations, the space objects involved and the targeted launch/deployment timeline.
A statement confirming the submitter’s commitment to working with OSC, in a manner as transparent to the public as possible, to develop best practices.

If you are interested in learning more about the SCC pilot phase or framework, please reach out to one of the Cooley lawyers listed below.

New Federal Program Deputizes Private Companies to ‘Hack Back’

Tue, 01 Sep 2026 21:33:03 Z

On August 12, 2026, President Donald Trump signed a memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime” (memorandum). Historically, private companies have faced the imperative to defend themselves against cybercriminals while being legally barred from fighting back or “hacking back” – also known as active defense or active cyber response (ACR). The concept of ACR stems from a situation where participants in the program respond on behalf of victims of hacking by launching various offensive counterattacks against the hacker, with the intent of mitigating the effects of the attack. Business, scholars and politicians alike have debated this historical prohibition on “hacking back,” arguing over the limits on the tools available to the private sector to defend itself when it holds the vast majority of the world’s online infrastructure.

The memorandum directs the federal government to authorize vetted private companies to conduct offensive cyber operations, including surveillance and disruptive effects operations under federal oversight, against suspected foreign criminal hacking groups. For cybersecurity firms, threat intelligence providers and defense contractors, this memorandum potentially opens up new lines of activity and opportunity, but not without potential risk and exposure.

What the memorandum enables

The memorandum directs the National Coordination Center (NCC) to create and manage a program that would authorize certain preapproved “Participating Companies” to conduct cyber surveillance operations and cyber effects operations, under federal control and oversight, against foreign cyber-enabled transnational criminal organizations.

A cyber surveillance operation means accessing another organization’s computer systems or networks, without authorization from the owner or operator or by exceeding authorized access, primarily to passively collect information or intelligence, including information that could support a future cyber effects operation, with the intent to remain undetected.
A cyber effects operation means an operation that actually manipulates, disrupts, denies, degrades or destroys another organization’s information systems, networks or data, going beyond mere observation.

The program will be overseen jointly by the Department of Justice (DOJ) and the Department of Homeland Security (DHS), which must coordinate with each other to approve any operation, and every resulting action must be conducted on behalf of, and under the supervision of, these agencies.

The opportunity: a new kind of government relationship

For companies that provide offensive or clandestine cyber capabilities, this program provides a potential opportunity to become a partner to the US government. Participating companies would enter into contractual agreements with DOJ or DHS.

The memorandum also directs the government to build out the terms of this relationship over the coming months. By October 11, 2026, the program’s executive directors must establish operating procedures, including minimum standards for participation covering technical proficiency, proven performance, facility security, personnel vetting, competence and reliability. In establishing these procedures and standards, the executive directions must ensure eligibility criteria that allows for participation by both large companies, which would provide capacity and volume, and smaller or more specialized companies, which would potentially be better suited to more discrete tasks.

The guardrails: federal oversight

The memorandum builds in several layers of federal oversight, including requiring:

Individual approval of each operation by the program’s executive directors.
Participating Companies halt operations that stray outside of the approved scope and notify the NCC.
Participating Companies to maintain a bond or escrow of at least $1 million, to be forfeited if the company falls out of compliance with its contractual agreement.
Annual evaluation of Participating Companies for continued participation in the program.

The risk: residual liability

The harder question for any company considering this program is what happens when something goes wrong, and the memorandum signals that the government is also conscious of potential risks.

Authorized operations can have unexpected results

If a Participating Company discovers that an authorized operation has exceeded its approved parameters, such as by unintentionally targeting a US person, a US-based information system or a system controlled by a US person, it must immediately stop the operation, take steps to minimize the impact and notify the NCC, which then notifies the DOJ. Companies must also immediately report any imminent attack on US critical infrastructure they discover, or any reasonable belief that an approved operation may result in loss of life or serious injury, or rise to the level of use of force or armed attack under international law. The fact that the memorandum specifically anticipates and requires reporting on scenarios this serious is a signal of just how much can go sideways, even with rigorous vetting and federal sign-off.

Anti-hacking laws at home and abroad

The Computer Fraud and Abuse Act (CFAA) is an avenue for exposure, as it bars cyber activity undertaken without authorization or that exceeds authorized access – the very activity this memorandum enables. Anyone who suffers damage or loss from a violation of the CFAA may sue the violator for damages and equitable relief.

It is unclear whether this private right of action would survive against a defendant acting as a Participating Company under the program. The memorandum references compliance with the CFAA, alluding to an exemption for “any lawfully authorized investigative, protective or intelligence activity of a law enforcement agency of the United States [and certain other government entities].”¹ But it’s unclear the extent to which the exemption can apply to the actions of private entities undertaken on behalf of the government. This uncertainty means that a Participating Company could find itself exposed to a civil suit from whoever was harmed, having to litigate the exemption’s scope.

Foreign law adds another layer that the memorandum does not seek to address or resolve. These operations are meant to target servers, networks and infrastructure located outside the United States, and most countries have their own computer crime statutes that make unauthorized access to a computer system a domestic offense wherever it originates. A US government contract does not extend to a foreign hacking law and does not confer immunity from prosecution or civil suit in that country. A Participating Company conducting an approved operation against infrastructure or targets sitting in a foreign jurisdiction could still face criminal or civil exposure under that jurisdiction’s own laws.

No new swords or shields

Federal oversight also does not mean federal immunity for a company that steps outside the lines. The memorandum expressly caveats that it does not create any right or benefit, procedural or substantive, that any party can enforce against the United States or its officers and employees. That language lays out the government’s position that a Participating Company cannot point to this memorandum as a federal government indemnity for claims brought against the company, and a private party harmed by an operation gone wrong has no new claim against the government created by this memorandum.

Who else should be paying attention

This is not only a story for companies that might apply to the program. Cloud and hosting providers, internet service providers and critical infrastructure operators have reason to watch closely too, because these operations could touch their infrastructure without warning. A hosting provider or network operator whose infrastructure sits between a Participating Company and its intended target may lack visibility into an authorized operation running through its systems until something breaks.

The program also contemplates Participating Companies entering into commercial agreements with other private sector entities to receive threat intelligence in support of their cyber operations. Managed security service providers and incident response firms should also take note, even if they never seek Participating Company status themselves. However, such entities also run the risk of identifying operations by Participating Companies when responding to incidents at foreign entities, which may present conflicts of interest between their incident response and threat intelligence services.

Before entering into any threat intelligence sharing arrangement with a Participating Company, a company should understand exactly how its data and its name could end up feeding into a federally authorized cyber operation, and what obligations or exposure that creates for the company supplying the intelligence, not just the company acting on it.

Looking ahead

The program’s operating procedures are not due until October, so the details of eligibility, vetting and contract terms are still being written. But companies in the defense industrial base, cybersecurity, and cyber operations, threat intelligence and managed security spaces should start thinking now about:

Whether becoming a Participating Company, or a commercial data partner to one, fits the company’s risk tolerance and business strategy.
What contractual protections, insurance and indemnification the company would need before agreeing to conduct operations under this kind of federal authorization.
Developing a legal strategy and assessing potential exposure under the CFAA and other anti-hacking laws (including outside of the US).
Preparedness for inadvertent or intentional retaliation or escalation from targets of cyber operations conducted under the program.
Whether the company’s infrastructure or client base could be swept into someone else’s authorized operation, even without any direct involvement in the program.

This memorandum marks a shift in how the government defines the private sector’s role in the fight against cybercrime. Companies in this space have an opportunity to contribute to the disruption of cyber-enabled transnational criminal organizations, but the legal exposure runs alongside the opportunity, not behind it. If you have questions about whether your company should participate in this program, how to structure a commercial data-sharing arrangement tied to it or how to manage the liability that comes with operating in this space, please contact the Cooley cyber/data/privacy practice.

Notes

18 USC § 1030(f).

FTC, Requiring Divestitures, Approves Final Consent Decree in Ascension/AmSurg Deal

Tue, 01 Sep 2026 21:11:00 Z

On August 25, 2026, the Federal Trade Commission (FTC) announced it had finalized a consent order resolving antitrust concerns arising from Ascension Health Alliance’s $3.9 billion acquisition of AmSurg. This order arrives against the backdrop of heightened FTC attention to the healthcare sector. In March 2026, FTC Chairman Andrew Ferguson directed the agency to form a Healthcare Task Force to pursue a “coordinated, integrated approach” to healthcare enforcement and advocacy in coordination with other agencies and law enforcement partners (such as the Department of Health and Human Services and Department of Justice). The final order in the Ascension/AmSurg matter reflects this continued focus and offers a useful window into how the FTC is applying it in practice.

The final order requires Ascension to divest seven AmSurg ambulatory surgery centers (ASCs) across five metro areas, settling allegations that the deal would substantially lessen competition for certain outpatient surgical services. The order also imposes a 10-year prior notice obligation on Ascension for future ASC acquisitions in the affected markets, as well as transition assistance, nonsolicitation, asset maintenance and monitor provisions typical of recent FTC healthcare merger remedies. True to FTC form, the matter demonstrates the agency’s continued scrutiny of vertical and horizontal healthcare consolidation at the local, service level – even where the overall transaction value and combined entity size might not otherwise trigger significant antitrust concern nationally.

Background

On June 2, 2026, the FTC announced a proposed consent order requiring Ascension, a national nonprofit health system, to divest several ASCs in order to proceed with its proposed acquisition of AmSurg. The FTC’s June 1 complaint alleged that the combination of Ascension and AmSurg, both providers of outpatient surgical services ranging from cataract surgeries to colonoscopies, would limit competition for certain outpatient surgical services performed by gastroenterologists, ophthalmologists and orthopedists in the Nashville, Tennessee, Panama City, Florida, Tulsa, Oklahoma, Waco, Texas, and Wichita, Kansas, metropolitan areas. The FTC alleged that this loss of competition would likely lead to higher surgery prices for patients while also threatening to lower the quality of care and limit innovation in surgical services. Daniel Guarnera, director of the FTC’s Bureau of Competition, stated that, “[a]ccess to quality surgical care at an affordable price is critically important for millions of Americans across the country,” and that the divestitures would “help preserve a competitive market that will allow patients to get the care they need at a fair price.”

Under the terms of the proposed order, Ascension agreed to divest seven AmSurg ASCs located in the markets where the FTC identified competitive concerns. Six of the centers were to be divested to SC Affiliates, while the seventh, located in Panama City, was to be divested to Florida Gastroenterology Center (referred to in the order as the Panama City Doctors), a physician group that already held a minority stake in that facility and would assume full ownership. The proposed order also required Ascension, Ambulatory Topco and AmSurg to provide up to one year of transition assistance, protect confidential information, maintain the viability of the divested assets pending transfer and refrain from interfering with employment relationships at the affected facilities. The FTC further required the appointment of a monitor to oversee compliance and imposed a 10-year prior notice obligation on Ascension for any future ASC acquisitions in the relevant metro areas.

The FTC’s investigation was conducted in coordination with the state attorneys general of Florida, Oklahoma and Tennessee, and the vote to issue the complaint and accept the consent agreement for public comment was 2 – 0. The proposed order was then placed on the public record for a 30-day comment period.

Why this matters

Local market power, not deal size, still drives FTC scrutiny. The FTC’s focus here was narrow. It did not object to the transaction as a whole, but to the loss of competition in five specific metro areas for three specific types of outpatient surgery. This demonstrates that deal size alone does not determine whether the FTC intervenes: A modest, local overlap in a single service may be enough to trigger a complaint and require a remedy. Companies acquiring ambulatory surgery centers, physician practices or other outpatient providers should expect the FTC to continue to analyze competition market by market and service by service, not just at the level of the overall transaction.
A 10-year leash: Prior notice extends well beyond Hart-Scott-Rodino (HSR) obligations. The order also puts Ascension under long-term FTC oversight – for the next 10 years, Ascension must notify the FTC at least 30 days before acquiring any interest in an outpatient surgery center in the five affected metro areas. This notice obligation applies even to deals that are too small to require a standard HSR filing. This means that the FTC can review Ascension’s future, smaller deals in these markets that might otherwise escape antitrust review entirely. Companies with a history of FTC healthcare enforcement should expect similar long-term reporting or notice conditions in future settlements.
The FTC is backing its words with action. The Ascension/AmSurg divestitures demonstrate yet another example of the FTC following through on its enforcement priorities, not just announcing them. Just days before finalizing this order, the FTC won a full trial in federal court blocking Henkel’s proposed acquisition of Liquid Nails, a construction adhesives merger, and secured a permanent injunction rather than settling for a preliminary one. That case was the first merger challenge litigated entirely in federal court under Ferguson’s stated preference for bringing merger cases only in federal court and bypassing the FTC’s in-house Part 3 administrative process. Similarly, the Ascension/AmSurg order highlights the agency’s announced commitment to working with other law enforcement partners to pursue coordinated enforcement efforts in the healthcare sector. Taken together, the Ascension/AmSurg order and the Henkel litigation win show that the agency is pursuing its stated priorities in practice, and that the FTC is prepared to both negotiate strong structural remedies and litigate mergers to a final result in federal court when a negotiated fix is not available.

CFTC’s Innovation Advisory Committee Holds Inaugural Meeting

Tue, 01 Sep 2026 07:00:00 Z

The Innovation Advisory Committee of the Commodity Futures Trading Commission (CFTC) held its inaugural meeting on August 20. The meeting brought together industry representatives from crypto, traditional financial markets and technology to discuss crypto assets, AI and prediction markets.

Roadmap for the new frontier of finance

In his opening remarks, CFTC Chairman Michael Selig previewed a “roadmap for the new frontier of finance,” stating that if the pending CLARITY Act, legislation that would establish a federal regulatory framework for digital assets, does not advance, he would direct CFTC staff to move swiftly to propose crypto market structure rules under the CFTC’s existing authority. Specifically, Selig directed CFTC staff to explore rules that could enable current registrants, as well as unregistered crypto exchanges, to be designated by the CFTC as a type of designated contract market (DCM) known as a “crypto asset market” and offer crypto asset trading on a leveraged or margined basis under the CFTC’s regulatory oversight.

Selig also directed staff to engage with developers of on-chain finance protocols to establish pathways for developers to offer their protocols in a legal and compliant manner in the United States. Selig’s remarks came a day after President Donald Trump noted in a White House press conference attended by crypto industry leaders that the CFTC was working to bring Hyperliquid, the most prominent perpetual swap exchange, into the United States.

On prediction markets, Selig outlined a three-part roadmap, which is reflected in a series of recently or soon-to-be proposed rules and amendments:

First, proposed amendments to CFTC Rule 40.11 to define key terms, such as “gaming,” and enumerate public interest criteria for evaluating certain event contracts, seeking to provide clarity on issues that have been hotly debated in connection with sports and election event contracts.
Second, a proposed rule to modernize the reporting framework for fully collateralized event contracts.
Third, anticipated amendments to Parts 38 and 40 of the CFTC’s regulations to modernize the core principles and listing rules governing DCMs that list event contracts, and to institute consumer protection requirements, including clearer expectations for product governance, market design and incentive programs.

Selig also reiterated the CFTC’s position that federally regulated event contracts fall within its exclusive jurisdiction and stated that the CFTC would continue defending that jurisdiction against efforts by states to apply state gaming laws to DCMs.¹

As part of the roadmap’s AI agenda, Selig highlighted a request for comment on compute markets issued earlier that week, describing plans to develop a regulatory framework supporting transparent markets for compute capacity as a commodity with reliable price discovery and effective hedging.

Industry feedback and recommendations

Throughout the meeting, Committee Chair Walt Lukken, president and CEO of the Futures Industry Association, posed questions to participants seeking feedback for the CFTC’s policy and rulemaking priorities. The discussion reflected both frustration with prior regulatory uncertainty and regulation by enforcement and appreciation for the CFTC’s shift toward engagement and regulatory action.²

1. Harmonization and speed to market

Industry participants were candid about their experiences under the prior administration. Several described facing investigations, Wells notices, litigation, de-banking, and overlapping federal and state requirements without clear rules governing their products. Participants said these conditions caused companies to move personnel and products overseas, incur significant legal costs, or discouraged entrepreneurs from building crypto businesses in the United States.

Against this backdrop, participants welcomed collaboration between the CFTC and Securities and Exchange Commission (SEC)³ and called for greater harmonization to reduce the costs and friction associated with overlapping regulatory regimes. Certain cross-agency products were cited as needing coordinated guidance, including equity perpetual contracts, KPI event contracts referencing company earnings and Bitcoin index options. Participants also noted that emerging structures, such as vaults, may require a collaborative approach given their mixed securities, commodities and derivatives characteristics.

One participant called for clarity on whether futures commission merchants may self-custody customer segregated funds in tokenized form, while another highlighted the value unlocked by the joint SEC-CFTC conditional exemptive orders issued in April 2026 permitting customer cross-margining across treasury cash positions and futures positions. More broadly, several participants noted their support for the CLARITY Act, but urged the CFTC to continue using its existing authority rather than wait indefinitely for market structure legislation. Speed was a recurring concern, with participants arguing that regulatory uncertainty and state-by-state requirements have placed US firms at a competitive disadvantage to offshore firms, and urging faster regulatory decision-making within a principles-based framework capable of keeping pace with changing technology.

2. Balancing innovation and market integrity in prediction markets

Prediction markets generated the sharpest debate of the meeting. Several participants urged the CFTC to defend its federal jurisdiction, preserve the ability of DCMs to self-certify contracts, and maintain a unified federal framework rather than subject federally regulated platforms to differing state regimes. Supporters argued that prediction markets can provide price discovery, risk-management tools and useful information while offering consumer protection that may not exist on offshore or state-regulated venues.

Much of the discussion focused on where the CFTC should draw the line on permissible event contracts. The CFTC’s proposed amendments to Rule 40.11 would define terms such as “gaming” and establish criteria for determining when contracts involving enumerated activities may be prohibited as contrary to the public interest. Participants differed over how restrictive those standards should be. Some argued that these sensitive markets may provide valuable information to the public, while others emphasized that contracts whose outcomes can be materially influenced by a single person or small group raise significant market integrity concerns.

One participant proposed a presumption in favor of listing novel contracts unless an identifiable public harm exists, coupled with consideration of whether the contract bears a direct causal relationship to that harm and the degree to which the outcome is susceptible to manipulation. The discussion exposed a broader divide between traditional exchange operators and novel prediction market platforms over whether the existing self-certification framework provides adequate safeguards against manipulation, particularly for sports, “mention” and other event contracts whose outcomes may be influenced by individual actors. Prediction market operators emphasized the importance of rapid self-certification for markets tied to current events, while other participants urged closer scrutiny of contracts that may present heightened manipulation risks.

The discussion also extended to retail safeguards and competitive parity. Participants raised concerns regarding potential regulatory arbitrage between direct-to-DCM and Futures Commission Merchant-intermediated retail access, including differences in know your customer (KYC) and customer identification requirements, and several supported applying comparable protections regardless of the access model.

Participants also raised concerns about US users accessing offshore platforms through VPNs and discussed the need for clearer and more consistent expectations regarding surveillance, product governance, responsible trading and other consumer protections. The debate underscored the CFTC’s challenge in facilitating innovation while maintaining consistent market integrity and customer protection standards across rapidly evolving prediction market business models.

3. AI: Focus on conduct, not technology

In respect of AI’s growing role in algorithmic trading and market operations, participants urged the CFTC to regulate conduct rather than specific models or tools. One participant cited the prior Regulation Automated Trading proposal, and the controversy surrounding proposed access to source code, as a cautionary example, recommending that the CFTC focus on attribution and accountability so that a responsible person or entity remains identifiable regardless of whether an order originates from an AI model, traditional algorithm or other automated system.

Cybersecurity and operational resilience of market infrastructure were a related focus. Participants described AI as both a threat vector and a defensive tool (useful for automated code review, formal verification of on-chain smart contracts, vulnerability detection and market surveillance) and suggested that advances in formal verification could over time support more stringent software reliability expectations. Others cautioned against restricting access to frontier AI models, arguing that broad access helps security researchers find vulnerabilities before attackers do, and that restrictions offer limited benefit where comparable models remain available offshore.

What’s next?

The meeting reflected a shift in the CFTC’s approach toward facilitating innovation through rulemakings and engagement with industry. Market participants should watch three developments in particular:

Potential crypto-market-structure rulemaking under the CFTC’s existing authority if the CLARITY Act stalls.
The pending Rule 40.11 proposal and forthcoming Parts 38 and 40 amendments governing prediction markets, including retail protections, product governance and market-design standards.
Continued CFTC-SEC coordination on products that implicate both securities and derivatives regulation.

The CFTC’s parallel work on compute markets also bears watching, as it considers how its existing commodity and derivatives framework may apply to an emerging market for compute capacity.

Notes

On April 2, 2026, the CFTC, together with the Department of Justice, filed lawsuits against Arizona, Connecticut and Illinois challenging state efforts to apply state law to CFTC-registered designated contract markets. On April 24, the CFTC sued New York to halt the state’s application of state gambling laws to CFTC-regulated markets, and it subsequently brought similar actions against Wisconsin, Minnesota, New Mexico and Kentucky. The CFTC also moved to intervene in litigation in Rhode Island and has filed amicus briefs in prediction-market litigation involving Nevada, Massachusetts and Ohio.
For example, on May 29, 2026, the CFTC issued a policy statement addressing the listing of perpetual contracts. On June 10, 2026, it proposed amendments to its rules governing event contracts involving enumerated activities; on June 18, 2026, the CFTC and SEC jointly requested comment on opportunities to clarify and harmonize derivatives product definitions and related jurisdictional issues; on June 22, 2026, the CFTC requested comment on 24/7 trading and perpetual contracts referencing certain energy commodities; and, on August 19, 2026, the CFTC requested comment on the listing of derivatives contracts referencing computing capacity.
This collaborative posture may in part reflect Selig’s prior service as a senior advisor to SEC Chairman Paul Atkins.

2026 Proxy Season Highlights: Final Shareholder Proposal Results and Management Proposals

Mon, 31 Aug 2026 15:25:00 Z

Despite uncertainty heading into the 2026 proxy season (January 1 – June 30 meetings), final voting results largely continued established patterns. Governance proposals attracted the strongest support, while environmental and social (E&S) proposals and proposals from anti-environmental, social and governance (ESG) proponents received considerably less support. Director elections and say-on-pay proposals continued to receive strong shareholder support, and ISS recommendations were again associated with sharp differences in voting outcomes across shareholder and management proposals.

Building on our early review of the 2026 shareholder proposal season, this alert reviews final 2026 shareholder proposal voting results across the Russell 3000, with separate analyses of tech companies, life sciences companies and, for the first time, “recently public companies,” defined as Russell 3000 companies that went public since 2016. This additional lens complements Cooley’s inaugural Post-IPO Governance Trends Report, which examines how governance practices and annual meeting voting outcomes evolve during companies’ early years as public companies. We also highlight key trends in director elections and say-on-pay votes across each of these groups, and we review voting results for select nonroutine management proposals across the Russell 3000.

This alert precedes the SEC’s expected September proposal to rescind Rule 14a-8. This proposal is currently under review by the White House, and Cooley’s June alert includes a discussion of how such a proposal may impact the 2027 proxy season.

Shareholder proposals

Although the SEC staff’s withdrawal from its traditional role in the Rule 14a-8 no-action process created substantial uncertainty, 2026 voting results largely followed recent patterns. Governance proposals remained the best-supported category, averaging 34% support, compared with 16% for environmental proposals, 15% for social proposals and 5% for proposals from anti-ESG proponents. The results reinforce a familiar divide: proposals addressing core governance and shareholder rights matters continue to attract materially more investor support than E&S proposals. Looking ahead, the forthcoming SEC proposal to rescind Rule 14a-8 and the SEC staff’s recent decision to end no-action responses entirely could produce more significant change in 2027, including more aggressive efforts by proponents to challenge exclusions or other actions to preserve access to companies’ proxy materials.

2026 shareholder proposals at Russell 3000 companies

ISS recommendations and shareholder support

ISS recommendations were closely associated with voting outcomes across every proposal category. Across all Russell 3000 companies, proposals backed by ISS averaged 33% support for environmental matters, 34% for social matters, 41% for governance matters and 24% for proposals from anti-ESG proponents, compared with 14%, 10%, 17% and 3%, respectively, when ISS opposed them. Although these results reflect correlation rather than causation, they underscore the continuing importance of proxy advisor recommendations to voting outcomes.

Average shareholder support varied sharply with ISS recommendations

Sector trends

Tech companies

Governance proposals at tech companies substantially outperformed other proposal categories, averaging 37% support compared with 13% for both environmental and social proposals. Proposal activity also remained concentrated among large-cap tech companies, with recipients having a median market capitalization of $61 billion.

Tech companies continued to be the primary target of anti-ESG proponents, accounting for 28% of their proposal submissions in 2026. Most of these proposals focused on social topics, with diversity, equity and inclusion (DEI), viewpoint and ideological discrimination, AI and data privacy representing the most common topics. Consistent with the broader market, shareholder support for social-focused proposals submitted by anti-ESG proponents at tech companies remained low in 2026, averaging 2%.

2026 shareholder proposals at tech companies

Life sciences companies

While shareholder proposal activity remained relatively limited at life sciences companies, voting outcomes were generally consistent with broader market trends. Governance proposals averaged 32% support, compared with 14% for social proposals and 1% for proposals from anti-ESG proponents, and no environmental proposal went to a vote. Proposal activity also remained concentrated among large-cap life sciences companies, with recipients having a median market capitalization of $30 billion.

2026 shareholder proposals at life sciences companies

Recently public company trends

Among Russell 3000 companies that went public since 2016, shareholder proposal activity was relatively limited and skewed toward larger companies. We identified 34 publicized proposals – representing less than 6% of total publicized submissions – and the median market capitalization of recently public companies receiving proposals was $14.8 billion. Of the 26 recipient companies, 16 had market capitalizations above $10 billion, and none went public after 2021. Where proposals did reach recently public companies, governance issues dominated. Each of the four proposals receiving majority support addressed a foundational governance matter: two sought board declassification, one sought majority voting for director elections and one sought majority voting for director removal. These results are consistent with a broader post-IPO pattern: As companies mature and their ownership bases broaden, IPO-era governance structures attract increasing shareholder scrutiny.

2026 shareholder proposals at recently public companies

Management proposals

Director elections

Director election results remained strong in 2026. Average support was 95.4% across Russell 3000 companies, compared with 94.3% at tech companies, 92.4% at life sciences companies and 92.9% at recently public companies. Similarly, 87.2% of all Russell 3000 director nominees received more than 90% support, compared to 83.6%, 71.8% and 75.3% of director nominees at tech, life sciences and recently public companies, respectively.

Director election vote results by support level

ISS opposition continued to correlate meaningfully with voting outcomes across all companies, although its incidence varied significantly by group. ISS recommended against 11.6% of all Russell 3000 director nominees, compared with 15% at tech companies, 26.1% at life sciences companies and 36.2% at recently public companies. Despite receiving the highest opposition rate, director nominees at recently public companies averaged nearly 93% support. As discussed in our Post-IPO Governance Trends Report, proxy advisors frequently oppose directors at newly public companies because of governance provisions commonly adopted at the time of IPO, but these recommendations generally have a more limited impact on voting outcomes, likely reflecting concentrated ownership and greater investor tolerance for these governance structures during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to evolve their governance practices.

Variance in director election support levels by ISS recommendation

Say-on-pay

Say-on-pay results also remained strong, with average support of 92% across the Russell 3000, 89.7% at tech companies, 90.8% at life sciences companies and 92% at recently public companies. Each group saw year-over-year increases in average support and in the percentage of proposals receiving more than 90% support.

Say-on-pay vote results by support level

ISS recommendations were again closely associated with say-on-pay voting results. Across the Russell 3000, ISS-supported proposals averaged 94.4% support, compared with 73.5% for ISS-opposed proposals. The gap was widest among tech companies at 22 percentage points, though this gap was down from 26 points in 2025. Recently public companies had a higher rate of ISS opposition than the broader Russell 3000, but adverse recommendations had a smaller effect on their voting outcomes. As with director elections, this likely reflects concentrated ownership and greater investor patience during the early post-IPO period, particularly among large institutional investors that often afford newly public companies more time to mature their compensation practices.

Variance in say-on-pay support levels by ISS recommendation

Select nonroutine management proposals

Responsive governance proposals

Management proposals seeking to unwind long-standing governance provisions declined in 2026. Board declassification proposals declined from 44 in 2025 to 31 in 2026, while proposals to eliminate supermajority vote requirements fell from 70 to 47. The decline likely reflects market maturation rather than diminished focus on these core governance issues, as many larger-cap, consumer-facing companies that historically faced the greatest investor pressure to eliminate these structures have already done so.

Shareholder support remained relatively steady, averaging 79% for declassification proposals and 77% for supermajority-elimination proposals, compared with 80% for both proposal types in 2025. However, passage rates notably declined, from 75% to 68% for declassification proposals and from 70% to 57% for supermajority-elimination proposals. The lower passage rates appear to reflect stringent charter or bylaw amendment thresholds rather than declining shareholder support. Many such amendments require approval by a supermajority of outstanding shares, and in each of 2025 and 2026, only one proposal to eliminate a supermajority vote requirement failed to receive support from a majority of outstanding shares.

DExit reincorporation proposals

Nevada and Texas remained the primary destinations for companies seeking to leave Delaware, with Texas emerging as the top destination in 2026. Nevada attracted four Delaware exit (DExit) proposals in 2024 and eight in 2025, but only three in 2026, while Texas increased from one proposal in 2024 and none in 2025 to 10 in 2026.

Notably, nearly 70% of the 26 companies that have sought shareholder approval to reincorporate from Delaware to Nevada or Texas since 2024 had a controlling shareholder or a significant insider voting bloc. This trend is consistent with the role that controlling shareholder concerns have played in driving the broader DExit movement.

Although 88% of DExit proposals have passed, this high success rate appears to reflect concentrated insider ownership at many of the companies pursuing these reincorporations rather than broad investor support. Assuming insiders voted all of their shares in favor, estimated noninsider support averaged 43% across all DExit proposals, including 30% at controlled companies and 55% at noncontrolled companies. This disparity suggests that institutional investors are generally more skeptical of DExit proposals at controlled companies.

Support from the Big Three – BlackRock, Vanguard and State Street – for DExit proposals has also been limited. While all three firms supported Tesla’s 2024 move to Texas, among Nevada reincorporation proposals in 2024 and 2025, BlackRock, Vanguard and State Street supported only 25%, 17% and 0%, respectively. Voting data for institutional investors on 2026 reincorporation proposals will become available in September 2026.

Officer exculpation proposals

Among Delaware-incorporated Russell 3000 companies, officer exculpation proposals continued to decline in prevalence following the initial wave of proposals after Delaware authorized officer exculpation in 2022. Proposal volume fell from 115 in 2025 to 53 in 2026, average support declined from 72% to 66% and the passage rate decreased from 93% to 87%. The decline occurred despite a modest increase in ISS support, as the percentage of proposals receiving favorable ISS recommendations rose from 84% in 2025 to 87% in 2026. Nevertheless, officer exculpation proposals continued to pass at a high rate.

Notes

The data presented in this alert are sourced from ISS Voting Analytics, as well as other databases, information publicized by shareholder proposal proponents and companies, and independent research, and focus exclusively on Russell 3000 companies.
For purposes of shareholder proposals discussed in this alert, “tech” includes core hardware, software and computing companies, as well as web-focused businesses in retail, transportation, business services and other industries, such as ride share, ecommerce and fintech companies, to approximate the commonly understood scope of the tech sector. Due to the volume of management proposals, discussion of management proposals in this alert involves a more restrictive definition of tech, focusing on companies classified under Global Industry Classification Standard (GICS) codes 4510 (Software & Services), 4520 (Technology Hardware & Equipment) and 4530 (Semiconductors & Semiconductor Equipment).
For purposes of all proposals discussed in this alert, “life sciences” refers to companies classified under GICS code 3520 (Pharmaceuticals, Biotechnology & Life Sciences).
For purposes of all proposals discussed in this alert, “recently public companies” refers to public companies that went public since 2016.

Senators Press FINRA on ACATS Fraud: What Broker-Dealers Should Do Now

Mon, 24 Aug 2026 07:00:00 Z

On August 20, 2026, US Senators Ron Wyden and Elizabeth Warren sent a letter to FINRA President and CEO Robert W. Cook urging immediate regulatory action on fraud involving the Automated Customer Account Transfer Service (ACATS), the system used to move customer securities and cash between brokerage firms. The letter was also sent to Securities and Exchange Commission (SEC) Chairman Paul Atkins and Depository Trust & Clearing Corporation (DTCC) President and CEO Frank La Salla, underscoring that congressional concern extends beyond FINRA’s direct regulatory perimeter. The letter identifies specific ACATS security gaps, names individual firms based on their current protections and calls for new rules on customer notification, transfer locks, transaction authentication and phishing-resistant multifactor authentication (MFA). FINRA must respond by September 17, 2026.

Although directed at FINRA rulemaking rather than any single firm, the letter signals where regulatory and reputational scrutiny is heading. Broker-dealers and other financial institutions handling ACATS transfers should assess their transfer-security controls, authentication practices and customer communications now rather than wait for a final rule.

The vulnerability

Administered by the US National Securities Clearing Corporation and governed by FINRA Rule 11870, ACATS gives an outgoing firm only one business day to validate or object to a transfer request and, if validated, three business days to complete it. The letter explains that this speed – designed to stop firms from obstructing customers who want to leave a brokerage firm – has created a gap: The outgoing firm does not need to notify or authenticate the actual account holder before a transfer proceeds. Fraudsters have exploited this gap by opening fraudulent accounts elsewhere using stolen information and pulling the victim’s assets before the victim knows a transfer occurred. Wyden and Warren’s letter cites an October 2025 New York Times investigation reporting on incidents at firms including Vanguard and Merrill.

Compounding the problem, the letter claims many firms do not reliably notify customers when a transfer is initiated. FINRA’s Regulatory Notice 23-06, published in 2023, recommended but did not require such notification. The letter states that certain firms currently give no notice at all, eliminating the window customers would otherwise have to stop a fraudulent transfer.

Firm-by-firm findings

The letter reports firm-by-firm findings across multiple controls, including self-managed transfer-block features and support for phishing-resistant MFA, based on a review conducted by the senators’ offices and direct outreach to major brokerages. The findings show substantial variation across the industry, with some firms offering robust, customer-controlled protections and others offering little or none.

Firms named in the letter should expect this level of public, comparative detail to be referenced in follow-on inquiries, press coverage or state regulatory attention, independent of what FINRA ultimately does with the rulemaking request.

What the letter asks FINRA to do

The letter’s near-term request is to codify Regulatory Notice 23-06 into a binding rule requiring transfer notifications and a self-managed, opt-in transfer lock. Longer term, the request is to require verified outgoing-holder confirmation via a dual-track framework, plus mandatory phishing-resistant MFA (passkeys), citing NIST SP 800-63 and 800-53, OMB M-22-09, and Japan’s recent passkey mandate as a model.

Why it matters

Congressional letters of this kind do not themselves create binding legal obligations, and FINRA is not required to adopt any of the specific proposals described above. However, the letter is a meaningful signal for several reasons:

It follows FINRA’s own 2023 guidance identifying transfer notification as an “effective practice,” meaning FINRA has already laid analytical groundwork that could support converting guidance into a rule.

It references federal cybersecurity authentication standards (NIST SP 800-63 and 800-53, OMB M-22-09) that already exist and could be invoked in examinations, enforcement referrals or private litigation irrespective of a new FINRA rule.

It creates a public record, firm by firm, of which institutions do and do not currently offer self-managed transfer locks and phishing-resistant MFA, which could be used by regulators or plaintiffs’ counsel regardless of the rulemaking outcome.

It highlights account-takeover and new-account fraud typologies that intersect with existing broker-dealer regulatory obligations, including Regulation S-P safeguarding requirements, SEC and FINRA Identity Theft Red Flags obligations under Regulation S-ID, FINRA Rules 3110 and 3120 supervisory obligations, and state data breach notification and safeguards laws that may be triggered if customer accounts are compromised.

Recommended actions

We recommend that broker-dealers and other financial institutions handling ACATS transfers take the following steps:

Inventory ACATS transfer-lock controls and assess moving to a self-managed, customer-controlled model. Firms should evaluate whether they can deploy a comparable feature before any FINRA mandate.

Confirm whether outbound transfer requests trigger customer notification, and if they do not, consider implementing a notification protocol.

Benchmark MFA offerings against phishing-resistant standards (NIST SP 800-63 and 800-53, OMB M-22-09), with particular attention to passkey deployment.

Review fraud-monitoring and escalation procedures for the account-opening/ACATS-pull typology described in Wyden and Warren’s letter.

Prepare for possible interest from regulators, plaintiffs’ counsel and the media, including SEC examination inquiries, state attorney general and state securities regulator inquiries, and update board/risk-committee reporting as needed.

Monitor FINRA’s response, due September 17, 2026, and any resulting notice-and-comment rulemaking.

How we can help

Our cyber/data/privacy practice advises broker-dealers, banks, investment management firms and other financial institutions on FINRA and SEC cybersecurity and authentication obligations, incident response, and regulatory engagement. We can help benchmark your current controls against the protections highlighted in the letter, prepare for examination inquiries and, if useful, submit comments in any resulting FINRA rulemaking.

FTC Court Win Blocks Henkel’s Acquisition of Liquid Nails

Fri, 21 Aug 2026 18:48:40 Z

On August 17, 2026, the Federal Trade Commission (FTC) announced it had secured a win in court to block the merger of two of the largest construction adhesive brands. The ruling is a significant triumph for the FTC and a useful data point for dealmakers evaluating how the agency is litigating – and where it is choosing to litigate – merger challenges under Chairman Andrew Ferguson.

On August 14, 2026, the US District Court for the Southern District of New York granted the FTC’s request for a permanent injunction to block Henkel’s proposed $725 million acquisition of Liquid Nails from private equity firm American Industrial Partners. Henkel is the manufacturer of the industry-leading Loctite brand of construction adhesives. In December 2025, the FTC sued to block Henkel’s proposed acquisition of Liquid Nails, Loctite’s chief rival in the construction adhesives market, alleging that combining the two brands would eliminate significant head-to-head competition and lead to higher prices, lower quality and reduced innovation for a product widely used in home building and maintenance.

After a seven-day trial, the district court sided with the FTC and issued a permanent injunction blocking the deal outright, rather than referring the matter back to the agency’s administrative process. Announcing the result, FTC Bureau of Competition Director Daniel Guarnera framed the case as a straightforward horizontal competition problem: “Anyone who looked at the construction adhesives shelves of a hardware store or home improvement retailer could see that a merger between Loctite and Liquid Nails would be a bad deal for Americans.” He added that the decision “will ensure that Americans benefit from continued competition between Loctite and Liquid Nails, including lower prices and higher quality.”

Beyond the substantive result, the agency was explicit that it views this case as validating a procedural shift, describing the win as marking “the Commission’s new approach to seeking permanent injunctions to block anticompetitive mergers without the need to continue cases in administrative proceedings,” or litigating merger challenges to a final, binding result in federal district court rather than pursuing a preliminary injunction in federal court while the underlying merits proceed in the FTC’s own administrative tribunal.

The Loctite/Liquid Nails result, along with public comments from Ferguson that the agency should bring its merger challenges directly in federal court rather than through the FTC’s in-house administrative process, signals a departure from the agency’s traditional two-track model. Taken together with the outcome in this case, the FTC seems to be making an intentional choice: Rather than seeking a preliminary injunction to preserve the status quo while an administrative case proceeds on a separate track, the agency litigated this matter through trial in district court to a final, appealable injunction.

Why this matters

For parties contemplating mergers that raise potential horizontal overlap concerns, several practical takeaways emerge:

Prepare for federal court, not the FTC’s administrative docket. If the agency is committed to litigating merger challenges to final judgment in federal district court, merging parties should plan for full-blown federal litigation – including trial – as the primary (not merely preliminary) battleground, including the associated discovery burden, timeline and evidentiary standards that this entails.
Building materials and other consumer-facing input markets remain a priority. The agency’s public messaging ties this enforcement action to housing affordability and cost-of-living themes, signaling continued scrutiny of consolidation in building products and other markets seen as directly affecting household costs.
Brand concentration arguments retain force. The FTC’s theory here rested on eliminating direct competition between two well-known, closely positioned brands within the same category – a straightforward horizontal theory that remains a core enforcement priority regardless of procedural reforms.

Q2 2026 Venture Financing Report – Record $85.7 Billion Invested; Up Rounds Remain Strong

Mon, 17 Aug 2026 19:41:25 Z

Cooley handled 166 reported venture capital financings in Q2 2026, representing $85.7 billion of invested capital, driven by a large late-stage tech deal. Compared to Q1 2026, deal volume declined for Series Seed, Series B, Series D and later rounds, while Series A and Series C rounds increased. Overall invested capital more than doubled from Q1 2026, reaching the highest level recorded in the history of this report (since 2014), with invested capital rising across all stages.

Median pre-money valuations increased for Series Seed and Series B rounds but decreased for Series A, Series C, Series D and later rounds. Series B rounds showed the greatest increase, with the median pre-money valuation rising from $152.5 million in Q1 to $185.2 million in Q2. Series D and later rounds showed the greatest decrease, with the median pre-money valuation dropping from $2.4 billion in Q1 to $600 million in Q2. The percentage of deals with pre-money valuations above $100 million (across all stages) remained elevated, increasing from 41% in Q1 to 48% in Q2.

Up rounds decreased to 83.6% of deals, while flat rounds and down rounds increased to 4.3% and 12.1%, respectively. By comparison, Q1 saw 86.6% up rounds, 2.5% flat rounds and 10.9% down rounds.

Recapitalizations increased from 1.75% in Q1 to 1.81% in Q2, while the percentage of deals with pay-to-play provisions increased from 7% to 8.4%.

Liquidation preference structures remained favorable to companies, with 95.8% of deals having a “1x” liquidation preference, and 96.4% of deals having nonparticipating preferred stock. Redemption provisions decreased from 6.4% in Q1 to 5.4% in Q2, and accruing dividends increased from 2.3% in Q1 to 3% in Q2.

In PitchBook’s Q1 2026 Global League Tables, Cooley was ranked the #1 law firm in the US and globally for representing companies raising venture capital, a ranking the firm has held for more than six consecutive years. PitchBook also ranked Cooley #1 for deals overall in the US and globally based on company representation across venture capital financings, IPOs, M&A and private equity transactions.

Additionally, LSEG’s Global Venture Capital Review for Q1 2026 named Cooley the #1 firm for representing companies raising venture capital based on deal count. LSEG also named Cooley the #1 law firm for venture capital firm representations based on overall deal count and overall deal value.

Spotlight on technology

Tech company venture financing deal volume increased slightly, from 94 deals in Q1 to 95 deals in Q2. Invested capital doubled from $36.7 billion in Q1 to $73.9 billion in Q2. This increase in invested capital was primarily driven by one large late-stage tech deal that closed this quarter. The median reported deal size of venture financings for tech companies increased, from $18.5 million in Q1 to $30.5 million in Q2.

Spotlight on life sciences

Life sciences deal activity declined in Q2, with 27 reported deals and $1.1 billion of invested capital, compared to 32 reported deals and $1.8 billion of invested capital in Q1. Median reported deal sizes of venture financings for life sciences companies increased in Q2 to $25 million, compared to $22.2 million in Q1. The percentage of life sciences company venture financings structured in tranches increased from 28.1% of reported deals in Q1 to 29.6% of reported deals in Q2.

Unlocking the Weights: What Enterprises Should Know Before Deploying Open-Weight AI Models

Wed, 12 Aug 2026 07:00:00 Z

Does every task in the enterprise really call for the biggest model on the market? That’s the question more companies are now asking. Frontier models set a high standard for pushing the boundaries of what AI can do, but as token fees climb and many everyday tasks turn out not to need frontier-level horsepower, companies are increasingly adding open-weight models to the mix as a complementary option. Deploying them, however, raises legal and governance questions that differ from those raised by hosted AI services or traditional open-source software procurement. This alert is intended to help companies and their general counsel understand and navigate those differences.

Open weight, not open source

“Open weight” is not “open source.” Open-source software is generally distributed under standardized, well-understood licenses that grant broad rights to use, modify and redistribute. Open-weight models simply make a model’s weights – the numerical settings a model learns during training that shape how it responds – available for download and local deployment. They require integration through a separate software platform to run and manage the model, and often remain subject to bespoke contractual terms on commercial use, intellectual property (IP), redistribution, attribution and downstream deployment.

Key legal risk areas

Organizations considering open-weight models should evaluate the legal framework governing deployment, not just technical performance. Licensing, IP, privacy, security and an evolving regulatory landscape all affect how these models can be used and what safeguards should accompany their deployment.

A. Licensing is the threshold issue

For many organizations, the first legal issue in evaluating an open-weight model is not copyright or regulation, but the license itself. Unlike traditional open-source licenses, open-weight licenses are increasingly customized. They typically permit downloading, deploying and modifying weights, but may impose obligations well beyond preserving copyright notices or attribution.

Depending on the model, organizations may encounter provisions addressing commercial use limitations, acceptable use restrictions, volume restrictions, and attribution or branding requirements. Some licenses also restrict using the model, its outputs or derivative works to train, develop or improve a competing AI model. Like traditional open-source licenses, organizations may also occasionally encounter “copyleft” provisions requiring that derivatives thereof be made available on the same open-source terms, which may conflict with commercial objectives of keeping the organization’s software source code a trade secret. The same issue can arise with training datasets, such as those licensed under the Creative Commons ShareAlike license, which requires that new works built from the same data be shared under the same license. That said, this concept has traditionally applied to creative works that are direct derivatives of other creative works and how it applies to models trained on those works remains a fact-specific analysis.

Intended deployment matters too. Internal productivity use may carry different obligations than incorporating the model into a customer-facing product or platform. Organizations planning to fine-tune, redistribute derivative weights or build downstream products should confirm that the license permits this, and check for added obligations, taking into account how their product’s use may evolve.

B. IP questions continue to evolve

Open-weight models also raise IP questions that courts and regulators are still working through as generative AI develops. Much of the current litigation asks whether using copyrighted material for AI training infringes copyright or falls within doctrines such as fair use. These disputes generally involve developers rather than downstream deployers, but organizations should recognize that training data provenance is not always transparent, and the governing standards remain unsettled. Questions also arise over AI-generated outputs: ownership of generated content, resemblance to protected third-party works, risk of incorporation of open-source code and security vulnerabilities into AI-generated software, and contractual allocation of IP risk.

Unlike many hosted AI services, self-hosted open-weight deployments may lack provider indemnification or related contractual and technical protections – not only for IP-infringing outputs, but also more broadly for harmful, inaccurate or discriminatory outputs. Organizations should therefore build governance around AI-generated outputs, including human review, documentation, and technical validation and safeguards, and consider how liability for AI-related risks is addressed when a model provider offers no contractual indemnities or other protections.

C. Privacy, security and deployment architecture

A principal advantage of open-weight models is deployment flexibility. Unlike provider-hosted models, which require transmitting prompts and data to a third party, open-weight models can run entirely within enterprise-controlled environments – a meaningful benefit for organizations handling sensitive commercial information, proprietary IP, or regulated data subject to sector-specific privacy and data-handling rules. That flexibility comes with a trade-off: It shifts responsibility for securing and operating the AI environment to the deploying organization. That includes integration, access controls, infrastructure maintenance, usage monitoring, safeguards against inappropriate content, vulnerability management, output optimization, and compliance with privacy, breach-notification and cybersecurity requirements that a hosted provider’s data processing terms might otherwise help address.

Conversely, managed inference providers – companies that host and run a model on their own infrastructure so customers can access it without operating it themselves –may offer contractual protections, support and established security controls, but they introduce their own vendor-management and data privacy-governance considerations. The right approach depends on the use case, legal obligations, risk tolerance and governance capability, not just technical requirements.

D. Regulatory landscape continues to develop

The legal framework for advanced AI continues to evolve, as lawmakers weigh AI governance, export controls, national security, computing restrictions, consumer protection and cross-border deployment. Many regulatory frameworks do not yet distinguish open-weight from proprietary models. One notable exception is the European Union AI Act, which exempts open-source general-purpose AI model providers from certain technical documentation and downstream information obligations. It does not exempt them from all requirements; they must still implement a policy to respect EU copyright law and rightsholders’ text and data mining opt-outs and publish a sufficiently detailed public summary of the content used for training. Recent reporting likewise suggests that the White House’s voluntary, nonpublic frontier model review guidelines do not apply to open-weight models – further evidence that this remains an evolving area of AI governance and national security policy.

Adding to this complexity, a substantial share of today’s top open-weight models are developed outside the United States, including by developers based in China. That reality has drawn its own share of policy attention. The US and other governments have begun considering supply-chain provenance, data-handling practices and security review as part of a broader conversation about foreign-developed AI models generally, separate and apart from the quality or utility of any particular model. Organizations evaluating an open-weight model of foreign origin should treat these considerations as part of standard diligence – alongside licensing and IP review – rather than as a bar to adoption, while staying alert to guidance that may apply specifically to models associated with certain jurisdictions or certain entities.

Open-weight model deployments may therefore raise a broader, and in some respects more nuanced, range of legal considerations than traditional software procurement, and even hosted frontier models.

Lawmakers have also begun examining the cross-border movement of advanced AI models, weights and related technology. Organizations should monitor developments affecting cross-border deployment and jurisdiction- or provider-specific restrictions, which remain highly dynamic and may affect deployers and developers.

Pre-deployment checklist

Before deploying an open-weight model, organizations should, at a minimum:

Carefully review the applicable license to confirm it permits the intended deployment, and identify any restrictions on commercial use, redistribution, fine-tuning, downstream deployment, attribution or other contractual obligations that may apply.
Assess the jurisdiction, ownership and supply chain associated with the model’s developer and any upstream contributors, including where the model was trained and hosted; confirm whether the developer or model is subject to export control classification, entity-list or other trade restrictions; and where the deployment involves sensitive, regulated or government-related data, consider whether additional national security or cross-border review is warranted before proceeding.
Evaluate whether a self-hosted or managed inference architecture is more appropriate given the organization’s data sensitivity, operational needs, risk tolerance, customer commitments and available contractual protections.
To the extent possible, diligence the provenance and licensing history of any third-party model weights before deployment, particularly where the model has been modified, fine-tuned or obtained through an intermediary, to understand what rights and obligations accompany the model.
Implement governance around AI-generated outputs, including human review, technical safeguards and code-scanning to help catch and prevent potential IP issues, open-source software, security vulnerabilities and other material errors before outputs are deployed or relied upon.
Build a process to keep policies current as fast-moving export controls, AI regulation and other legal rules continue to evolve.
Develop contingency plans that account for changes to licensing terms, model availability or regulatory requirements that could affect continued deployment or commercial use.

As enterprise adoption of open-weight models grows, the legal questions surrounding deployment – from bespoke licenses to IP risk, governance and emerging regulation –will keep evolving. Organizations that evaluate these issues early in procurement and deployment will be better positioned to fold open-weight models into their AI strategies while managing legal and operational risk.

Cooley combines experience in AI, technology transactions, IP, privacy, cybersecurity, national security and global AI regulation to help clients evaluate, deploy and govern AI systems across the company.

The UPC Three Years In

Tue, 11 Aug 2026 18:13:25 Z

The Unified Patent Court (UPC) opened its doors in June 2023 as a single, centralised judicial forum to handle patent disputes across participating EU countries. During a seven-year transitional period, it is possible to opt European patents out of the UPC’s jurisdiction, i.e. up to May 2030. This period can potentially be extended once by another seven years, up to May 2037. However, the consultation on whether to extend this period is due to start in June 2028, so we cannot expect to have certainty regarding the possible extension until relatively late in the current period. As such, it is possible that within a few years the UPC could become the mandatory forum for enforcement and revocation of European patents in EU Member States participating in the UPC’s system, irrespective of whether a unitary patent is requested upon grant.

In the first six months of the UPC, roughly half of newly granted European patents remained within the system. This has increased as the court has matured and case law has developed and, as of June 2026, about two-thirds of newly granted European patents are not being opted out. Of the patents under the UPC’s jurisdiction, about half are unitary patents, with the remainder being European patents validated by the traditional route. This split has been fairly consistent throughout the UPC’s lifespan. For example, in 2025, 62% of patents remained under the UPC’s jurisdiction and 29% of granted patents were registered as unitary patents. As such, it appears that patentees are becoming more accepting of the UPC and unitary patent system, with the growing use of unitary patents reflecting increasing confidence in the combined UPC/unitary patent framework, including its simplified administration and, in many cases, more cost‑efficient structure (including renewals). This trend may be explained by the UPC’s practical advantages, notably the speed of its procedures and the availability of remedies (including injunctions) with effect across multiple EU Member States in a single action.

Perhaps surprisingly, patents in the medical or veterinary science space now have a higher uptake of unitary patents than average for European patents. Whilst the expectation has been that the pharmaceuticals space would be more risk-averse, patentees are choosing strategies that involve unitary patents. That said, the still-evolving unitary supplementary protection certificate framework introduces uncertainty that may continue to influence how life sciences patentees approach unitary patents. Curiously, the smallest proportion of unitary patents is in the electronics space. This space also sees the lowest proportion of opt-outs, so this lack of unitary patents is presumably driven by cost, countries of interest and expected patent lifespan, rather than any concerns about the UPC itself.

One reason patentees may be more willing to make use of the UPC is that the revocation rates at the UPC and European Patent Office (EPO) are broadly comparable. In 2025, 32% of revocation actions or counterclaims for revocation at the UPC resulted in the patent in suit being revoked. At the EPO, there was a revocation rate of 29% at the first instance during opposition in 2025, which rises to 31% on appeal (and to 48% on appeal if dismissed appeals are excluded). The risk of a central revocation of a European patent post-grant, therefore, does not appear to significantly differ between the UPC and EPO systems.

However, it is important to recognise that the nature of this risk differs between the systems. At the UPC, revocation can arise quickly within infringement proceedings and applies across all participating EU Member States in a single decision, whereas EPO opposition follows a different procedural track and typically operates over a longer time frame. As such, the practical commercial impact of revocation risk may be more acute in the UPC context.

The case law of the UPC is developing and there are indications of greater consistency in approach between divisions, as guidance from the Court of Appeal of the UPC emerges. The Court of Appeal has overturned approximately a third of first-instance decisions, whereas the EPO Boards of Appeal at least partially overturned 64% of cases in 2025.

Overall, it appears that the UPC is gaining prominence and credibility as a forum. This may be contributing to the increasing willingness to remain within its jurisdiction.

What does this mean for patentees?

Ultimately, a more nuanced, portfolio‑based approach is now appropriate when interacting with the UPC and choosing between traditional European patent validation and the unitary patent system. As UPC case law becomes more settled and the court is used by more patentees, keeping selected cases within the UPC and considering unitary patents rather than national validations potentially becomes more attractive. This is especially true as the end of the initial transition period approaches.

In practice, many patentees are using the UPC, often in conjunction with a unitary patent, alongside the traditional national validation route and opt-outs. This is not purely a question of patent strength or importance, and the sensitivities depend both on subject matter and business model. It is not uncommon to see a blended approach even within the same patent family, for instance with commercially valuable “picture claim” patents opted out and broader offensive patents kept within the UPC’s jurisdiction.

The key balance is therefore between the UPC’s enforcement advantages (including speed and pan‑European relief) and the risk of central revocation, with the appropriate approach depending on the strength of the patent, its commercial footprint and the patentee’s risk tolerance.

For patentees with interests in the UK and other significant European markets not participating in the UPC (such as Spain and Poland), a parallel national patent strategy will remain appropriate.

If you wish to discuss any specifics of post-grant patent strategy, especially around staying in or opting out of the UPC’s jurisdiction, please contact a member of the patent counselling and prosecution group’s London team for bespoke advice.

FCC Adopts Rules Overhauling Space Station Licensing Rules

Mon, 10 Aug 2026 13:56:23 Z

The Federal Communications Commission (FCC) adopted a Report and Order and Further Notice of Proposed Rulemaking on July 22 overhauling its space and earth station licensing framework. The rules aim to provide entities with a more efficient, predictable and flexible process to support commercial deployment of space infrastructure.

Updated licensing framework

The FCC establishes a “licensing assembly line” to provide space companies a clearer and quicker process for obtaining authorizations. The framework adopts a modularized, certification-based application designed to only collect necessary information and streamline the review and approval process.

Removal of surety bond requirements

The new rules eliminate the surety bond requirements for all systems, except for non-geostationary orbit (NGSO) systems involved in processing rounds (i.e., fixed satellite service and mobile satellite service systems). For NGSO systems subject to processing rounds, the FCC will require a bond set at an initial amount of $10 million, with the bond amount being reduced based on the percentage of the total authorized satellites deployed.

Elimination of streamlined small satellite and small spacecraft rules

The FCC eliminates the streamlined small satellite and small spacecraft rules, stating that those processes are no longer necessary. The FCC does not, however, address how it will handle current streamlined small satellite or small spacecraft licenses, or how it intends to calculate annual fees for such licenses moving forward, which historically have been less than 1/20 of the annual fees of other NGSO systems.

New ‘variable trajectory space stations’ licensing category

Recognizing the continuous development and use of new space technologies, the FCC creates a new category for space stations that does not readily fit into the traditional NGSO or geostationary orbit (GSO) space station categories. The variable trajectory space stations (VTSS) category is for systems “of one or more space stations either operating beyond the geosynchronous orbit or operating without fixed or predictable patterns over the course of its lifetime and operating under one space station call sign.” These systems include, but are not limited to, orbital transfer vehicles, rendezvous and proximity operations platforms, in-service servicing systems and missions involving transit to, orbiting of, or operations on the moon or other celestial bodies.

Conditional grants

Under the new rules, the FCC will issue conditional grants of authorization to further streamline and expedite the licensing process. These conditional grants will allow applicants to move forward with launch and/or certain operations prior to obtaining full authorizations from the FCC.

Revised processing rounds

The FCC updates its processing-round framework to provide NGSO systems greater predictability. Under the new framework, the FCC will open annual processing rounds and review applications on a rolling basis for each year. The Space Bureau will initially open processing rounds for Ka-, Ku-, V- and Q-bands and then add additional bands.

Further notice of proposed rulemaking

In addition to adopting new licensing rules, the FCC seeks comments on additional rules and revisions to further modernize its licensing framework to promote deployment of space operations. Some of these proposed rules include creating a new space-based experimental license; allowing currently operating NGSO satellite systems to combine authorized satellites under a single call sign; and permitting space station licensees to change or add radio frequency sensing capabilities through a minor modification or notification process.

If you are interested in learning more about the rules and their potential impact, please register for a Lunch & Learn panel on these and related topics on August 13 from 12:00 to 2:00 pm ET, or reach out to one of the Cooley lawyers listed below.

Structuring CVC-Backed Funds: A Governance, Economics and Regulatory Deep Dive

Thu, 06 Aug 2026 11:04:42 Z

This article is the second in our series on fund structures for corporate venture capital (CVC) sponsors. The first article in the series examined the principal models through which a corporate sponsor can collaborate with a fund manager (FM) at the general partner (GP) level. This article builds on that analysis by examining the governance architecture of each approach in greater depth, specifically the allocation of control, economics, liability and regulatory exposure between the corporate sponsor and the FM. These dimensions are among the most consequential and contested aspects of any CVC fund structuring exercise.

A corporate sponsor seeking to embed governance influence alongside an FM has a range of structural options available to it.

While other approaches exist, for example, hiring an unrelated investment team, developing an in-house investment management capability or acquiring majority control of an existing GP, this article examines the four structures most commonly encountered in CVC fund formation:

Minority equity stake and board representation in the GP entity
Investment committee representation
Contractual rights arrangements
Dual/parallel co-GP structure

The four structures are presented broadly in order of increasing governance depth, with the co-GP structure representing the most extensive form of engagement. Each structure is discussed in turn below, with analysis of its key commercial terms and the principal advantages and disadvantages from both the CVC’s and FM’s perspectives. In practice, negotiated arrangements often combine elements from more than one structure to achieve a bespoke balance that reflects the relative bargaining positions and strategic objectives of the parties.

1. Minority equity stake and board representation in the GP entity

Under this structure, the CVC acquires a minority equity interest in the GP entity, with the FM retaining majority ownership and control. The equity stake is typically accompanied by minority representation on the GP’s board of directors, together with a package of protective rights designed to embed the CVC’s governance position durably within the constitutional framework of the GP entity itself.

Key commercial terms

The CVC holds minority equity in the GP, with the FM retaining majority equity and corresponding majority board representation. The CVC receives an agreed upon share of carried interest, typically pro rata to its GP equity stake. Where an investment manager is engaged to provide advisory services to the fund, management fees will typically flow to the investment manager rather than to the GP itself; any CVC participation in management fee economics is accordingly structured for gross or net economics to flow to the CVC, including through a separate fee-sharing arrangement, rather than as a direct entitlement flowing from GP equity. Protective provisions in the GP’s constitutional documents confer information rights and veto rights over defined categories of major decisions, including amendments to the limited partnership agreement (LPA) or other fund documents, hiring or termination of key persons, related party transactions, changes to the fee or carry structure, new GP equity issuances or a change of control of the GP, fund dissolution, and material or conflicted investment decisions.

The CVC’s equity position is further protected by the following provisions, and in many cases is complemented by investment committee rights (discussed in greater detail under structure 2 below), which afford the CVC influence over the most consequential investment and portfolio decisions:

Preemption rights, a right of first refusal and tagalong rights on any transfer of GP equity by the FM.
Anti-dilution protections against future issuances.
Key person provisions addressing the consequences of FM principal departures.
Noncompete obligations typically imposed on the CVC parent in respect of specified fund verticals.
Deadlock resolution mechanisms (customarily a put/call arrangement or a buy-sell “shotgun” mechanism) to address irreconcilable disagreements between the parties.

CVC’s perspective

From the CVC’s perspective, the principal advantages are economic and constitutional. The board seat is embedded within the GP entity’s constitutional framework, making it the most insulated form of governance influence across all four structures. It provides board-level visibility into GP operations and fund-level approvals, though it should be noted that the GP board’s functions are often limited to constitutional and administrative matters such as board resolutions, fund approvals of expenses and related-party transaction approvals, while strategic direction, market updates and portfolio-level discussion typically take place at the investment management or investment committee level. The participation in carried interest (and, where applicable, management fee economics as described above) delivers a direct share of the fund’s economics. Tagalong rights and the right of first refusal protect the CVC’s ability to exit the GP equity stake on the same terms as the FM. The CVC’s own regulatory position is expected to remain outside the scope of registration requirements under the Investment Advisers Act of 1940 (Advisers Act), subject to the level of the CVC’s control and ownership. Note that this analysis reflects the US regulatory position; other jurisdictions may impose different registration, licensing or regulatory requirements on a CVC that acquires a minority equity interest in a GP entity, and local counsel advice should be sought.

The disadvantages are significant. By acquiring GP equity, the CVC is indirectly subject to Advisers Act fiduciary duties owed to the fund, creating a higher standard and potentially compliance obligations than arises under other structures examined below. Affiliated transactions between the CVC parent and the fund give rise to potential conflicts of interest and, in some cases, principal transaction concerns. GP entity valuation at entry and at any subsequent exit is complex and frequently contentious. If the fund underperforms, disputes over carried interest allocation or the CVC’s share of management fee economics may arise between the CVC and the FM, particularly where fee revenues decline and the parties disagree over the apportionment of reduced economics.

FM’s perspective

From the FM’s perspective, the CVC’s equity commitment provides institutional validation (particularly for first-time or emerging fund sponsors) and working capital for the GP entity, as well as a portion of the GP’s commitment to the fund. The deadlock resolution mechanism described above (customarily structured as a put/call arrangement or a buy-sell “shotgun” mechanism) affords the FM a defined exit pathway from the CVC relationship should the parties’ interests diverge. The CVC’s commercial network and strategic resources may be committed to the fund either through the equity relationship or through separate contractual arrangements, though the equity structure creates a more durable alignment of incentives than informal or purely contractual undertakings.

The downsides for the FM are also material. The loss of sole control over the GP entity and the dilution of carry and fee economics are significant concessions. The FM must manage a minority shareholder relationship alongside a diverse LP base, adding governance complexity. There is a real risk that the FM is not perceived as an independent and disinterested fiduciary for the capital contributed by other LPs, particularly where the CVC parent has interests in portfolio companies or co-investment opportunities. Veto rights create operational friction and can delay time-sensitive investment decisions. Where the CVC’s capital is committed through the GP commitment (as is typical), the risk of most-favored-nation (MFN) claims from other LPs is reduced; however, if the CVC also invests as an LP or receives preferential side letter terms, the obligation to disclose the CVC’s preferential treatment may invite MFN claims from existing and prospective LPs unless those rights are expressly carved out of the MFN framework. Further, if the CVC parent undergoes a change of control, this may engage the assignment provisions under the Advisers Act. However, where the CVC is a minority investor in the GP and the FM retains clear majority ownership and control, a change of control of the CVC would not necessarily constitute a change of control of the GP for assignment purposes, though the analysis is fact-specific, and the fund documents should address the consequences of a CVC parent change of control expressly.

2. Investment committee representation

Under this structure, the CVC holds minority seats on the fund’s investment committee (IC) without acquiring any equity interest in the GP entity. The FM retains full GP ownership and control, as well as majority representation on the IC. The CVC’s influence over investment decisions is negotiable, ranging from observer only to effective veto rights related to specified categories of decisions.

Key commercial terms

The CVC appoints minority IC members, who may sit as voting members or as nonvoting observers depending on the terms negotiated. IC quorum requirements typically mandate the presence of at least one CVC representative (or a waiver) before a quorum is constituted. CVC veto rights could be limited to defined categories of decisions, typically including investments above a specified percentage of fund size, investments in sectors competitive with the CVC parent, follow-on investments above agreed concentration limits, below-cost or related-party exit decisions, and co-investment allocation decisions.

Mandatory recusal protocols address decisions in which the CVC parent has a conflict of interest. Strict nondisclosure obligations and information barriers between CVC IC members and the CVC parent are essential features to prevent confidential deal intelligence from migrating from the CVC's IC representatives to the CVC parent. IC appointees are removable for cause, and any replacement is subject to the FM’s reasonable consent. A fundamental drafting question concerns whether CVC IC members vote in their personal capacity or as agents of the CVC entity. If acting as agents, knowledge acquired by IC representatives may be attributed to the CVC entity directly, broadening potential liability exposure and complicating conflict management and regulatory requirements. Conversely, if acting in a personal capacity, the CVC entity has less formal control over how its nominees exercise their votes, and the enforceability of IC voting instructions may be limited. The answer to this question also affects how confidential information obligations are structured. In addition, the FM and the CVC will need to assess the FM’s regulatory requirements resulting from CVC and its employees’ access to the FM’s information and network.

CVC’s perspective

From the CVC’s perspective, this structure affords greater access to investment decisions with the potential to influence those decisions. Early visibility into proprietary deal flow in sectors of strategic relevance to the CVC parent is a significant benefit. The regulatory footprint is considerably lighter than under structure 1, and exit from the arrangement is simpler. There is no GP equity interest to unwind. There is, however, a reputational risk to the CVC if its IC representatives are perceived to have blocked or delayed deals. The parties may also negotiate a separate carry arrangement, under which IC representation is accompanied by a defined economic participation in fund profits. It should be noted that carried interest grants are not inherently tied to GP equity ownership; carry allocations may be structured independently of the GP’s equity capital structure, and accordingly the economic distinction between a carry arrangement under this structure and the carry entitlement flowing from GP equity under structure 1 may be more a matter of structural form than economic substance.

The disadvantages are meaningful. CVC IC representatives may be treated as access persons of the investment adviser, with consequent compliance and information-handling obligations. Those requirements could expand to CVC without appropriate information gates. Conflict recusal protocols are operationally complex, and contested recusals create friction with the FM and other LPs. The CVC’s veto rights likely should be disclosed to other LPs, and other investor may not want the FM’s investment discretion impacted by the CVC. Confidential deal intelligence is necessarily exposed to the CVC’s IC representatives, creating a risk that commercially sensitive information migrates to the CVC parent notwithstanding information barriers.

FM’s perspective

From the FM’s perspective, this structure preserves full GP equity ownership and economics without necessarily dilution of carry or fee entitlements. The CVC could have a range of influence investment decisions, and veto rights, if any, could be limited to defined categories of decision with the FM retaining majority control of the IC. IC rights can be structured to sunset at the end of the investment period, limiting the duration of the CVC’s governance influence.

The drawbacks are also significant. The CVC’s veto may delay or block time-sensitive investment decisions. Confidential deal flow and portfolio data are necessarily exposed to a corporate LP whose parent may compete with portfolio companies, and intelligence may migrate inadvertently to the CVC parent despite information barriers. Other LPs may invoke MFN provisions to demand equivalent observation rights. Deadlock mechanics are required but often contentious to negotiate.

3. Contractual rights arrangements

Under this structure, the CVC and FM enter into a suite of stand-alone contractual arrangements that confer defined management-adjacent rights on the CVC, without any equity stake in the GP or formal seat on any governance body. This is the lightest-touch governance structure of the four and affords the greatest flexibility to both parties.

Key commercial terms

The contractual arrangements typically comprise some or all of the following elements:

Co-investment rights. A right for the CVC (or its parent) to participate alongside the fund in portfolio investments on a pro rata or fixed-allocation basis, on no-fee, no-carry or preferential terms.
Deal sourcing exclusivity window. A contractual obligation on the FM to present defined categories of investment opportunity to the fund (rather than to competing vehicles) for a specified period before the FM may pursue them elsewhere.
Enhanced information rights. Reporting rights beyond those available to ordinary LPs, including access to deal pipeline data, portfolio company information and IC materials relevant to the CVC parent’s sectors of strategic interest.
Portfolio assistance framework. A services or secondment arrangement under which the CVC parent provides defined resources – commercial, technical or operational – to portfolio companies, typically on arm’s-length terms.
Advisory or observer rights. A right for the CVC to appoint a nonvoting observer to the IC or the GP’s board, without any veto or quorum right, to preserve visibility into fund governance without triggering the regulatory or fiduciary consequences of formal membership.

CVC’s perspective

From the CVC’s perspective, this structure carries the lightest regulatory footprint of the four; the CVC’s rights are contractual as in option 2 and are less likely to give rise to regulatory obligations associated with GP or IC status. Each right can be negotiated, transferred or terminated independently of the others, providing maximum flexibility as the CVC-FM relationship evolves. In many cases, co-investment rights can deliver direct and immediate financial value. The portfolio assistance framework directly serves the CVC parent’s corporate development agenda without requiring formal governance involvement.

The disadvantages lie principally in enforcement and durability. While all of the structures examined in this article are contractual in nature, the distinction here is one of structural resilience: Rights embedded in the GP’s constitutional documents benefit from the procedural protections and amendment thresholds applicable to those instruments, whereas stand-alone agreements may be more readily amended, waived or terminated by the parties, which may not provide timely protection in a fast-moving investment context. The deal sourcing exclusivity window can constrain the pace of both the fund and the CVC parent. All rights must be carefully drafted to ensure they survive any assignment or novation of the investment management agreement between the FM and a successor investment manager, so that the CVC’s entitlements are preserved in the event of a change in the identity of the party providing investment management services to the fund. A CVC that exercises its contractual rights with sufficient regularity and depth risks being characterized as a de facto fund manager, with associated liability consequences.

FM’s perspective

From the FM’s perspective, this structure is the least disruptive to its ownership, control and economics. Full GP ownership is retained, and the flexibility of independent contractual arrangements allows each right to be negotiated, modified or terminated without affecting the others. The strategic advisory relationship can enhance the LP value proposition at low governance cost to the FM.

The principal downsides for the FM relate to the ripple effects on its other LP relationships. Co-investment terms and enhanced information rights will frequently trigger MFN demands from other LPs. The deal sourcing exclusivity window can constrain the pace of deal execution for the fund as a whole. Multiple separate agreements create operational complexity and a risk of inconsistency between documents. Portfolio assistance arrangements must be structured on strictly arm’s-length terms to avoid self-dealing claims from other LPs. The FM will also need to assess its compliance obligations, disclosures to other investors and how the relationships fit within the FM’s compliance policies and procedures.

4. Dual/parallel co-GP structure

The co-GP structure is the most ambitious and operationally complex of the four. Unlike the joint venture model examined in our first article (model 3), which involves shared equity ownership of a single GP entity by the corporate sponsor and an industry partner, this structure involves two separate legal entities, the FM’s own GP and a newly established CVC co-GP entity, each named as a GP of the fund in the LPA. Both co-GPs bear joint and several liability to the fund’s LPs, and share in the economics of the GP according to an agreed formula. The governance, liability and regulatory issues specific to dual co-GP structures, including inter-GP coordination, separate regulatory obligations and fund continuation mechanics, are examined in detail below.

Key commercial terms

Both entities are named as co-GPs in the LPA, with carry (and occasionally, management fees as well) allocated between them in accordance with an agreed formula. A co-GP governance agreement sets out with precision the matters that require unanimous consent and those that can be decided by either a co-GP or majority. Unanimous consent matters typically include amendments to the LPA or other fund documents, changes to investment strategy or mandate, investment decisions above a defined threshold, key person appointments and terminations at either co-GP, related party transactions, dissolution of the fund or either GP entity, any assignment of GP rights or management economics, and material changes to compliance or regulatory frameworks.

While both co-GPs are jointly and severally liable to LPs under the LPA, an internal indemnification agreement allocates liability between the co-GPs. Each co-GP entity independently satisfies its own regulatory obligations, with costs allocated separately. Key persons are defined separately for each co-GP entity. Fund continuation mechanics address the scenario in which one co-GP exits or is removed for cause, permitting the remaining co-GP to continue as sole GP subject to LP consent.

CVC’s perspective

From the CVC’s perspective, this structure provides the most formal and equal governance standing of any of the four options. True co-GP status means the CVC is a named GP of the fund in the LPA, placing it on the same constitutional footing as the FM. The CVC obtains direct access to GP economics without acquiring an equity interest in the FM’s preexisting GP entity. The structure enables the CVC to build an independent investment management capability alongside the FM, and signals a long-term commitment to the fund, including through a capital commitment made by the CVC co-GP entity (or its affiliate), that may strengthen its fundraising profile with other LPs.

The disadvantages are commensurately high. GP liability represents a significant balance sheet risk for the CVC’s corporate parent. Establishing a CVC co-GP entity could trigger Advisers Act registration and compliance obligations for the CVC and CVC parent. Inter-GP coordination is operationally complex, and the risk of decision gridlock is at its highest in this structure. Advisers Act fiduciary duties are owed to the fund, not merely to the CVC. Any change of control of the CVC co-GP entity, including the CVC parent, will engage complex GP succession mechanics, potentially requiring LP consent.

FM’s perspective

From the FM’s perspective, the CVC co-GP enhances the fundraising profile and institutional credibility of the fund. The CVC bears a proportionate share of any GP-level liability, reducing the FM’s net exposure. The arrangement provides the FM with access to the CVC’s deal flow, commercial networks and LP base.

The disadvantages are the most severe of any of the four structures. The co-GP arrangement is the most operationally complex option, with the highest risk of decision gridlock. The FM loses its status as sole fund fiduciary, which may undermine its leverage in negotiations with portfolio companies and third parties. The carry pool is materially reduced by the co-GP split. If the CVC co-GP is removed for cause or withdraws, fund continuity mechanics may trigger LP removal rights or necessitate a fund restructuring. Two separately regulated entities significantly increase compliance costs.

5. Comparative analysis

The four structures can be assessed across five principal dimensions: governance footprint, CVC liability exposure, CVC economics, CVC regulatory risk and the degree of control dilution for the FM. The table below summarizes this comparison.

Structure	Governance footprint	CVC liability	CVC economic participation	CVC regulatory risk	FM control dilution
1. Minority GP equity + board	High	Moderate to high	Pro rata fees and carry	High	Moderate to high
2. IC representation	Moderate	Low	None (separate carry optional)	Low	Low
3. Contractual arrangements	Low	Low	Co-invest/carry by agreement	Low	Low
4. Dual co-GP structure	Highest	Highest	Equal to agreed GP split	Highest	Highest

Conclusion

The choice between these four structures is ultimately a function of the CVC’s strategic objectives, its appetite for liability and regulatory exposure, the FM’s willingness to accept governance dilution, and the interests of the wider LP base. A CVC that prioritizes direct economic participation and durable governance influence will gravitate toward structure 1 or structure 4, accepting the associated liability and regulatory complexity. A CVC that seeks strategic insight and deal flow access with a lighter touch will favor structures 2 or 3, preserving flexibility and minimizing regulatory risk.

It is important to note that these structures are not mutually exclusive. In practice, a negotiated arrangement commonly combines elements from multiple structures – for example, IC representation paired with a suite of contractual rights, or a minority GP equity stake accompanied by a co-investment framework. The most successful arrangements are those that are clearly documented, anticipate the principal friction points (conflicts, key person departures, deadlock and LP scrutiny), and build in mechanisms to resolve them without resorting to litigation.

As corporate venture capital continues to mature as an asset class, the governance architecture of CVC-backed funds will remain a focal point for legal advisors, fund managers and institutional LPs alike. Structuring these arrangements carefully at the outset, with clear eyes about the trade-offs involved, is essential to the long-term health of the fund and the CVC-FM relationship.

Ninth Circuit Rules on AI Agent ‘Access’ to Third-Party Websites Under CFAA

Thu, 06 Aug 2026 07:00:00 Z

On August 4, 2026, the US Court of Appeals for the Ninth Circuit vacated a preliminary injunction that had barred Perplexity’s AI agent from accessing Amazon.com on customers’ behalf, holding that Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) and California Comprehensive Computer Data Access and Fraud Act (CDAFA) claims against Perplexity. Reversing the district court, the panel explained that when a user tasks a Perplexity agent with taking actions on the user’s behalf on Amazon.com, it is “the user who ‘accessed’ Amazon’s computers,” not Perplexity. The decision is significant for both sides of the agentic AI ecosystem: It potentially offers AI developers a measure of protection from CFAA/CDAFA claims arising from agents acting at a user’s direction, while signaling to website operators that these anti-hacking statutes may not be an effective tool for policing agent access – though other legal theories, such as breach of terms of service, may remain available.

Two important limits temper the decision for both audiences. First, the ruling addresses only CFAA and CDAFA theories of liability and expressly leaves open other claims, including breach of terms of service and contract- or tort-based theories. Second, the panel made clear that the inquiry is fact-specific, noting the possibility that other AI agents with greater autonomy or more direct communication with a website’s servers could still give rise to CFAA and CDAFA liability. Because this appeal arose from a preliminary injunction, the panel’s findings reflect a likelihood-of-success assessment on the current record, not a final merits ruling.

Background

Amazon sued Perplexity in the US District Couty Northern District of California, alleging that Perplexity’s agentic browser feature, the “Assistant” (part of its Comet browser), accessed Amazon users’ password-protected Amazon accounts to browse and purchase products – at users’ direction. Amazon alleged that Assistant did so without identifying itself to Amazon as an AI agent and in violation of Amazon’s terms of service. Amazon claimed this conduct violated the federal CFAA and CDAFA. On March 9, 2026, the district court granted Amazon’s preliminary injunction, finding Amazon was likely to succeed on the merits because Perplexity’s access was not authorized by Amazon, regardless of whether the Amazon users had permitted Assistant to access their own Amazon accounts. Perplexity appealed.

The Ninth Circuit’s decision

On August 4, 2026, a Ninth Circuit panel vacated the injunction and remanded the case for further proceedings.

The panel’s decision turned on the threshold question of computer “access” under the CFAA. To prevail on a CFAA claim, a plaintiff must show that the defendant:

Intentionally accessed a computer
Without authorization or in excess of authorized access
Thereby obtaining information
From a protected computer
Causing at least $5,000 in aggregate loss in a one-year period

The court found that “access” means “entering a computer system itself,” and the statute’s use of “whoever” contemplates access by a person, not a software tool. As a result, “it was the user who ‘accessed’ Amazon’s computers, with the help of Perplexity’s AI agent, the ‘Assistant,’ to carry out specific acts on Amazon.com.” Because the user, not Perplexity, accessed Amazon’s servers, the court found Amazon was unlikely to prevail on a CFAA claim against Perplexity.

To reach this holding, the court examined how Assistant works. When a user directs the Assistant to shop on Amazon, the Assistant takes screenshots of the browser view on the user’s own machine and sends those screenshots to Perplexity’s servers, which then send back instructions on how to navigate Amazon.com to the user’s computer. Critically, “Perplexity itself does not directly communicate with Amazon’s servers,” as communications are routed through the user’s computer. The court distinguished this fact pattern from those in cases such as Facebook, Inc. v. Power Ventures, Inc., where the defendant’s own systems caused messages to be transmitted directly on Facebook’s platform, without first passing through a user’s machine.

The CDAFA was likely to fail for the same reason. Although the CDAFA defines “access” more broadly than the CFAA, the panel held that the statute still focuses on the person accessing or causing access. Because the user, not Perplexity, accessed Amazon’s systems, Amazon’s CDAFA claim was also unlikely to succeed.

Finally, the court also held that the equitable factors underlying a preliminary injunction favored Perplexity, as Amazon’s evidence of irreparable harm – claims that the Assistant might not select the best price or product for a user – was comparatively weak and abstract, and that Amazon’s cybersecurity concerns were unconvincing.

Remaining liability risk

The court made clear that different facts regarding how the agent operated may have changed the outcome. For example, if an AI company exercises greater control over its agent or if the company’s servers communicated directly with the defendant’s servers, that may yet support a finding that the company itself “accessed” a website’s servers.

The court also expressly narrowed the holding to the CFAA and CDAFA contexts. The court left open the possibility that the same conduct could be the basis for other types of claims, such as claims sounding in tort or contract.

Practical takeaways for website operators

Websites seeking to restrict AI agents from accessing accounts or taking actions on a user’s behalf should not assume that the CFAA or similar state anti-hacking statutes will provide an effective remedy, at least where the AI company’s own systems do not directly communicate with the website’s servers. Such websites may have to turn to other theories of liability, such as enforcing terms of service.

Practical takeaways for AI agent developers

Makers of agentic AI tools should take some comfort from the Ninth Circuit’s finding that a user directing an AI agent – rather than the AI company itself – is the one who “accesses” a third-party website for CFAA and CDAFA purposes, at least where communications with the third-party website’s servers are routed through the user’s computer. This finding puts new emphasis on how the AI agent communicates; agents that do not rely on the user’s computer as a relay will pose greater risk. AI developers should not treat this decision as foreclosing liability under other legal theories, including contract-based claims arising from a website’s terms of service.

The EU 21st Russian Sanctions Package Is Here: Business Implications

Tue, 04 Aug 2026 09:46:24 Z

On 23 July 2026, the Council of the European Union adopted the 21st package of sanctions measures against Russia. This package builds on the EU’s 20th package of sanctions which was adopted three months ago on 23 April 2026.

The measures focus on energy, financial services and crypto, trade and the Russian military-industrial complex. Additionally, the EU sanctioned 218 new persons (48 individuals and 170 entities), which the Council described as the largest batch of listings in four years.

We have summarised the most salient measures below.

Crypto-asset measures

In its 20th Package, the EU introduced extensive restrictions on Russia-related crypto activity, including measures against the A7A5 stablecoin, RUBx, and banned all EU support for the digital ruble. The EU further imposed a total sectoral ban on providers and platforms established in Russia allowing the transfer and exchange of crypto-assets.

The 21st package introduced three distinct crypto-asset measures:

Platform transaction bans. The 21st package extends transaction bans with crypto-assets to 14 crypto-related service platforms based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan and Belarus.
Non-Russian in EU crypto-asset business. From 25 August 2026, Russian nationals and people living in Russia cannot:

i. Own or control (directly or indirectly) a crypto-asset business based in an EU Member State.

ii. Sit on the board or governing body of such a business.

This applies to all crypto-asset businesses in the EU.

Country-level ban framework. EU persons and entities will be prohibited from transacting, directly or indirectly, with any crypto-asset service provider or exchange platform established in a country that the Council of the EU determines to be undermining Russian sanctions. No country has yet been listed, but this new regulation signals the EU’s readiness to impose jurisdiction-level exclusion.

Financial measures and asset freezes

Asset freeze

All 218 new designations (48 individuals and 170 entities) are subject to EU asset freezes. This means that their assets must be frozen and EU operators may not make funds or economic resources available to them. The financial sector accounts for the largest share – 94 banks and major financial institutions including the Moscow Exchange. As part of the 20th package of sanctions, the EU had designated several banks and defence-related companies and individuals and imposed further restrictions on entities in China, Hong Kong, the UAE, Türkiye, Kazakhstan, Uzbekistan and Belarus involved in supplying dual-use or military goods to Russia.

Transaction ban

The 21st package further expands the transaction-ban framework introduced in earlier packages, to 33 additional Russian credit and financial institutions, one Kyrgyz bank connected to Russia’s SPFS system, three other non-Russian banks, and five oil traders that helped circumvent the Russian crude oil prohibition. More than 100 Russian banks are now subject to financial messaging and transaction restrictions in total.

Trade measures

Export bans

New restrictions on nickel powders and alloys (jet engine coatings), beryllium powders, self-adhesive films (aerospace and defence), and UAV items, including ground support equipment, jamming and interception systems, launch systems, servomotors and flight termination systems.

Import bans

New bans worth more than €60 million on copper, nickel, lead and precious-metal ores, unwrought zinc, alkaline-earth metals, zinc and chromium oxides, glassware, imitation pearls and car parts The new import prohibitions do not apply to contracts concluded before 24 July 2026 that are being executed until 25 October 2026.

Entity list

Fifty-one entities are added to the list of entities subject to stricter export restrictions because of their support for Russia’s military and industrial complex and role in circumvention. The newly listed entities include third-country entities in China, India, Kazakhstan, Kyrgyzstan, Türkiye and the UAE.

Next steps for companies with Russian exposure

Businesses with Russian exposure should use the package as a prompt to refresh sanctions screening, counterparty diligence and contract reviews across the areas most affected by the new measure:

Screen against new asset freezes
Screen against expanded transaction bans
Review crypto platform relationships
Review existing import contracts – transition period runs to 25 October 2026 for contracts concluded before 24 July 2026

The key point is to identify any exposure early, particularly where the package expands restrictions beyond Russian entities to third-country platforms, vessels, banks and service providers.

EU AI Act: Transparency Obligations Take Effect 2 August 2026

Mon, 03 Aug 2026 07:00:00 Z

Starting 2 August 2026, providers and deployers of certain AI systems must comply with the transparency obligations set out in Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) (AI Act). The European Commission adopted guidelines on these obligations on 20 July 2026. Noncompliance can trigger fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. The AI Act applies globally to providers, deployers, importers and distributors of AI systems that place AI on the EU market or whose AI outputs are used within the European Union.

What the rules cover

Article 50 addresses four scenarios, split between obligations on providers (those who develop and place an AI system on the market) and deployers (those who use an AI system under their own authority):

AI systems that interact directly with individuals (e.g., chatbots, voice assistants, AI agents): Providers must disclose that users are engaging with AI, unless this is already obvious.
AI systems generating or manipulating synthetic audio, image, video or text: Providers must embed machine-readable markings and provide a detection mechanism, subject to limited exceptions (e.g., standard editing, non-substantial alterations).
Emotion recognition or biometric categorization systems: Deployers must inform affected individuals.
Deep fakes and AI-generated text on public-interest matters: Deployers must disclose that content was artificially generated or manipulated, unless it has undergone substantive human editorial review with a person assuming editorial responsibility.

Key dates and transitional relief

The obligations apply immediately from 2 August 2026 to all in-scope systems, regardless of when they were placed on the market. Content generated and published before that date need not be retroactively labeled. A limited transitional period applies only to the marking and detection obligation for generative AI systems already on the market. Providers have until 2 December 2026 to comply.

The Code of Practice

The AI Office has published a voluntary Code of Practice on Transparency of AI-Generated Content, offering providers a recognized path to demonstrate compliance with the marking and detection obligations. This includes a set of icons that may be used to label AI-generated content. Several major AI providers have already signed on. Signatories benefit from a degree of presumption of conformity and a more favorable enforcement posture; non-signatories face closer scrutiny and must demonstrate compliance through other means.

What businesses should do now

Identify which AI systems you provide or deploy, and under whose authority they operate (including where agencies or contractors are involved).
Map content and interactions against the four categories above, including deep fakes and public-interest text.
Implement disclosure, labeling and editorial-review procedures, and assess whether to sign the Code of Practice.
Complete this assessment before 2 August 2026, noting the extended 2 December 2026 deadline for marking/detection of existing generative AI systems.

If you have questions about how these obligations apply to your organization, please contact your Cooley team.

Foreign-Produced Power Inverters and Advanced Robotic Devices Added to FCC Covered List

Fri, 31 Jul 2026 19:37:38 Z

***Updated August 27, 2026***

On July 28, 2026, the Federal Communication Commission’s Public Safety and Homeland Security Bureau announced the addition of foreign-produced power inverters and advanced robotic devices to the Covered List. This action, which took effect immediately, followed a national security determination (NSD) that these devices pose supply chain vulnerabilities and cybersecurity risks to critical infrastructure.

On August 20, 2026, in response to a second NSD for power inverters, the Bureau announced several modifications to the foreign-produced power inverters entry on the Covered List. This action, which took effect immediately, revises the definition of “power inverters” and “foreign-produced power inverters,” thus clarifying and, in some respects, narrowing the types of power inverters included on the Covered List.

Advanced robotic devices

The FCC’s action on advanced robotic devices followed an NSD that advanced robotic devices are being increasingly used in monitoring and securing critical infrastructure, as well as being applied across the industrial manufacturing sector, and are vulnerable to data exfiltration, remote disruption and dependencies on unsecure over-the-air updates.

The NSD’s definition of “advanced robotic device,” as adopted by the FCC, is a mechanical mobile device that satisfies the following four prongs:

Is capable of locomotion, obstacle avoidance, navigation or movement on the ground.
Operates at a distance from a human operator or supervisor based on commands or in response to sensor data or any combination thereof.
Has a combined weight of the device and, if applicable, ground station or docking station of more than 4.4 pounds.
Contains:
- A sensor capable of perceiving its environment.
- A component capable of providing network connectivity with connection speeds of at least 200 kbps in either direction.
- Software running either locally or remotely that controls the robot’s autonomous navigation or movement perception, data collection or remote command and control.

The definition explicitly includes autonomous mobile robots, humanoid robots and quadrupeds with such capabilities, but encompasses other devices that fall within the four prongs. The rule appears to apply to many home robotics products, such as robotic vacuums, lawn mowers and comparable products, along with terrestrial robotic delivery devices.

The definition explicitly excludes connected vehicles, vehicles operated only on a rail line, uncrewed aircraft or uncrewed aircraft systems, unmanned underwater vehicles, fixed/nonmobile robots, or medical devices, such as surgical instruments, external limb prostheses, and ambulatory and mobility assistive devices (e.g., canes, crutches, walkers, wheelchairs).

Power inverters

The FCC’s initial action followed the first NSD finding that power inverters’ remote connectivity creates vulnerabilities in the US energy grid. These vulnerabilities could let foreign or other malicious actors access inverters and exploit such access through various cyberattacks. As described in the NSD, power inverters facilitate the connection of direct current energy generation sources to the predominately alternating current electricity of the US energy grid, and it is estimated that more than 46 GW of electric power on the grid currently relies on inverters.

The FCC initially adopted the first NSD definitions of “power inverters”¹ and “foreign-produced,”² which were unclear and created confusion in the industry as to the scope of the definitions. Following the second NSD, the FCC modified the definition of “power inverters” and added a definition of “foreign-produced power inverters.” The FCC also updated its associated FAQ to provide additional clarification that arose from the first NSD definitions.

The second NSD explained that the interagency body had intended to only include those power inverters that change direct current to alternating current (including those that were bi-directional) and were “utility-interactive” (i.e., connected to the grid). The first prong of the new “power inverter” definition makes this clear. The second NSD also states that “[p]ower inverters that are incapable of connection to the utility grid (i.e., non-utility-interactive inverters) generally do not pose risk to public utility grid.”

The second NSD also clarified the second prong of “power inverter,” which relates to components for remote communications, control, sensing, data collection or monitoring. Specifically, whereas the first NSD provided an example involving wireless connections while including a catch-all for “other similar connections” that arguably included wired connections, the second NSD made clear the connections could be wireless or wired. The second NSD arguably expanded the second prong by stating that a device satisfying the first prong is a power inverter if it “is designed, equipped, or configured to accept,” not just contains, a component that enables remote communications, control, sensing, data collection or monitoring through wired or wireless connections. Therefore, a device whose architecture provides the ability to add a component, whether of the same manufacturer or a third party, that provides such connectivity would be within the scope of the second prong.

For reference, the second NSD and FCC define “power inverters” to mean:

Changes DC power to AC power, to include bi-directional devices, that is intended for use in parallel with an electric utility to supply common loads and sometimes deliver power to the utility, i.e., a utility-interactive inverter as that term is defined in UL 1741 sections 2.1.23, 2.1.52.
Contains, or is designed, equipped or configured to accept, a component that enables remote communication, control, sensing, data collection or monitoring through ethernet, Wi-Fi, cellular, Bluetooth or other similar connections, whether wired or wireless.

The second NSD, however, excludes certain types of “foreign-produced power inverters” from the definition; therefore, foreign-produced power inverters that meet either of the following criteria are not subject to the Covered List restrictions:

Eligible for the Advanced Manufacturing Tax Credit in 26 US Code § 45X for domestic production.
A domestic end product as defined in 48 CFR § 25.101(a) because they are manufactured in the United States, and the cost of domestic components exceeds 65% of the total component cost for items delivered in calendar years 2024 through 2028, or 75% for items delivered starting in calendar year 2029.

Effect of inclusion on the Covered List

Products placed on the Covered List cannot receive FCC equipment authorization, which effectively prevents such products from being marketed and sold in the US. The action only applies to new foreign-produced power inverters and advanced robotic devices that have not received equipment authorization prior to July 28, 2026. Devices that were granted authorization by the FCC before that date can continue to be sold in the US. Companies that produce power inverters or advanced robotic devices outside of the US can seek Conditional Approval from the Department of War or Department of Homeland Security (DHS) to exempt their devices from the Covered List going forward.

Opportunities to mitigate effects

Waiver of certain ‘permissive changes’ prohibitions

On the same day, the FCC also announced a waiver that permits previously authorized power inverters and advanced robotic devices to receive basic software and firmware updates that mitigate harm to US consumers, such as changes that ensure the continued functionality of the device (e.g., vulnerability patches and updates to facilitate compatibility with different operating systems). Accordingly, any foreign-produced power inverters or advanced robotic devices that were authorized prior to July 28, 2026, may undergo these permissive changes through at least January 1, 2029.

Producers may also be able to petition for a waiver to make certain Class I and Class II permissive changes to hardware of already certified devices. Such permissive hardware changes should not:

Improve performance or capability or alter the functionality of the previously authorized device.
Be used to market the device as a distinct model.
Involve swapping a US-produced component for a foreign-produced component.

The FCC has granted similar waivers for permissive changes to hardware in routers with existing authorizations that were subsequently placed on the Covered List.

‘Conditional Approval’

Producers of power inverters and advanced robotic devices on the Covered List may apply for Conditional Approval that would exempt the approved entity from Covered List restrictions. As with other devices that are included on the Covered List, entities seeking Conditional Approval for foreign-produced power inverters or advanced robotic devices must be prepared to provide information on the entity’s corporate and management structure, details regarding existing manufacturing and component supply chain, and a US manufacturing and onshoring plan.

What affected companies can do now

If your company manufactures, distributes or integrates these devices, you should consider the following immediate steps:

Audit your devices
- Identify country of origin: Determine exactly where your current and future devices are manufactured. Under the new rule, even “American” brands may be affected if their physical production occurs in a foreign country.
- Assess “foreign-produced” models: If only minor assembly of a product happens abroad, you may be able to demonstrate that it should not be on the Covered List.
- Identify “previously authorized” models: Confirm which of your foreign-produced models already have an approved FCC ID. These can still be imported and sold. But consider whether permissive changes to hardware are or will be needed due to supply chain issues or end-of-life status.
- Pipeline review: Any new models currently in development abroad will likely be blocked from the US market unless you obtain Conditional Approval or pivot your manufacturing strategy.
Apply for ‘Conditional Approval’
The FCC has provided a pathway for exemptions from the Covered List through the Department of War and DHS. To succeed, applicants should be prepared to provide:
- Detailed background about company ownership and management.
- A detailed bill of materials and country of origin for all components of each device for which Conditional Approval is sought.
- A verifiable US manufacturing and onshoring plan that is time-bound, including expected capital expenditures and workforce deployment, and overseen by a dedicated officer.
- Quarterly updates on the progress of bringing production to US soil.
Secure your legacy devices
- Take advantage of the FCC Office of Engineering and Technology waiver for Class I and Class II permissive changes for previously authorized routers to receive software and firmware updates to mitigate security harms. This waiver is currently set to expire on January 1, 2029. Ensure you have a plan to push security updates to existing foreign-made routers before the waiver window potentially narrows or expires.
- Consider filing a Petition for Waiver to permit Class I and Class II permissive changes to certain hardware that are, or are expected to become, subject to supply chain issues or end-of-life status.
Update certifications
Going forward, all applicants for FCC equipment authorization who have a product on the Covered List will need to self-certify, in good faith, that their device is not “covered equipment.” False certifications could lead to significant legal exposure and the revocation of existing authorizations.

How we can help

If you have questions about whether your devices are within the scope of the Covered List or the Conditional Approval or waiver process, or need assistance preparing those submissions, please reach out to the Cooley lawyers listed below. We have valuable experience seeking Conditional Approval and waivers for other foreign-produced devices on the Covered List and can help prepare and prosecute such submissions.

Mailbox to Inbox: The SEC’s Proposed E-Delivery Rules and What Employers Need to Know Now

Wed, 29 Jul 2026 19:44:16 Z

Federal securities laws impose delivery obligations on companies in connection with director and executive incentive equity compensation programs – from Form S-8 prospectuses to equity award agreements and even tender offer materials. Now, those rules may change in a significant way. The Securities and Exchange Commission (SEC) recently proposed Regulation E-Delivery, a sweeping new rule that would dramatically expand the ability of issuers and others to satisfy information delivery requirements electronically.

That proposed regulation is the subject of a July 21 Cooley alert, and we encourage you to read that alert to understand the potential sweeping significance of the proposed rule. The purpose of this alert is to highlight some of the relief around electronic delivery that already applies in the employer-employee context pending final approval of the proposed Regulation E-Delivery rule in whatever form that might take.

How we got here

Many required regulatory disclosures and reports under the federal securities laws have long been delivered in paper format. As internet and email access began to expand in the 1990s, the SEC began issuing interpretive guidance that permitted electronic delivery in some circumstances, provided generally that the person with a right to receive the applicable disclosures and reports affirmatively consented to e-delivery. In a 2000 Interpretive Release, the SEC resisted calls to expand e-delivery opportunities first provided in 1995/1996 releases. For example, in 2000, the SEC expressly concluded that the time had not yet come for an “access-equals-delivery” model, where investors would be assumed to have access to the internet, thereby allowing delivery to be accomplished solely by an issuer posting a document on the issuer’s or a third party’s website.

At the same time, the SEC in those 1995/1996 releases recognized that special relief is appropriate in the employer-employee context. At the heart of that relief is how to demonstrate evidence of delivery, one of the three elements of satisfactory electronic delivery in the current framework (along with notice and access). The 1995 release (Securities Act Release No. 7233 (Oct. 6, 1995)) provided that one method for satisfying the evidence-of-delivery element is to obtain an informed consent from an investor to receive information through a particular electronic medium. The 1996 release (Securities Act Release No. 7288 (May 9, 1996)) then provided that an issuer could presume consent to electronic delivery by employee-security holders who use the electronic mail system “in the ordinary course of performing their duties and ordinarily are expected to log-on to electronic mail routinely to receive mail and communications.”

What this looks like in practice: Equity incentive plans and Form S-8

One critical example of where this relief is in play are the following e-delivery rules presently applicable to employers awarding grants under equity incentive plans in reliance on an S-8 registration statement based on the guidance from the 1995/1996 releases:

Presumed consent; access. As noted above, an employer generally may presume consent to e-delivery by employees who are regular email users or, for those who are not regular email users, are able to receive e-delivery via other means, such as through administrative assistants or co-workers. However, the email must prominently state that a paper copy is available upon request, and the employer must in fact make paper copies available to any employee who asks.
Former employees. Because of an expectation that former employees and service providers no longer have routine workplace access, former employees and service providers must provide informed consent to e-delivery.
Form of delivery. The applicable materials can be attached to the e-delivery vehicle (for instance as attachments to an email) or, where documents are not directly attached , the e-delivery must provide employees and service providers with the information necessary to easily locate and retrieve them (g., directions for accessing them through the company’s local area network or a third-party provider’s equity program portal). The access medium must “not be so burdensome that intended recipients cannot effectively access the information provided,” and recipients must have the opportunity to retain the documents or have ongoing access equivalent to personal retention.

The employer-employee relief is not limited to S-8 circumstances, however, and it can prove very useful in other employee compensation circumstances as well, such as issuer tender offers.

What now: What’s next?

Proposed Regulation E-Delivery will likely establish new, uniform standards for electronic delivery of securities disclosures and reports – including the 10(a) prospectus under Form S-8. But the finish line is not here yet. In the meantime, compliance obligations under the current framework are fully effective, and the employer-employee e-delivery relief described above is available to use right now. Taking full advantage of existing relief requires attention to the details.

The applicable requirements are numerous and include rules that are easy to overlook –proper legending, maintaining a file of all prospectus materials for at least five years after they were last used, and the delivery rules that are the focus of this alert. Gaps in any of these areas can result in adverse consequences for your company and your employees, and the SEC’s rule proposal is a timely reminder that employers should be aware of the obligations and monitoring compliance with them on an ongoing basis. Cooley’s compensation and benefits group is ready to help you assess your current practices, close any gaps and position your program for the changes ahead. Reach out to your Cooley contact to get started.

Quantum Computing EOs Create Immediate Compliance Deadlines, New Federal Partnership Opportunities

Wed, 29 Jul 2026 19:37:54 Z

On June 22, 2026, President Donald Trump signed two executive orders (EOs) that make quantum computing a concrete compliance and business reality for critical infrastructure operators, federal agencies, federal contractors and quantum technology companies. The first order focuses on the threats posed by a quantum future and sets hard deadlines for migrating federal systems and contractor operations to post-quantum cryptography (PQC), with initial agency steps due by late July 2026. The second order launches a coordinated federal push to develop the most advanced quantum technologies in the world, creating significant partnership opportunities for the private sector.

This alert summarizes the key provisions, deadlines and action items arising from these orders. In light of the growing importance of quantum computing to organizations’ cybersecurity, privacy and data regulatory concerns, Cooley’s cyber/data/privacy practice will be publishing an ongoing series of alerts to keep you informed about what’s to come.

Overview: Two orders, two missions

Executive Order 14412, titled “Securing the Nation Against Advanced Cryptographic Attacks” (Defensive Order), focuses on US defense and preparedness against the threats posed by quantum computing. It responds to a threat that the Trump administration understands to already be materializing: Adversaries are collecting sensitive encrypted data today with the intention of decrypting it later, once large-scale quantum computers are operational. This “harvest now, decrypt later” strategy means the window for action is defined not by when quantum computers arrive, but by when organizations complete their migrations to quantum-resilient safeguards. Experts have been aware of this attack strategy for some time, since the algorithms underlying the widespread distribution of public key cryptography (such as RSA and elliptic curve) produce output using mathematical computations that make that output feasible to decryption in a reasonable period of time with quantum technology. To counter this, the Defensive Order mandates a government-wide transition to post-quantum cryptography (PQC), meaning encryption algorithms specifically designed to withstand attacks by both quantum computers and the classical computers in use today. Federal contractors and critical infrastructure operators, as defined under the USA PATRIOT Act, are squarely in scope.

Executive Order 14413, titled “Ushering In the Next Frontier of Quantum Innovation” (Innovation Order), focuses on US innovation and achieving primacy in the quantum technology space. It directs a whole-of-government effort to:

Develop a quantum computer capable of scientific discoveries beyond anything currently possible on a classical computer.
Accelerate quantum sensing and networking capabilities.
Strengthen domestic supply chains for quantum hardware and components.
Grow a trained US quantum workforce.
Entrench US global leadership in quantum technology.

The Innovation Order also serves as a call to the private sector, signaling the federal government actively seeks industry partners.

Immediate deadlines for federal agencies

For federal agencies, the deadlines in the Defensive Order begin almost immediately. Within 30 days of its release, or by July 22, 2026, every agency head must designate a PQC migration lead, meaning an employee who will be responsible for overseeing the agency’s cryptographic inventory, developing a prioritized migration plan and coordinating across the government, and will report to the agency’s chief information officer. Within 90 days, or by September 20, 2026, the Office of Management and Budget must issue guidance requiring agencies to review their inventories of their high- value assets and high-impact systems and submit plans to transition them, with firm completion targets:

All high-value assets and high-impact systems must use PQC for key establishment purposes (i.e., the creation of a shared encryption key for communication between different systems) by December 31, 2030.
All high-value assets and high-impact systems must use PQC for digital signature purposes (i.e., for verifying the authenticity and integrity of data) by December 31, 2031.

A NIST-led pilot migration on a subset of its own systems must begin within 180 days and be complete by December 31, 2027, providing a model for agencies to follow.

Implications for federal contractors

Federal contractors are not exempt. The Defensive Order requires the Federal Acquisition Regulatory Council, within 180 days, to publish a proposed rule requiring federal contractors to comply with post-quantum cryptography standards by December 31, 2030. A separate proposed rule, due within 270 days, would require federal contractors to maintain vulnerability disclosure programs and incorporate reports of cryptographic vulnerabilities into such programs, including the use of encryption methods that do not meet federal standards.

These proposed rules are not yet final but will be soon. Federal contractors that begin cryptographic inventories now – cataloging what systems they run, what encryption they rely on and where their gaps are – will be far better positioned than those who wait for the rules to be proposed and finalized.

Implications for critical infrastructure operators

The Defensive Order extends to operators of critical infrastructure across sectors including energy, water, transportation, healthcare and financial services. The federal agencies that oversee each of these sectors are required to assist operators in developing PQC migration plans. If you operate critical infrastructure, expect outreach from your sector’s federal oversight agency. Engaging proactively now will put you ahead of that process.

Implications for quantum technology companies

For companies in the quantum technology space, the Innovation Order signals substantial federal investment and partnership opportunities. The Innovation Order directs agencies to explore advance market commitments and use prize challenges to encourage private-sector participation in building next-generation quantum computers, quantum sensors and quantum networks, as well as in developing domestic supply chains for quantum-enabling components. Companies should monitor the National Quantum Strategy update due within 180 days of the Innovation Order, which will define the specific areas of federal focus and map where the partnership opportunities will be.

The Innovation Order also carries a cautionary note for quantum technology companies. The federal government intends to work with international allies to tighten restrictions on the export of quantum-enabling technologies to countries of concern and harmonize research security policies across allied nations to prevent adversarial actors from gaining access to critical quantum technology through research partnerships or other channels. For quantum technology companies, this signals that export control compliance in this space is likely to become more demanding, and that existing research collaborations with foreign universities, institutions or individuals may warrant a closer look.

Looking ahead

These EOs mark a turning point: Quantum computing is no longer a future concern but a present compliance and strategic priority. Whether your organization faces new migration obligations or stands to benefit from federal quantum investment, prompt attention to these orders is essential. Watch for the next installment in our quantum computing series, which will break down key quantum computing concepts, contextualize these orders and help enterprises and their leaders prepare for what comes next. If you have questions about either of these orders or any other quantum computing issues, please contact the Cooley cyber/data/privacy practice.

FCC Expands Restrictions on Covered List Equipment and Supply Chains

Wed, 29 Jul 2026 07:00:00 Z

The Federal Communications Commission (FCC) has adopted changes to its equipment authorization rules aimed at strengthening the security of the communications supply chain.

Building on its previous actions, the new Order expands the scope of its equipment authorization rules beyond retail products to include certain internal hardware components produced by entities prohibited from selling their products in the US because they create national security risks. (The list of these entities is known as the Covered List.) The Order also imposes new obligations on online marketplaces selling FCC-regulated devices, including requiring certain online marketplaces to display FCC IDs for certified equipment at the point of sale, subject to limitations and differentiated standards, in addition to other certification requirements for equipment modifications.

Logic-bearing hardware components

The Order closes what the FCC describes as the “component part loophole.” Until now, the FCC restricted the sale of retail products manufactured by named entities specifically named on the Covered List but did not restrict products manufactured with parts made by those entities. Under the new rules, devices incorporating “logic-bearing hardware components” produced by Covered List entities also become ineligible for FCC equipment authorization if the finished device itself would have been prohibited had it been manufactured by the Covered List entity. The FCC concluded that these components present national security risks and could permit unauthorized access, data collection or other malicious activity if they are incorporated into completed products sold in the US.

To implement this new rule, the FCC adopted a definition of “logic-bearing hardware component” that encompasses nearly all hardware capable of performing digital processing functions, including devices, modules, integrated circuits and other physical components that generate and use radio frequency energy to perform data processing functions, but does not include software and firmware at this time. Thus, manufacturers, importers and other companies seeking FCC equipment authorization will need to focus on their supply chains to determine whether logic-bearing hardware components made by entities on the Covered List are used in their products.

New online marketplace requirements

The Order applies the FCC’s marketing rules to online marketplaces that list, distribute or offer regulated equipment for sale. The FCC also concludes that online marketplaces are engaged in “marketing” when they list third-party products, even if they do not take title to those particular products. In that context, the Order requires online marketplaces to display FCC IDs at the online point of sale for devices subject to FCC certification, which generally are products that use radio waves to communicate with other devices. While the FCC’s definition of “online marketplace” is limited to websites that accommodate third-party sellers, the Order seems to apply the rules both to entities that sell products directly to customers and to online marketplaces that provide a platform for third-party sellers.

For listings subject to the rule, the specific requirements depend on the marketplace’s role in the transaction. Notably, if the marketplace sells the device itself, takes title to a third party’s device, or has physical access to the device through warehousing, fulfillment, consignment or shipping, the Order requires display of an FCC ID that is both valid and accurate for the listed product. If, however, a marketplace hosts a third-party listing but does not take title to or have physical access to the device, the marketplace must display a valid FCC ID, take reasonable steps to confirm that the ID is valid in the FCC’s database, and require the seller to certify the accuracy of the information. Marketplace operators are not required to provide FCC IDs for products sold by third-party sellers that are not “high-volume third-party sellers” or for listings for used devices. These new rules take effect six months after Federal Register publication for marketplaces that sell, take title to or physically handle devices, and nine months after publication for qualifying third-party listings where the marketplace does not take title.

Modifications to equipment manufactured by Covered List entities

The FCC adopted new restrictions on modifications to authorized equipment manufactured by Covered List entities. Going forward, any modification or permissive change performed by a Covered List entity must undergo full FCC certification, even if the underlying product was authorized through the Supplier’s Declaration of Conformity (SDoC) process, which covers products that emit radio waves but do not communicate with other devices. In addition, previously authorized equipment cannot later be modified in a manner that causes it to become covered equipment.

FCC considering additional changes

The Further Notice of Proposed Rulemaking signals additional changes that may be on the horizon. Among other proposals, the FCC seeks comment on requiring hardware and software bills of materials to be provided with equipment applications, expanding component restrictions to software and firmware, requiring certification for additional categories of devices, strengthening import restrictions, establishing expiration dates for equipment authorizations, and codifying permanent exceptions allowing software and firmware updates for previously authorized covered equipment in certain circumstances. These developments continue to reflect the FCC’s shift toward regulating the full communications equipment supply chain rather than focusing solely on finished products. The FCC also seeks comment on whether it should expand the rules to require online marketplaces to collect, verify or display information related to approvals through the SDoC.

Companies involved in the design, manufacture or sale of FCC-regulated equipment should evaluate whether their existing compliance programs adequately address the FCC's expanding supply chain requirements. Companies that will be affected should consider filing comments, as many of the FCC’s proposals could expand compliance obligations for both manufacturers and retailers.

If you have any questions about the Order or how it may impact your company, please contact the following Cooley communications attorneys:

Cooley Submits Comments on DFPI’s Proposed Rulemaking Under California’s VC Diversity Reporting Law

Thu, 23 Jul 2026 16:35:05 Z

Cooley recently submitted a formal comment letter to the California Department of Financial Protection and Innovation (DFPI), in response to the agency’s invitation for comments on proposed rulemaking under the Fair Investment Practices by Venture Capital Companies Law (FIPVCC).

The letter urges the DFPI to use the rulemaking process to resolve critical ambiguities in the FIPVCC and establish a workable compliance framework for the venture capital industry. Key recommendations include narrowing the “covered entity” definition with clear nexus standards, permitting consolidated reporting by controlling entities to reduce duplicative obligations, limiting the scope of reportable investments, excluding foreign investments from surveying and reporting obligations, allowing use of third-party platforms and substantively equivalent survey and reporting forms, and strengthening confidentiality and anonymization protections for firms and founders. These comments build on a March 2026 letter in which Cooley separately requested regulatory guidance on consolidated reporting, registration obligations and the scope of the survey distribution requirement.

Cooley also recommended that the DFPI maintain its current suspension of implementation and enforcement until the pending constitutional challenge filed in the US District Court for the Eastern District of California (1517 Management Company, LLC, et al. v. Mohseni, No. 2:26-cv-01957) is resolved. Following Cooley’s submission, the parties filed (and the court granted) a joint stipulation to extend the response deadline to July 31, 2026, to allow time for an anticipated joint motion to stay all deadlines and proceedings in the litigation, pending the DFPI’s issuance of final rules.

Cooley will continue to monitor the rulemaking, engage with the DFPI on behalf of our clients and assist clients in assessing their obligations under the FIPVCC.

From Opt In to Opt Out: SEC Proposes Electronic Delivery as Default for Required Disclosures

Wed, 22 Jul 2026 21:50:00 Z

On July 16, 2026, the Securities and Exchange Commission (SEC) voted to propose Regulation E-Delivery, a sweeping new framework that would make electronic delivery the default method for satisfying required disclosure delivery obligations under the federal securities laws. Under the proposal, covered entities, including issuers, broker-dealers, investment advisers, investment companies and other market participants, could deliver regulatory documents electronically without first obtaining each recipient’s affirmative consent. This marks a fundamental shift from the current framework, which has required investors and other recipients to opt in for electronic delivery and has otherwise defaulted to paper.

New default electronic delivery framework

The proposal would replace the SEC’s decades-old, guidance-based approach with a uniform rule establishing clear conditions for default electronic delivery. A covered entity could rely on Regulation E-Delivery where:

The recipient has provided an electronic address.
The entity has given the recipient prominent advance disclosure that covered information will be sent electronically.
The recipient has not opted out.

Importantly, Regulation E-Delivery is not a blanket rule. It would permit but not require electronic delivery. A covered entity may rely on it only where those conditions are satisfied, and it does not permit a blanket shift of all investors and other recipients to electronic delivery regardless of circumstances.

Methods of electronic delivery

The proposal provides two permissible methods of electronic delivery. For covered information that does not include personal financial information, a covered entity may deliver materials directly to the recipient’s electronic address; for example, as an email attachment or embedded document. For covered information that does include personal financial information, however, direct delivery is not permitted; instead, the covered entity must send a statement of availability directing the recipient to a secure website where the materials can be accessed. Covered entities may also elect to use the statement of availability method for materials that do not contain personal financial information.

Key investor protections

Covered recipients would retain the right to receive paper copies free of charge at any time. Investors currently receiving paper communications would receive two paper transition notices before being moved to electronic delivery, an initial notice at least 180 days before the transition and a follow-up notice approximately 30 days before.

Transition period

If adopted, the rule’s effective date would be 60 days after publication of the final rule in the Federal Register, with a two-year transition period before the current guidance-based framework is rescinded. The comment period will be open for 60 days following publication of the proposing release in the Federal Register, with comments due on or before September 21, 2026. The SEC has invited comment on several implementation aspects of the proposal, including the transition timeline, the mechanics of paper notice requirements and the framework’s treatment of recipients who prefer to continue receiving paper materials.

Impact on proxy season

For public companies, the proposal’s most immediate practical impact falls on the annual proxy process. Transitions to default electronic delivery of proxy statements and annual meeting materials could meaningfully reduce printing and mailing costs and lessen the administrative burden associated with annual meeting preparation.

Current delivery framework

Currently, issuers may satisfy proxy delivery obligations either by mailing a full set of proxy materials (on paper or electronically, for shareholders who previously opted in) or by using the SEC’s notice-and-access model, under which shareholders receive a paper Notice of Internet Availability directing them to proxy materials posted online.

Replacing the paper notice

The proposal would eliminate the paper Notice of Internet Availability as a stand-alone delivery method. In its place, shareholders with an electronic address who have not opted out would receive an electronic statement of availability, delivered to their electronic address and including a direct link to the proxy materials posted online. Shareholders would retain the right to opt out and receive a full paper set of materials at any time.

Related amendments to Exchange Act Rule 14a-16

The proposed changes to Rule 14a-16 under the Securities Exchange Act of 1934, as amended (Exchange Act), would also eliminate the long-standing 40-calendar-day e-proxy deadline. Because that deadline was specifically designed to give shareholders sufficient time to receive the paper notice, request paper copies of the materials, if desired, and review the proxy materials prior to executing a proxy, its removal follows naturally from the elimination of the paper notice itself. The proposal would also extend the electronic delivery framework to business combination proxy solicitations, which have historically required delivery of a full paper set of materials.

Additional amendments

In addition to establishing the new default delivery framework, the proposal would rescind Rule 30e-3 under the Investment Company Act, which currently provides registered investment companies with an alternative means to satisfy shareholder report transmission requirements. The proposal would also amend the rules governing the dissemination of tender offer materials in Rule 14d-5 under the Exchange Act. The SEC has noted that the proposal is intended to reduce unnecessary printing and mailing costs while providing investors with more timely, accessible and interactive disclosures that better reflect current communication practices.

***

Regulation E-Delivery is part of a broader pattern in the SEC’s current regulatory agenda: revisiting existing rules and guidance to give issuers and market participants greater flexibility to disclose and disseminate material information in real time, while maintaining the investor protection principles that underpin the existing federal securities framework.¹

Cooley’s corporate governance and securities regulation attorneys are available to discuss these issues with you.

Notes

This approach is further illustrated by two Corporation Finance Interpretations issued by the SEC’s Division of Corporation Finance in July 2026 (CFIs 104.03 and 131.04), which expanded the methods available to bidders for disseminating tender offer materials at commencement. Under the updated guidance, bidders in all-cash and exempt securities issuer and third-party tender offers that are not going-private transactions may satisfy the commencement dissemination requirement by issuing a press release through a widely disseminated news or wire service that contains a hyperlink to the full offer materials, in lieu of a summary newspaper advertisement or a mailing to shareholders. A bidder relying on this method must still mail by first-class mail, or otherwise furnish with reasonable promptness, its offer materials to any shareholder who requests them.

Seventh Circuit Holds Texts Not ‘Telephone Calls’ Under Key TCPA Provision

Wed, 22 Jul 2026 18:06:00 Z

On July 14, 2026, the US Court of Appeals for the Seventh Circuit decided Steidinger v. Blackstone Medical Services, holding that text messages “do not fall within the private right of action created by § 227(c)(5),” an important and heavily litigated provision of the federal Telephone Consumer Protection Act (TCPA).¹ Section 227(c)(5) creates a private right of action for individuals “who ha[ve] received more than one telephone call within any 12-month period by or on behalf of the same entity in violation of the regulations prescribed under [§ 227(c)].”² Those regulations include the Federal Communication Commission’s rules establishing the National Do-Not-Call Registry and requiring entities to maintain internal do-not-call lists.³

The Steidinger complaint alleged that class members received marketing texts from Blackstone Medical Services urging them to purchase home sleep tests. The plaintiffs claimed to have received these messages even after indicating they did not want to be contacted, including by replying “STOP” or registering on the National Do-Not-Call Registry.

The appeal turned on a single issue: whether texts are “telephone calls” within the meaning of § 227(c)(5). Beginning with the statutory text and applying the ordinary meaning of the term at the time of the TCPA’s 1991 enactment, the court observed that a “telephone” was then defined as an instrument for reproducing sounds at a distance, and a “call” meant communicating with someone by telephone. Because text messages do not reproduce sounds, the court concluded, they do not qualify as a “telephone call.” It further reasoned that the surrounding provisions of § 227(c) – which consistently use the broader term “telephone solicitation” when referring to communications that include non-voice messages – reinforce this reading. That is, the court presumed Congress used the narrower term “call” in § 227(c)(5) deliberately, given the alternative of “solicitation.” The Seventh Circuit affirmed the district court’s dismissal.

Why this ruling matters

The TCPA is a heavily litigated statute. It provides for statutory damages of $500 to $1,500 per violation, so even modest-sized class actions can present millions of dollars in exposure. Defendants frequently face pressure to settle even meritless cases due to the litigation costs and substantial damages potential.

Steidinger meaningfully changes the calculus. Because § 227(c)(5) is now confined to voice calls in the Seventh Circuit, text-based suits brought under this specific TCPA provision will no longer be viable in Illinois, Indiana and Wisconsin. For companies facing class action exposure under § 227(c)(5), this ruling eliminates a significant category of federal claims. The decision is also powerful persuasive authority for litigants in courts outside the Seventh Circuit. However, as discussed below, companies that communicate with customers via text remain subject to other TCPA provisions and to state telemarketing laws – including laws in the Seventh Circuit states that expressly apply their do-not-call rules to text messages.

Caveats

Several limitations are noteworthy. First and most importantly, Steidinger is binding only in the Seventh Circuit. Companies operating nationally should not assume text-message TCPA exposure has been eliminated.

Second, other circuits have reached the opposite conclusion. For example, in Howard v. Republican National Committee, decided in January 2026, the Ninth Circuit held that texts do constitute “calls” within the meaning of the TCPA, relying on agency interpretations and statutory context.⁴ The Seventh Circuit in Steidinger expressly acknowledged other circuits’ contrary holdings, including those from the First, Second, Ninth (Howard) and Eleventh Circuits, but declined to follow them.

Third, Steidinger addressed only the private right of action under § 227(c)(5) for violations of the do-not-call rules. The decision did not reach the separate TCPA provisions that prohibit nonconsensual autodialed calls to cell phone numbers.⁵ The FCC and many courts have interpreted those provisions to cover text messages, and that interpretation – while potentially vulnerable to challenge under the same textualist logic the Seventh Circuit applied in Steidinger – technically has not been disturbed. For the time being, § 227(b)’s autodialer rules remain a potential source of text-message litigation even in the Seventh Circuit. Companies should continue to maintain robust TCPA compliance programs addressing all applicable provisions of the statute.

Fourth, telemarketing laws in the Seventh Circuit states independently regulate text messages. For example, Indiana’s Telephone Solicitation of Consumers Act expressly defines “telephone sales call” to include the transmission of text messages via SMS and multimedia messages via MMS.⁶ Wisconsin’s telephone solicitation statute similarly defines “telephone solicitation” to include “the unsolicited initiation of a telephone conversation or text message” for commercial purposes,⁷ and the implementing regulations (ATCP 127.80(12)) separately define “text message” to include SMS and similar electronic communications. Both states prohibit solicitation texts to numbers on their state do-not-call registries. These state-law obligations operate independently of the federal TCPA, and Steidinger does not affect them.

What’s next?

Steidinger is powerful new authority for companies that use text messages to communicate with their customers. Looking ahead, this question may be a candidate for US Supreme Court review, given the growing split among circuit courts considering this issue. In the meantime, companies should not treat this ruling as blanket protection for their text messaging programs and should continue to carefully evaluate their compliance obligations under federal and state law.

Notes

__ F.4th __, 2026 WL 2028517, at *5 (7th Cir. July 14, 2026).
47 USC § 227(c)(5).
See 47 CFR § 64.1200(c)-(d).
164 F.4th 1119, 1123–25 (9th Cir. 2026).
See 47 USC § 227(b)(1)(A)(iii).
Ind. Code § 24-4.7-2-9(b).
Wis. Stat. § 100.52(1)(i).

FTC Secures Record $12 Million Penalty for HSR Violation

Wed, 22 Jul 2026 13:07:14 Z

FTC takes aim at deal structures that avoid HSR filing obligations

On July 13, 2026, the Federal Trade Commission (FTC) announced that Edwards Lifesciences and Genesis MedTech Group agreed to pay a combined civil penalty of $12 million to settle allegations that they intentionally structured Edwards’ acquisition of JC Medical, a subsidiary of Genesis, to avoid premerger reporting requirements under the Hart-Scott-Rodino (HSR) Act, a “device in avoidance.” The settlement is the largest civil penalty ever imposed for failure to file an HSR notification.

This enforcement action appears to have grown out of the FTC’s earlier substantive investigation into Edwards’ proposed acquisition of JenaValve Technology, which the FTC alleged was the only other company besides JC Medical that was, at the time, conducting US clinical trials for transcatheter aortic valve replacement for aortic regurgitation (TAVR-AR) devices. Edwards announced the JenaValve acquisition the day after closing the JC Medical acquisition. The FTC successfully sought a preliminary injunction blocking the JenaValve deal in January 2026, shortly after which Edwards abandoned the deal.

The Edwards/Genesis complaint centered on two contemporaneous transactions between Edwards and Genesis: a $115 million acquisition for JC Medical voting securities and a $25 million investment in nonvoting securities of Genesis, which, if both counted toward the size of transaction, would have been over the then-applicable threshold. The FTC alleged that the parties’ internal documents “made clear that both [payments] were part of a single transaction.” The complaint also cited an email in which Edwards reportedly described such two-tiered deal structure as “below the threshold! Intentional[.]”

While device-in-avoidance enforcement actions are rare (only two in this century), the Edwards/Genesis settlement may be part of a larger agency push to rein in deal structures that result in transactions not requiring filings, especially acquihires, which have become more common in the AI space.

FTC alleged payment for nonvoting securities of Genesis was really consideration for acquisition of JC Medical

On July 22, 2024, Edwards acquired JC Medical from Genesis by purchasing all voting shares of JC Medical for $115 million, plus contingent milestone payments. Concurrently, Edwards committed to a separate $25 million investment in nonvoting shares of the parent company, Genesis, which closed on August 9, 2024. Taken individually, the $115 million subsidiary purchase fell below the then-applicable $119.5 million HSR size-of-transaction threshold, and the $25 million parent investment involved nonvoting equity. Under standard HSR aggregation rules, two purchases from the same ultimate parent entity are aggregated if the acquiring person is purchasing voting securities or assets in both instances. However, because the $25 million investment in Genesis involved nonvoting securities, the consideration paid for such shares was excluded from the size-of-transaction calculation under the HSR Act. Consequently, the transactions closed without premerger HSR notifications.

The FTC alleged that the $25 million nonvoting investment in Genesis was “intended [… ] to be additional compensation to Genesis for the sale of JC Medical to Edwards,” and, when combined with the $115 million acquisition price, would have resulted in total consideration of $140 million, exceeding the then-applicable $119.5 million threshold and triggering an HSR filing obligation. The FTC pointed to the parties’ internal documents indicating that the split payment structure was not reached for independent commercial reasons. Per the preliminary injunction opinion from the related JenaValve litigation, after Edwards internally flagged an “H[SR] concern” with its offer, JC Medical’s then-CEO proposed that “‘[if] the HSR component [wa]s a no-go for the deal structure,’ Edwards could close the valuation gap by making a separate investment in Genesis” rather than by increasing the stated acquisition price.

The FTC challenged the transaction as a “device in avoidance” under 16 CFR § 801.90 (Rule 801.90), which provides that “[a]ny transaction(s) or other device(s) entered into or employed for the purpose of avoiding the obligation to comply with the requirements of the [HSR Act] shall be disregarded, and the obligation to comply shall be determined by applying the [HSR Act] and these rules to the substance of the transaction.”

Edwards/Genesis is particularly noteworthy because the antitrust agencies rarely invoke Rule 801.90 in enforcement actions. Indeed, before Edwards/Genesis, the enforcement action against Canon/Toshiba, settled on June 10, 2019, was the only civil penalty case in the 21st century invoking the anti-evasion rule.

In Canon/Toshiba, Toshiba transferred all voting shares in Toshiba Medical Systems Corporation (TMSC), a subsidiary of Toshiba, to a newly created special purpose vehicle (SPV) for nominal consideration. Simultaneously, Canon purchased the only nonvoting share in TMSC – coupled with options to purchase all voting shares from the SPV for nominal consideration – for $6.1 billion. The complaint alleged that, despite the nonvoting nature of the share acquired by Canon, the terms of this single-share-plus-options package effectively transferred full beneficial ownership and economic interest in TMSC to Canon. The FTC alleged that such structure was designed to allow Toshiba to recognize the $6.1 billion sale proceeds before its fiscal year-end without observing the HSR waiting period. To settle the allegations, Canon and Toshiba each paid a $2.5 million civil penalty ($5 million combined).

Edwards/Genesis is also notable because the allegations involve consideration attributed to nonvoting securities, which is a feature of recent acquihire structures, often involving an acquisition of nonvoting securities and a nonexclusive license to intellectual property, both of which are traditionally considered not reportable.

Record fine levied against buyer and seller, plus five-year notice requirement

The proposed settlement requires Edwards to pay $10 million and Genesis to pay $2 million. The combined $12 million is the largest civil penalty ever imposed for failure to make an HSR filing. The penalty is notable in part because civil penalties are more commonly imposed on acquirers; requiring a seller to pay is less common, though not unprecedented (e.g., Canon/Toshiba split the $5 million penalty equally between buyer and seller).

The $12 million penalty is a relatively small fraction of the theoretical maximum exposure. The government alleged that the parties were in violation of the HSR Act for 721 days beginning July 22, 2024. At the current maximum penalty of $53,088 per day per defendant, the government could have sought approximately $38 million from each party, or roughly $77 million combined. The $12 million settlement thus represents approximately 16% of the maximum.

In addition to the monetary penalty, the proposed judgment requires Edwards, for a period of five years, to provide at least 30 days’ advance written notice to the FTC before acquiring any interest in any firm that commercially sells, is conducting US clinical trials for, or holds a US Food and Drug Administration Investigational Device Exemption for a TAVR-AR device, regardless of whether such an acquisition would otherwise require an HSR filing. Edwards must also implement an antitrust compliance program, including designation of a compliance officer and annual certifications from relevant personnel. The five-year term is two years longer than the three-year term imposed in the Canon/Toshiba judgment.

What this means for dealmakers

The HSR rules elevate substance over form, and fewer bright lines remain. Edwards/Genesis shows that the antitrust agencies are prepared to look past the formal structure of related payments – including payments characterized as a nonvoting equity investment in the seller parent – to assess whether, in substance, they constitute integrated consideration for one acquisition.
Internal documents and deal communications carry significant weight. The FTC’s complaint relied heavily on how the transaction was discussed internally and in negotiations, not only on how it was documented in the final agreements. Emails, board presentations and deal correspondence that reference the HSR threshold in connection with pricing decisions, including discussions about structuring around the threshold, may be used to establish the purpose of a transaction structure under Rule 801.90.
The FTC’s skepticism of nonvoting securities as consideration may have implications for acquihires and other nontraditional structures. The FTC under the Trump administration has expressed concerns about transactions being structured to avoid HSR filings. For example, Chairman Andrew Ferguson has said that the agency is examining acquihires, particularly in AI, for potential HSR evasion and substantive antitrust concerns, and may issue additional guidance. Similarly, Commissioner Mark Meador has warned companies against acquihire structures that are deliberately “designed to fall below premerger notification thresholds” to “limit[] the opportunity for advance [agency] review,” emphasizing the importance for the agency to “look past formal transaction labels and assess whether a deal, however packaged, forecloses competition and constrains access to the specialized talent on which dynamic markets depend.” To address these concerns, the FTC issued a Request for Public Comment, seeking input on whether to formally extend HSR coverage to “non-traditional transaction structures,” including acquihires and convertible security transactions. Edwards/Genesis may be part of this initiative, offering a real-time example of how parties have allegedly attempted to structure transactions to avoid HSR filings.
Buyers and sellers can each be on the hook for civil penalties. Both buyers and sellers have independent HSR filing obligations and can each face civil penalties for structures that the government deems to violate the HSR Act. The $2 million penalty against Genesis illustrates that sell-side exposure is real. Sell-side counsel should conduct an independent HSR analysis and should not rely solely on the buyer’s threshold determination, particularly where the deal structure involves payments to the seller or its affiliates that are structured separately from the stated acquisition price.

European Commission Adopts Revised EU CSRD Reporting Standards

Tue, 21 Jul 2026 07:00:00 Z

On 3 July 2026, the European Commission adopted a delegated act setting out revised European Sustainability Reporting Standards (ESRS) and a delegated act setting out voluntary reporting standards for smaller companies. The revised ESRS will replace the previous version of the ESRS (Previous ESRS).

The ESRS are the mandatory reporting standards for European Union (EU) companies subject to the EU Corporate Sustainability Reporting Directive (CSRD). These updates will affect many US companies that fall within the CSRD’s scope through their EU subsidiaries and are required to file CSRD reports starting from fiscal year 2027. The standards are now effectively final – they still require formal adoption by the EU but they can no longer be amended. We anticipate formal adoption to happen in the coming months.

The overarching goal of the revision was to simplify and streamline the Previous ESRS, complementing the changes to the scope of the CSRD introduced by the Omnibus I package (read our alert here). The European Commission states that the mandatory data points have been reduced by over 60%, and as a result, estimates reporting costs will decrease by approximately 30% per company.

Our key takeaways

1. Topics have not changed

The revised ESRS continue to cover the same topics as the Previous ESRS: ESRS 1 and 2 (general requirements and disclosures), five environmental standards (climate change, pollution, water, biodiversity and ecosystems, and resource use and circular economy), four social standards (own workforce, workers in the value chain, affected communities and consumers and end users), and one governance standard (business conduct).

2. Mandatory data points reduced by 60%, but a new ‘fair presentation’ requirement is introduced

According to the European Commission, mandatory data points have been reduced by over 60% and total data points by over 70% compared to the Previous ESRS. However, a new ‘fair presentation’ requirement introduced in ESRS 1 requires that the information disclosed is comparable, verifiable and understandable. It also requires the disclosure of entity-specific information where the topical disclosures do not cover them in sufficient granularity to allow users to understand the material impacts, risks and opportunities. In practice, this gives companies more flexibility but also places a heavier burden on them to justify their conclusions, including to their CSRD assurance provider.

3. Prohibition on reporting nonmaterial information

The revised ESRS generally prohibit reporting disclosure requirements, data points and entity-specific information where they are not material. Nonmaterial information may still be included in the CSRD report where it:

Must be disclosed under other legislation.
Stems from generally accepted reporting standards or frameworks, including nonmandatory or sector-specific guidance published by other standard-setting bodies (such as the Global Reporting Initiative).
Is needed to meet the data demands of a specific user.

Any nonmaterial information must be clearly identified as such, comply with the faithful representation principle, and not obscure material information. Companies that have been using CSRD reporting for broader sustainability disclosures should take particular note of this restriction, which will limit the amount of additional ‘marketing-speak’ that can be included in a CSRD report.

4. Double materiality perspective retained

Companies will still need to consider both financial and impact materiality and when working out what is material, it is still necessary to consider both financial users of the report and nonfinancial users of the report. Financial materiality continues to require consideration of material risks and opportunities attributable to business relationships across the upstream and downstream value chain, unchanged from the Previous ESRS.

5. ‘Top-down’ approach permitted for the double materiality assessment

Revised ESRS 1 introduces the option to use a ‘top-down’ approach. According to the top-down approach, the double materiality assessment (DMA) begins with an analysis of the business model, including sectors, geographies, and the features of the upstream and downstream value chain to identify the most evident material topics. However, companies can continue using the ‘bottom-up’ approach or even combine a ‘top-down’ approach for some topics and a ‘bottom-up’ analysis for others. This provision will apply from FY 2026.

As for refreshing the DMA, revised ESRS 1 requires companies to consider annually whether significant changes – such as changes to activities, structure, business relationships, understanding of impacts, risks or opportunities, assessment methodologies, or the external environment – would affect their materiality assessment conclusions. If so, the DMA must be reviewed and updated. Companies should be aware that any decision not to refresh the DMA is likely to be questioned by their assurance provider.

6. Taking account of mitigating measures in the double materiality assessment

A significant area of uncertainty under the Previous ESRS was to what extent mitigating measures can be taken into account when defining material topics for CSRD reporting. The revised ESRS 1 take the following approach to considering mitigating measures:

For the severity of actual negative impacts, the assessment must not consider remediation activities to address impacts if those activities were undertaken during the reporting period.
For the severity and likelihood of potential negative impacts, the assessment should take into account implemented prevention and mitigation policies and actions only if those policies and actions can reasonably be assumed to effectively reduce the severity or likelihood. Actions or policies that have not yet been implemented must not be considered.
The materiality assessment needs to consider information on policies and actions used to manage negative impacts if they are decision-useful to users, irrespective of how effectively the company manages the impacts or of how effectively the corresponding topics are regulated.
Companies must assess positive impacts “without netting against negative impacts”. Actions to prevent, mitigate, end, minimise or remediate negative impacts or mere compliance with legal requirements do not qualify as positive impacts. Companies should therefore ensure they do not conflate positive impacts with mitigation or prevention measures.

7. Reduced scope for reporting on opportunities

Under the Previous ESRS, it was left open to companies to report on sustainability-related opportunities, including at the sector level. Revised ESRS 1 now prohibits reporting on general sector-level opportunities. Companies must limit their disclosures to opportunities that are currently being pursued or incorporated into their strategy.

8. Greater flexibility to rely on proxies and estimates in value chain reporting

Revised ESRS 1 gives companies greater flexibility to rely on proxies and estimates for value chain information, and removes the previous obligation to “make reasonable efforts” to obtain information from value chain partners. This is a significant practical relief, particularly for companies with complex or fragmented supply chains.

However, important limitations remain:

Data and assumptions used in sustainability reporting must, to the extent possible, be consistent with those used to prepare the financial statements, and any differences must be explained.
For the first three financial years (FY) of CSRD reporting, where not all necessary value chain information is available, the company must explain the efforts made to obtain the information, why it was not available and its plans to obtain it in the future.

9. New ‘undue cost or effort’ relief

Under the revised ESRS, when carrying out the materiality assessment and preparing the CSRD report, the company must “use all reasonable and supportable information that is available to the undertaking at the reporting date without undue cost or effort”. This proportionality mechanism, inspired by the International Sustainability Standards Board’s S1 and S2 standards, means companies need not gather information for materiality assessments or metrics disclosures if doing so would entail an undue cost or effort. “Undue cost or effort” is not directly defined and will depend on a company’s specific circumstances, requiring a balanced assessment of the costs and efforts involved against the benefits of the resulting information for users. What is reasonable and supportable information that is available to the undertaking without undue cost or effort must be reassessed for each reporting period.

10. Disclosures on anticipated financial effects

Disclosure of qualitative and quantitative information on anticipated financial effects remains mandatory for material risks and opportunities. However, this is subject to exceptions and phase-in periods, e.g., allowing companies starting to report from FY 2027 to omit information on anticipated financial effects for the first two reporting years, and to omit quantitative information about anticipated financial effects for their first four reporting years. Qualitative and quantitative information about current financial effects for which there is a significant risk of a material adjustment within the next annual reporting period to the carrying amounts of assets and liabilities reported in the related financial statements is also mandatory.

In addition, under ESRS 2, companies are also required to disclose the amounts of significant financial resources allocated to key actions taken to manage material impacts, risks and opportunities and achieve the objectives or related policies in the reporting period (if any) and provide an indicative range of significant future financial resources expected to be allocated. Anticipated financial effects from material climate-related physical and transition risks and opportunities must also be disclosed under ESRS E1. However, some of this information on transition risks and opportunities is subject to a two-year grace period (four years for certain quantitative information) for companies starting to report from FY 2027.

11. Changes to environmental and social standards

A number of changes have been made to the environmental and social disclosure standards. For example, if a company does not have a transition plan for climate change mitigation that includes certain key features such as greenhouse gas (GHG) emission reduction targets, key actions, and compatibility with the 1.5°C target, it must disclose this fact and indicate whether and, if so, when it expects to adopt one. For S1-16 (Incidents of discrimination and other human rights incidents), only substantiated and verified instances of human rights incidents need to be reported. This is narrower than under the Previous ESRS, which required reporting of mere complaints.

12. Value chain cap and other reliefs

The revised ESRS reflect the Omnibus I amendments, which introduced a value chain cap to CSRD: companies subject to the CSRD cannot require companies in their value chain that have 1,000 employees or fewer to provide more sustainability information than is required by the voluntary reporting standard adopted alongside the revised ESRS. However, this exemption does not cover ESRS E1-8 metrics (gross Scope 1, 2 and 3 GHG emissions). The exemption will apply from FY 2026.

Additional specific reliefs include the option to exclude activities from metric calculations if they are not a significant driver of the relevant impacts, risks, or opportunities and their exclusion is not expected to impair the relevance and faithful representation of the reported information. If this relief is relied on, that fact should be disclosed in the CSRD report. Another new relief provides that companies which acquire a subsidiary during the reporting period may defer its inclusion in the materiality assessment and sustainability statement to the following reporting period. Conversely, if a subsidiary leaves the group during the reporting period, the company may adjust the scope of its materiality assessment and reporting boundary from the beginning of the current reporting period.

13. Presentation and structuring for machine readability

Companies should also consider how their sustainability statements will be reviewed in practice. Benchmarking bodies, proxy advisors and institutional investors are increasingly using large language models and automated text-analysis tools to review and compare sustainability reports at scale. Clear structure, consistent headings, well-defined key terms and a logical information architecture will play an increasingly important part in determining how a company’s disclosures are interpreted and ranked.

The revised ESRS introduce an optional executive summary and the ability to present EU Taxonomy disclosures in a separate appendix, which may improve accessibility and navigability.

Next steps

The revised ESRS and the voluntary reporting standards have been presented to the Council and the European Parliament, which have two months to scrutinise the texts. They cannot propose amendments. They may only reject the delegated act in full, which is widely considered unlikely. Upon publication in the Official Journal of the EU, the revised ESRS will enter into force on 20 November 2026 and apply to financial years beginning on or after 1 January 2027. We recommend that in-scope companies begin assessing the impact of these changes on their reporting processes and materiality assessments now.

Please reach out to any member of the Cooley ESG team if you have any questions.

VivaTech 2026: Cooley and the French Innovation Ecosystem

Mon, 20 Jul 2026 15:50:00 Z

VivaTech 2026 brought more than 200,000 technology leaders, entrepreneurs, investors and policymakers to Paris for four days of discussion on the forces shaping the global innovation economy. Across the conference, conversations reflected a maturing European ecosystem, where AI, life sciences, enterprise technology and capital formation are increasingly interconnected.

Event summary

For Cooley, the week offered a timely view into the priorities and ambitions of the French and European innovation ecosystems. Our presence at VivaTech focused on engaging directly with founder-led companies, investors and industry leaders across technology, life sciences and AI, as well as better understanding how companies in France and across Europe are navigating growth, funding, regulation and international expansion.

The week also marked the Paris launch of Cooley Off the Record, a discussion series designed to create space for candid exchange among the people building and backing high-growth companies.

Cooley Off the Record, hosted at Hotel Molitor on 17 June, created a new forum in Paris for intimate, practical conversations among founders, investors and industry professionals about the opportunities and challenges of building and scaling companies.

Key takeaways

A global platform with local relevance. VivaTech’s scale underscored Paris’ role as a convening point for the international technology community, while highlighting the strength and ambition of the French market.
AI as both opportunity and operating reality. Discussions moved beyond broad enthusiasm to practical questions about adoption, governance, sector-specific applications and long-term business models.
Cross-sector innovation is accelerating. The overlap among technology, life sciences and data-driven business models was a recurring theme, particularly for companies operating in healthcare, enterprise technology and other regulated or complex sectors.
France’s innovation ecosystem is gaining depth. The market is supported by a growing base of ambitious founders, experienced investors and sector expertise across technology and life sciences.
Responsible adoption is a central theme. The most relevant conversations at VivaTech focused not only on what new technologies can do, but also on how companies can responsibly adopt, commercialize and scale them.
Cross-border growth brings added complexity. As companies scale internationally, legal, regulatory and strategic considerations are becoming increasingly central to growth conversations, particularly for businesses operating at the intersection of innovation and regulated markets.
Sustained engagement matters. Cooley’s engagement in Paris reflects a continued commitment to participating in the French ecosystem, not only around major industry events but through ongoing dialogue with the startups, investors and innovators shaping the market. Visit our France webpage to find out more about our commitment to the French ecosystem.

VivaTech reinforced that innovation ecosystems are built through sustained engagement, shared perspective and practical collaboration. Cooley’s time in Paris, including the launch of Cooley Off the Record, reflected that approach and underscored the importance of continued connection with the people and companies shaping the future of France as a leading global player in the technology and life sciences ecosystems.

Capital Markets Update – July 2026 One-Minute Reads

Mon, 20 Jul 2026 07:00:00 Z

SEC proposes rescission of climate-related disclosure rules

The Securities and Exchange Commission (SEC) announced it has proposed to rescind the climate-related disclosure rules and has requested comments by August 3, 2026. See the proposed rules and the fact sheet. Comments can be submitted or viewed here, and you can also read statements from Chair Paul Atkins, Commissioner Mark Uyeda and Commissioner Hester Peirce. For information and insights on the proposal, see this Cooley alert and this TheGovernanceBeat.com post. For other thoughts on the proposed rescission, see this ESG Dive article, this Responsible Investor article, this Bloomberg Law article, this TheCorporateCounsel.net blog post and this TheCorporateCounsel.net blog post.

SEC settles charges for violating whistleblower protection rule

The SEC announced settled charges against Foot Locker for using separation agreements with a provision that purported to waive employees’ rights to receive SEC whistleblower awards. According to the SEC’s order, approximately 148 departing Foot Locker employees signed separation agreements in order to receive severance payments. The order finds that the agreements contained a provision that purported to waive employees’ rights to receive whistleblower awards from the SEC, and that Foot Locker phased out the award waiver provision in its separation agreements and no longer requires departing employees to waive such rights. The SEC’s order finds that Foot Locker violated Rule 21F-17(a) of the Securities Exchange Act of 1934, which prohibits any person from taking any action to impede an individual from communicating directly with SEC staff about a possible securities law violation. Without admitting the findings in the order, Foot Locker consented to the entry of a cease-and-desist order and agreed to pay a $148,000 civil penalty. For more information, see this CompensationStandards.com blog post.

SEC approves new Nasdaq delisting rule

Per this SEC order, Nasdaq’s proposed rule change (SR-NASDAQ-2026-009), as modified by Amendment No. 1, is approved on an accelerated basis. Nasdaq Rule IM-5101-4 provides that where a security exhibits trading activity that is indicative of potential manipulation, and the SEC has implemented a temporary trading suspension of that security pursuant to Section 12(k) of the Act (Section 12(k) suspension), Nasdaq may exercise its authority under Nasdaq Rule 5101 to delist the security when it determines that doing so is necessary to protect investors. Nasdaq would be permitted to exercise the discretionary authority even when the security and the listed company otherwise satisfy all applicable Nasdaq listing standards at the time of determination. For more information, see this TheCorporateCounsel.net blog post.

Corp Fin posts new CFI – Rights listings in business combinations

The SEC’s Division of Corporation Finance has posted new Securities Act sections corporation finance interpretation (CFI) 142.01, which addresses the contents of a registration statement of securities underlying rights that are to be listed on an exchange. For more information, see this TheCorporateCounsel.net blog post.

Question: A company seeks to list rights on a national securities exchange in connection with a business combination transaction without the underlying securities also being listed. As required by the exchange, the company must have an effective registration statement, prior to the rights being listed, that registers the issuance of the underlying securities upon exercise of the rights. Must the registration statement contain information regarding the specific transaction and the business to be acquired?

Answer: Yes. The registration statement must contain information about the contemplated business combination transaction and the business to be acquired.

Supreme Court validates SEC’s use of disgorgement without investor loss

Per this TheCorporateCounsel.net blog post, the US Supreme Court issued its decision in Sripetch v. SEC, in which it unanimously held that the SEC may obtain a disgorgement award from a defendant in an enforcement proceeding without a showing of pecuniary loss to investors. In his opinion for the Supreme Court, Justice Neil Gorsuch reviewed the history of the SEC’s use of the disgorgement remedy, the Supreme Court’s 2020 decision in Liu v. SEC limiting the agency’s use of disgorgement and federal legislative responses to that decision. Citing a variety of judicial precedent, Justice Gorsuch concluded that neither the Supreme Court’s decision in Liu nor traditional equitable principles required the SEC to establish pecuniary harm in order to use disgorgement as a remedy. For more information, see this SCOTUSblog post.

CapitalXchange offers current SEC rulemaking overview

In this CapitalXchange blog, Cooley’s Liz Dunshee explores the five recent SEC rulemakings (touching capital markets access, scaled disclosure accommodations, reporting cadence, climate disclosure and enforcement practice) and how they fit together and reflect growing momentum for the overarching goal of SEC Chair Paul Atkins to “make IPOs great again.”

SBTi releases finalized new corporate net-zero standard

Per this ESGtoday article, the Science Based Targets initiative (SBTi) announced the release of Corporate Net-Zero Standard Version 2.0, its update to its flagship standard to assess, certify and track companies’ decarbonization commitments and support science-based climate target setting. Among the key changes introduced with the new standard is the use of a “best-efforts” framework, enabling companies to remain in compliance with the standard even if targets are not achieved, with an expectation for companies to utilize “all available levers to drive emissions reductions,” and to be transparent about implementation barriers and mitigating actions, with the SBTi “acknowledging that factors outside a company’s control may affect progress.” See also this article from The Wall Street Journal.

CARB proposes revisions to SB 253 and deferral of reporting deadline

The California Air Resources Board (CARB) announced it is updating its regulatory proposal to defer the reporting deadline for entities to report Scope 1 and Scope 2 greenhouse gas emissions from August 10, 2026, to November 10, 2026. In addition, CARB will be proposing limited changes to the regulation to clarify certain requirements and will make these available for comment as part of a 15-day public comment period. A new proposed reporting deadline of November 10 will help ensure reporting entities have additional clarity following approval of the final regulation before reporting is due. For more information, see this ESG Dive article.

Nasdaq amends proposed $5 million market cap for continued listings

In January, Nasdaq filed a proposal with the SEC to adopt a continued listing requirement of at least $5 million market value of listed securities (MVLS). Since January, the SEC has extended the time to act on the proposal and posted an order instituting proceedings to determine whether to approve the proposed rule change. Now, the SEC has posted a new notice to solicit comments on a revised proposal from Nasdaq. Comments on the amended proposal were due July 10, 2026. To address comments previously received, Nasdaq amended its proposal by giving the Hearings Panel more discretion. Nasdaq proposes to modify the initial proposal, which would have prevented a Hearings Panel from reinstating a company that failed to maintain a minimum of $5 million MVLS. Instead, Nasdaq now proposes to adopt Listing Rule 5815(c)(1)(I) to provide that in the case of a company that received a Staff Delisting Determination due to a failure to maintain MVLS of at least $5 million under Rule 5450(a)(3) or 5550(a)(6), the Hearings Panel, where it deems appropriate, may grant an exception for a period not to exceed 180 days from the Staff Delisting Determination for the company to demonstrate that it meets all requirements for initial listing. For more information, see this TheCorporateCounsel.net blog post.

Enablement Risks for Method of Treatment Claims After Wyeth v. AstraZeneca

Fri, 17 Jul 2026 20:54:00 Z

On July 9, 2026, the US Court of Appeals for the Federal Circuit issued a precedential decision in Wyeth LLC v. AstraZeneca Pharmaceuticals LP, No. 2024-2325. The Federal Circuit affirmed the district court’s holding that the asserted claims were invalid for lack of enablement and granting AstraZeneca judgment as a matter of law to set aside Wyeth’s $107.5 million jury verdict. (Slip op. at 2, 19.)

Following the US Supreme Court’s 2023 decision in Amgen v. Sanofi, the trend toward increased scrutiny for enablement for life sciences patents has continued. The Wyeth decision has implications for patents claiming methods of treatment, which are frequently sought prior to the availability of clinical data.

The patents at issue

The Wyeth patents claimed methods of treating non-small cell lung cancer (NSCLC) that has become resistant to standard drug therapies, using a class of drugs called irreversible epidermal growth factor receptor (EGFR) inhibitors. (Slip op. at 2-3.)

The specification described three candidate drugs and provided experimental cell assay data (not in patients) showing that these compounds could kill cancer cells (the “in vitro” testing). (Slip op. at 3-4). The specification also listed broad daily dose ranges of approximately 1 to 1,000 mg. However, the patents taught that “[p]recise amounts of active ingredient … depend on the judgment of the practitioner and are peculiar to each individual” but contained no examples of any of these drugs administered to human patients. (Id. at 4.)

Claim construction: ‘Unit dosage’ requires more than in vitro activity

An exemplary claim recited a method “comprising administering daily to the patient ... a pharmaceutical composition comprising a unit dosage” of the claimed drug. (Slip op. at 3 (quoting ’314 patent 35:52-60).)

Before trial, the district court construed the term “unit dosage” according to the specification’s own express definition as “physically discrete units suitable as unitary dosage for the subject, each unit containing a predetermined quantity of active material calculated to produce the desired therapeutic effect in association with the required diluents; i.e., carrier, or vehicle.” (Slip op. at 5, citing Claim Construction Decision, 2023 WL 2683559, at *9 (emphasis added).) At the judgment as a matter of law (JMOL) stage, the district court explained the practical consequence of that construction in the context of the full claim was the requirement for an actual repeatable dosing regimen capable of producing a therapeutic effect in a human patient, not merely a compound shown to kill cancer cells in a laboratory setting. In other words, based on the claim language as construed by the court, the claimed dosage must work in a person, not just in the laboratory. (Id. at 6.)

Wyeth argued on appeal that the district court improperly imported clinical safety and efficacy requirements into the claims, contending the claims required nothing more than inhibiting EGFR activity and killing cancer cells in vitro. (Slip op. at 9.) The Federal Circuit disagreed because the claims, as construed, required the daily administration of a dosage “calculated to produce the desired therapeutic effect.” (Id. at 10-11.) This construction drew in patient-level efficacy as a required part of the claim. (Id.) According to the Federal Circuit, however, this does not mean Wyeth’s specification needed to demonstrate US Food and Drug Administration-approved safety or clinical optimality. Instead, the claim as construed required only that the claimed dosage be capable of producing a therapeutic effect when administered to a patient. (Id.)

The Federal Circuit also rejected Wyeth’s argument that the district court had amended its claim construction post-verdict, finding that the district court’s statements in its JMOL order were permissible clarifications of its original pre-trial construction. (Slip op. at 12.)

Enablement: The specification’s in vitro data could not bridge the gap to patient dosing

The Federal Circuit identified several interconnected failures in the disclosure of Wyeth’s specification:

No working patient examples. The specification provided no examples of any irreversible EGFR inhibitor being given to a human patient at a dose that worked. (Slip op. at 14.) The three candidate drugs described in the patents were tested only in in vitro experiments on cancer cells, and the specification gave no guidance on how to convert those lab results into a dose that could safely and effectively be given to a real patient. (Id.)
Broad, unvalidated dose ranges. The dose ranges disclosed in the specification – a per-body-weight range of approximately 0.5 to 1,000 mg/kg, and a total daily dosage range of 1 to 1,000 mg (preferably 2 to 500 mg), which the specification described as “general” and “projected” – came with no explanation of how those numbers were arrived at, how a skilled artisan would select among them for a given compound, or how they related to the claimed unit dosage calculated to produce a therapeutic effect in a (Slip op. at 15.)
Lab doses were toxic in humans. Testimony from Wyeth’s own experts and the inventors confirmed AstraZeneca’s unrebutted evidence that the doses at which at least two of the three described drugs (HKI-272 and EKB-569) appeared to work in the lab exceeded the maximum dose a human patient could safely tolerate. (Slip op. at 15-16.) In other words, the “effective” in vitro dose indicated by the disclosure would translate to a dose that would be dangerous in a person. For example, one of the inventors confirmed that “[t]he concentrations in the test tube are higher than those you can give to patients.” (Id. at 16.) The court acknowledged that the mere presence of nonworking examples in the specification will not always defeat a patent, citing Atlas Powder Co. v. E.I. du Pont De Nemours & Co., 750 F.2d 1569, 1576–77 (Fed. Cir. 1984). (Id. at 16.) Here, however, the nonfunctionality of several of the drug dosages described in the specification played a direct evidentiary role, especially in the absence of any affirmative examples of doses that did work in human patients. The Federal Circuit concluded that the disclosed doses could not serve as a starting point for patient treatment across the claimed category. (Id.)
Specification acknowledges its own gaps. Rather than providing a methodology for calculating a unit dosage, the specification stated that “[t]he skilled artisan is aware of the effective dose for each patient” and precise amounts “depend on the judgment of the practitioner and are peculiar to each individual.” (Slip op. at 17.) The Federal Circuit held that relying on skilled artisan knowledge cannot substitute for the obligation to supply the novel aspects of the claimed invention in the specification. (Id.)

The Federal Circuit emphasized that, in a complex and unpredictable field, the specification must provide greater guidance. (Slip op. at 17.) Because the specification identified only a starting point for further research, leaving the skilled artisan to conduct an iterative, trial-and-error process to identify operative dosing regimens, practicing the claims would require undue experimentation, and therefore the claims were not enabled. (Id. at 17-18.)

Importantly for life sciences innovators, the Federal Circuit acknowledged the generally accepted practice of claiming a method of treatment with a range of doses without providing clinical data from large human trials. (Slip op. at 19.) But it distinguished this general trend from Wyeth’s patents based on the specific facts relevant to those patents. For the court, the problem was not the absence of clinical data per se, but instead the specification’s failure to disclose any actual dosages suitable for patient administration, combined with unrebutted evidence that at least two of the three disclosed compounds could not be administered to patients because all therapeutically effective dosage levels across the disclosed ranges would exceed the maximum tolerated dose in humans. (Id. at 15-16, 19.)

The outcome in Wyeth provides a noteworthy contrast to the Federal Circuit’s recent opinion in Teva Pharmaceuticals International GmbH v. Eli Lilly & Co., No. 24-1094 (Fed. Cir. Apr. 16, 2026), which also concerned method claims in which a class of compounds were defined by their function – a class of humanized antibodies (humanized anti-CGRP antagonist antibodies) to treat headache. Unlike the Wyeth case, in Teva the Federal Circuit held that the claimed antibody class was well known in the prior art, the specification disclosed that all antibodies would work for the claimed purpose (which was unrebutted at trial), and the point of novelty was not the compounds themselves but the application of those compounds to treating headache. (Teva Pharms., No. 24-1094, at 13, 22–23.)

The different outcome in Wyeth seems to have turned on the inventive concept captured by the claims and the state of the specification: The claims at issue in Teva were directed to a novel therapeutic use (treating headache) with a known class of compounds, and the specification directly addressed the novel aspect of the invention (the therapeutic use). In contrast, the claims at issue in Wyeth were directed to a dosing regimen, and the specification left the novel and critical element (a dosing regimen capable of producing a therapeutic effect in a patient) insufficiently addressed, with most of the disclosed compounds proving inoperative at some of the very doses the patents claimed.

Practical implications

For a variety of reasons, life sciences companies need to file patent applications covering methods of treatment before clinical data is available, including publications on clinical trial registries, scientific presentations and fundraising. Companies in this situation should consider two practical points following Wyeth:

Be aware of how claim language and the specification can introduce unintended functional limitations. In Wyeth, claim scope created an unexpected enablement problem through the construction of a single term. The term “unit dosage” appeared in every asserted claim, and the district court’s construction –uncontested on appeal – required “a therapeutic effect.” (Slip op. at 5, 10.)
Avoid unnecessary language about uncertainty in the specification. In Wyeth, the specification’s own statements (“[p]recise amounts of active ingredient … depend on the judgment of the practitioner and are peculiar to each individual” and “[t]he skilled artisan is aware of the effective dose for each patient”) were used by the court as evidence that determining the claimed unit dosage was a complex and individualized task that the specification failed to address. (Slip op. at 17.) Patent drafters should consider avoiding unnecessary language overemphasizing dosing unpredictability or patient-by-patient variability because it can become evidence against enablement when broad method claims are later asserted.

However, life sciences companies should also exercise caution in attempting to enable method-of-treatment applications with speculative and excessive disclosure around doses and dosing regimens. The safe and effective dosing regimen for a particular drug and indication will be discovered in clinical trials, which may occur several years after initial in vitro data. Filing applications for dosing claims contemporaneously with such clinical results can lead to additional – and often more defensible – patents with later expiration dates, potentially adding valuable exclusivity to the commercial product.

Conclusion

Wyeth v. AstraZeneca reinforces the principle the Supreme Court established in Amgen v. Sanofi: Where a claim limitation requires dosage form and/or patient-level efficacy, the specification must provide the guidance necessary to achieve that outcome across the full scope of the claimed compounds. In vitro data, broad projected dose ranges and reliance on skilled artisan knowledge may not suffice.

UK OFSI Fines Tech Company £1M for Sanctions Breach

Tue, 14 Jul 2026 13:58:42 Z

On 26 May 2026, the UK’s Office of Financial Sanctions Implementation (OFSI) imposed a civil monetary penalty of £1,000,920.59 on Sabre Global Technologies Limited (SGTL), a UK-registered technology company, for breaches of UK financial sanctions.

This is the UK’s largest sanctions breach penalty since Standard Chartered was fined £20 million in 2020, and the first penalty that deals with sanctions circumvention under OFSI’s new settlement framework.

One week later, HMRC publicly named Petrofac Facilities Management Limited (PFML), following a £569,157 compound settlement, for breaches of the Russia sanctions regime, although no further details were released. Together, these cases indicate an increasingly assertive UK sanctions enforcement landscape, with penalties appearing to be on an upward trajectory.

The OFSI decision regarding SGTL confirms that software, data services and digital tools constitute “economic resources” under UK sanctions law which must not be made available to designated persons.

The decision also sets out detailed expectations on screening, escalation, self-reporting and senior accountability – and should be read as required reading for sanctions professionals across the technology sector.

Background

SGTL operates a global distribution system (GDS), providing entities within the travel industry with access to travel content from a broad range of travel suppliers. SGTL receives a booking fee from travel suppliers in exchange for distribution of their content via the GDS.

On 14 September 2007, SGTL entered into a contract with Ural Airlines, granting the airline access to its GDS and other related services. The agreement was extended multiple times, with the most recent contract update on 1 December 2021 and an amendment agreement on 1 September 2022. The contract was due to expire on 30 November 2022, though access to the GDS in fact continued until 6 December 2022. This contractual framework is a significant element of the case, as OFSI found that SGTL’s invoicing of Ural Airlines and instruction that funds be paid into its account constituted making funds available for the benefit of a designated person.

On 19 May 2022, Ural Airlines was designated under the Russia (Sanctions) (EU Exit) Regulations 2019 (Russia Regulations). SGTL’s legal representatives notified SGTL of the designation on the same day.

Notwithstanding the designation, SGTL continued to provide services to and receive funds from Ural Airlines for a period thereafter. SGTL was repeatedly notified by its UK bank of sanctions concerns in relation to payments received from Ural Airlines. The bank flagged and held payments on 6 June, 27 June, and 5 July 2022, and SGTL’s US bank subsequently flagged a further payment in September 2022. Despite these repeated red flags, SGTL continued to explore alternative payment routes, including testing whether payments from Ural Airlines could be received via its US bank account. SGTL ultimately decided not to renew the contract when it expired on 30 November 2022.

OFSI identified three breaches of the Russia Regulations:

Making funds available for the benefit of a designated person.
Making economic resources available to a designated person.
Circumventing the prohibitions.

The total value of the breaches was assessed as £2,634,001.54 ($3,222,379.89), covering funds and economic resources in breach of regulations 13, 14 and 19 of the Russia Regulations.

Why this decision matters

1. Invoicing, instructing and receiving payment from a sanctioned party can constitute ‘making funds available’

SGTL’s contract with Ural Airlines created a debt obligation. OFSI found that by invoicing Ural Airlines and instructing that funds be paid into its bank account, SGTL made funds available to its bank for the benefit of a designated person.

OFSI found that Ural Airlines received a significant financial benefit because the payments served to discharge its financial obligations to SGTL.

This is an interesting, and perhaps surprising, interpretation of the asset freeze restrictions, since OFSI’s position is that making available funds to a third party for the benefit of the designated person can occur even though the payment is made by the designated person and relates to a debt addressed to the designated person. Unfortunately, no further detail is provided in the penalty notice of why OFSI has taken this approach or how it will seek to interpret this in other situations.

2. Digital services and software as a service (SaaS) products are within scope of ‘economic resources’

OFSI considered that, by enabling Ural Airlines to access and use the GDS platform, SGTL made an economic resource available. Platform operators should take note that providing access to a digital platform or service may itself give rise to sanctions risk.

OFSI explicitly confirms that intangible services – including software platforms, data services and digital tools – can constitute an “economic resource” for the purposes of UK sanctions regulations.

Under the UK sanctions framework, economic resources are defined broadly as assets of every kind, whether tangible or intangible, movable or immovable, which are not funds but which can be used to obtain funds, goods or services. OFSI confirmed that a service which enables a designated person or entity to generate revenue, maintain operations or otherwise obtain an economic advantage may amount to making an economic resource available – regardless of whether that service is intangible or provided entirely digitally.

The decision is a useful reminder for technology companies, including SaaS providers, that deliver software platforms, data feeds, API access or other digital services to customers that the provision of their services can fall squarely within sanctions restrictions.

3. Circumvention will be treated as aggravating

During July and August 2022, SGTL explored alternative routes to receive funds. It engaged with its US bank to scope receiving payments from Ural Airlines into its US account in light of sanctions issues with its UK account. Internal emails show that, if a test payment succeeded, SGTL expected full outstanding GDS fees to be paid via this route.

On 21 September 2022, Ural Airlines sent a £176.48 ($200) test payment to SGTL’s US account.

OFSI’s decision confirms that attempts to restructure or reroute payment pathways to avoid the effect of UK sanctions – including by staging payments through third countries – will be treated as circumvention and may constitute a breach in their own right. Such conduct will be treated as an aggravating factor and will significantly increase the seriousness of any enforcement outcome.

4. UK-specific policies and procedures are required

SGTL’s sanctions documentation at the time focused on general procedures and US requirements, with limited coverage of UK-specific regimes. In addition, its third-party screening tool did not automatically flag the relevant designation to the compliance team, contributing to a delay in identifying and addressing the issue.

OFSI has emphasised that sanctions compliance frameworks must be specifically tailored to the UK sanctions regime. Thus, reliance on groupwide policies designed primarily for other jurisdictions (such as the US Office of Foreign Assets Control regime or EU sanctions) is not sufficient. For a comparison of US and UK economic sanctions authorities, see the joint OFAC-OFSI comparative overview published on 23 June 2026, produced under the OFAC-OFSI Enhanced Partnership established in October 2022, which outlines key similarities and differences between the regimes.

The SGTL penalty notice specifies that firms must ensure that:

Policies and procedures are current and address UK-specific requirements.
Sanctions screening systems are tested and verified to be working as intended.
There are robust escalation protocols for red flags, including blocked payments or notifications of concerns from banking partners.
Clear senior accountability exists at board and executive level for sanctions compliance.

5. Early and comprehensive self-reporting is essential

SGTL voluntarily self-reported the breach without prompting but provided only limited detail and continued servicing a designated person. It later cooperated fully with OFSI when prompted, and overall, this factor was treated as neutral (neither mitigating nor aggravating) by the OFSI when determining how seriously to view this case.

OFSI has reiterated the importance of prompt, comprehensive and detailed self-reporting of suspected breaches, as soon as reasonably practicable. Delays and incomplete submissions are likely to undermine any mitigation argument. In practice:

Firms should contact OFSI early, even where the full picture is not yet clear.
Where full disclosure is not immediately possible, firms should make an early partial disclosure, clearly stating that a further and fuller disclosure will follow.
Firms should provide a timeline for full disclosure and keep OFSI updated if that timeline is likely to slip.
Firms should not allow the process of taking legal advice – while important – to cause unnecessary delay in making initial contact with OFSI.

Key compliance actions

In light of this decision, we recommend that technology and digital services companies take the following steps:

Audit your customer base and product suite. Regularly review whether any existing or prospective customers are designated persons or entities under UK financial sanctions.

Review and update your UK sanctions compliance framework. Ensure your policies, procedures and training materials are specifically tailored to the UK sanctions regime.

Establish clear escalation protocols. Ensure that there are well-understood, documented escalation routes for any potential sanctions, and that these protocols survive personnel changes.

Assess your self-reporting readiness. Ensure your compliance and legal teams have a clear plan for engaging with OFSI promptly in the event of a suspected breach.

Take legal advice where uncertainty exists.

HHS and Congress Push to Streamline and Onshore Clinical Trials

Mon, 13 Jul 2026 14:40:48 Z

Conducting first-in-human clinical trials in the United States is often associated with significant cost, complexity and delay. There is a growing consensus among policymakers that the current US requirements are unnecessarily rigid and burdensome for early-stage clinical development. Companies often view foreign jurisdictions, such as Australia and China, as offering faster, more flexible pathways for initiating clinical trials. On June 22, 2026, the US Department of Health and Human Services (HHS) announced a coordinated, departmentwide effort – Operation TrialBlazer – to reverse that trend and restore American leadership in clinical research. As part of this initiative, the Food and Drug Administration (FDA) and other HHS agencies, including the HHS Office of Inspector General (OIG), are advancing reforms aimed at streamlining the clinical trial process, eliminating inefficiencies, increasing participation and improving transparency for biopharmaceutical companies and other stakeholders. Momentum for streamlining and improving the clinical trial process extends beyond the executive branch, with Congress also actively considering proposals to accelerate early-phase development, reduce administrative burdens and encourage sponsors to keep early-stage clinical research in the US. Companies, particularly small and mid-size biopharma companies, should closely monitor these initiatives and leverage this momentum to engage with FDA, OIG and other HHS agencies to help shape reform efforts.

Efforts to address a long-standing shift of early clinical research overseas

The migration of clinical research from the US to foreign countries is not a recent phenomenon. For example, in 2010, HHS reported that more than half of all clinical trial sites were located outside the US, and that 80% of marketing applications submitted to FDA contained data from foreign studies. In April 2026, then-FDA Commissioner Martin Makary noted that China had four times more Phase 1 trial initiations than the US since at least 2024, and that the average time between a pre-investigational new drug (IND) request and IND go-ahead is approximately 380 days in the US versus 220 days in China, with China having announced plans to reduce that timeline even further.

China is not the only country that has attracted early-stage research; Australia has also become a popular jurisdiction for initiating clinical trials. Australia’s appeal stems in part from its regulatory framework, which allows certain clinical trials to proceed using a streamlined notification process. These competitive pressures have not gone unnoticed. HHS agencies, including FDA and OIG, and Congress have begun taking concrete steps to reclaim the US’s position as the preeminent destination for early-phase clinical research.

FDA’s request for an expedited IND pathway

Before creation of Operation TrialBlazer, in an effort to reshore clinical trials, FDA had already asked Congress to create a risk-based expedited IND pathway for certain Phase 1 clinical trials. This pathway would serve as an alternative to the traditional IND process intended to reduce duplicative and time-consuming requirements that are not necessary to maintain safety and ethical standards. FDA recognizes that such a pathway is particularly important for smaller companies, which face proportionally greater barriers under the current framework. Those barriers that have contributed to the migration of preclinical and early Phase 1 research to jurisdictions like China and Australia. According to FDA’s request, the proposed pathway would be optional and risk-based and rely more heavily on existing preclinical evidence and validated alternative testing methods to accelerate initiation of US-based Phase 1 programs.

FDA RFI on expedited IND pilot program

Without waiting for Congress to act, FDA has also moved administratively to pilot a version of this approach. As part of Operation TrialBlazer, on June 24, FDA published a request for information (RFI) soliciting public comments on a proposed Expedited Investigational New Drug Pilot Program designed to shorten the time from drug identification to first-in-human Phase 1 clinical trials. The pilot would enlist a network of Qualified Research Institutions (QRIs), such as academic medical centers and contract research organizations (CROs), to partner with sponsors in developing and reviewing Phase 1 IND protocols. QRIs would provide advisory recommendations on the pharmacology/toxicology, clinical, and chemistry, manufacturing and controls (CMC) components of an IND submission, with the aim of improving submission quality and reducing the incidence of clinical holds. QRIs would also support parallel activities, such as Institutional Review Board (IRB) review and clinical trial site activation, while FDA retains full oversight and regulatory authority, including the ability to issue clinical holds, disqualify investigators and conduct inspections. The pilot also proposes a rolling IND submission process, which would allow sponsors to receive earlier and more frequent feedback from FDA. According to FDA, the pilot’s core objectives are to improve IND submission quality, reduce FDA review time, and accelerate the interval from nonclinical research to first-in-human study initiation. FDA is seeking input from sponsors, CROs, academic institutions, health networks/systems, IRBs, patient advocacy organizations, investors and other stakeholders on the pilot’s structure, scope and implementation.

Comments are due by July 22, 2026.

FDA AI initiatives

FDA has also been pursuing a related initiative that predated the June 22 HHS announcement. Nearly two months earlier, in late April 2026, FDA published an RFI on a proposed pilot program focusing on improving efficiency and decision-making quality within the existing Phase 1 trial framework. FDA sought input on how AI could support dose selection, safety monitoring, patient recruitment and go/no-go decisions while maintaining FDA’s existing scientific and regulatory standards. The fact that FDA subsequently launched a separate, more sweeping set of initiatives as part of the June 22 HHS announcement suggests the agency concluded that AI-enabled optimization of the current process, while valuable, is not sufficient on its own to close the competitiveness gap with countries like Australia and China. This gap is rooted in the regulatory process itself, which no amount of AI-driven efficiency within FDA’s existing framework can eliminate. The June 22 initiatives, by contrast, take aim at that structural gap directly. FDA received nearly 200 comments in response to the AI RFI, and the comment period closed on June 29, 2026.

OIG RFI on potential fraud and abuse barriers to clinical trial participation

As part of Operation TrialBlazer, OIG issued an RFI seeking public input “on whether any additions or modifications are needed to the safe harbor regulations under the Federal Anti-Kickback Statute [(AKS)] or the exceptions to the civil monetary penalty [(CMP)] provision prohibiting inducements to beneficiaries … for remuneration provided to individuals in connection with their participation in clinical trials.”¹

The inclusion of this RFI within HHS’s broader clinical trial reform framework reflects a recognition that fraud and abuse compliance uncertainty may itself be a barrier to advancing clinical research. To the extent such uncertainty exists and remains, it may undermine the administration’s broader goals of accelerating drug development, increasing participation in clinical research and expanding patient access to innovative therapies.

Clinical trial participation imposes real costs on patients, including transportation to and from trial sites, childcare, time away from work and other out-of-pocket burdens. Financial constraints may result in enrollment failure and participant dropout. These challenges are particularly acute in rare disease research, where enrollment difficulty is compounded by small patient populations. Further, as participants and/or trial sites may be, and often are, geographically dispersed, participants may need to travel substantial distances to reach a qualifying trial site. In such contexts, the ability to offer meaningful logistical and financial support to participants could be determinative of whether certain individuals are able to participate.

However, sponsors seeking to offer such support have faced uncertainty and persistent compliance questions. In the RFI, OIG notes that it has published 10 favorable advisory opinions over the past two decades permitting certain cost-sharing waivers or subsidization of certain federal healthcare program cost-sharing obligations for clinical trial participants in specific situations and circumstances, but that it has “not issued any advisory opinions or guidance relating to other remuneration provided to clinical trial participants, such as transportation costs, childcare costs, or stipends.”² In the absence of clear guidance, sponsors considering whether to offer such support face questions and uncertainty in seeking to assess whether a given arrangement may or may not be viewed as compliant. That uncertainty can have a chilling effect. As a result, sponsors potentially may either forego compensation programs entirely or limit them in ways that could contribute to or perpetuate enrollment challenges.

OIG’s new RFI is a step toward addressing these questions and the uncertainty that sponsors and other organizations currently face. OIG is seeking public input on a number of areas, including, among others:

Whether, and if so, how, clinical trial participation is meaningfully enhanced by providing appropriate remuneration to federal healthcare program enrollees.
Whether clinical trial sponsors, clinical trial sites or other organizations view the AKS and Beneficiary Inducements CMP as barriers to providing appropriate remuneration to clinical trial participants, and, if so, why.
The types and amounts, if applicable, of remuneration stakeholders may seek to provide to clinical trial participants to facilitate participation.
The fraud and abuse risks that may be associated with the offer and provision of such remuneration.
The types of arrangements necessary to provide such remuneration.
Safeguards that may be necessary or prudent to prevent fraud and abuse when clinical trial participants receive remuneration.

OIG states that it is seeking to identify ways in which it might modify or add new AKS regulatory safe harbors or new exceptions to the Beneficiary Inducements CMP’s regulatory definition of “remuneration” to address these considerations. Additionally, OIG seeks to identify other guidance it could publish or amend “to foster arrangements that facilitate clinical trial participation, while also protecting against harms caused by fraud and abuse.”³ The RFI also lists several specific questions for stakeholder input.⁴

Comments are due no later than 5:00 pm ET on August 24, 2026.

FDA draft guidance on substantial evidence of effectiveness

The June 22 HHS announcement also referenced a new FDA draft guidance titled, Demonstrating Substantial Evidence of Effectiveness for Human Drug and Biological Products. While this draft guidance addresses the evidentiary standard for drug approval broadly and not the IND process specifically, it is directly relevant to sponsors conducting early-phase trials in the US, as it signals FDA’s latest interpretation of the statutory standard for the data that will ultimately be required to support approval. This 2026 draft guidance revises a 2019 draft guidance and contains significant substantive updates reflecting FDA’s evolving views on topics such as externally controlled trials and Bayesian statistical analysis. More broadly, the 2026 draft guidance moves away from the rigid examples provided in the 2019 draft guidance toward a more comprehensive view of the overall development program, the broader context of the disease state, and the role of external and real-world evidence when assessing whether a sponsor has met the substantial evidence standard.

Perhaps the most notable example of this shift is the reorganization and reframing of the discussion around the number of clinical trials required to demonstrate effectiveness. While the 2019 draft guidance positioned two adequate and well-controlled clinical trials as the standard approach for demonstrating substantial evidence of effectiveness, the 2026 draft guidance reframes multiple clinical trials as one possible way that sponsors may meet this requirement depending on the needs of the drug development program. Likewise, the 2026 draft guidance expands the potential scenarios in which one adequate and well-controlled trial may be sufficient to meet the substantial evidence standard. Whereas the 2019 draft guidance organized regulatory flexibilities around three scenarios – life-threatening or severely debilitating diseases, rare diseases and situations where human efficacy trials are infeasible – the 2026 draft guidance does away with these distinct categories and instead states that the clinical context is critical to informing the approach to establishing substantial evidence of effectiveness. While regulatory flexibilities may still be warranted for a rare disease, those flexibilities may differ for a life-threatening rare disease with no current treatment options versus one that is less debilitating and/or has available treatment options.

Trial design is another area that received a significant update in the revised draft guidance. The 2026 draft guidance devotes considerable discussion to study designs, such as noninferiority studies and external controls, but expands upon the situations in which these designs can offer meaningful evidence of efficacy, consistent with FDA’s more flexible approach across the updated guidance. The guidance also notes that trial design elements, such as eligibility criteria, a control arm and supportive therapies that reflect standard of care, and a meaningful primary endpoint, should be selected to provide results that are relevant to patients and prescribers. FDA states that trial design is an area where the agency may exercise regulatory flexibility, including by relying on trial designs that generate less certainty regarding efficacy if warranted based upon a holistic view of clinical considerations.

One area where the 2019 and 2026 draft guidance overlap is in the categories of confirmatory evidence that may be considered to demonstrate substantial evidence of effectiveness. Specifically, FDA confirms that mechanistic evidence, natural history data and data from trials in a related disease or condition are examples of types of confirmatory evidence. With the 2026 draft guidance, FDA provides some additional confirmatory evidence considerations. For example, FDA cautions that natural history data used as confirmatory evidence should be separate from any data used as a control for a single and adequately controlled clinical trial. FDA also specifically addresses real-world data as a subset of natural history data that may be appropriate as confirmatory evidence in rare diseases or conditions, depending on considerations such as reliability and relevance of the data source and appropriateness of the study design and statistical methods for studies that leverage this data.

FDA is also accepting comments on the newly released Substantial Evidence of Effectiveness draft guidance. This comment period is an important opportunity for any company seeking drug or biologic approval and is especially relevant for sponsors developing treatments for rare, serious or life-threatening conditions, or those who may be planning to rely on single trial or novel trial designs to support approval.

Comments are due by September 22, 2026.

Bipartisan proposals on Capitol Hill

Along with these FDA and other HHS initiatives, Congress is developing its own proposals seeking to align with and compliment FDA’s recent actions. In May 2026, Rep. Jake Auchincloss (D-MA), a member of the House Energy and Commerce Committee, released a legislative discussion draft of the Cures in Care Initiative, which outlines a broad plan to modernize the US clinical trial system. The draft proposes to revamp FDA oversight of first-in-human and Phase 1 studies, including modernizing IRBs and streamlining Phase 1 processes. It also points to Australia’s notification process as a model and calls on FDA to pilot a third-party oversight framework, termed an “IND alternative pathway,” and issue guidance for pre-certifying third-party organizations.

Similarly, in a February 2026 roadmap of various FDA reforms, Sen. Bill Cassidy (R-LA), chair of the Senate Committee on Health, Education, Labor, and Pensions, proposed that the agency launch a pilot program testing expedited clearance of low-risk Phase 1 studies, similar to the regulatory framework used in Australia.

The House Appropriations Committee made a similar recommendation in a report accompanying its markup of the FDA Fiscal Year 2027 appropriations bill. The committee directed FDA to revise its IND processes and data requirements for initial human trials to streamline administrative requirements, reduce filing burdens and tailor the process and requirements to make them risk and trial phase appropriate. The committee also encouraged FDA to develop and implement a pilot program to test an Australian-style clinical trial notification system in the US.

While committee report directives and draft legislative language do not carry the force of law, they are powerful policy signals from Congress to FDA. These bipartisan, bicameral signals bear watching for future congressional action as the appropriations bills and Prescription Drug User Fee Act (PDUFA) reauthorization work their way through the legislative process.

Opportunities to shape reform efforts

These developments signal a rapidly growing momentum within the government to modernize and accelerate the clinical trial framework in the US. The FDA and OIG RFIs and FDA draft guidance, in particular, represent concrete and time-sensitive opportunities for sponsors and other stakeholders to provide input that can help shape the contours of future US clinical trial reform. For sponsors, especially small and mid-size biopharma companies, these comment periods present important vehicles for communicating ideas and perspectives that could meaningfully accelerate development timelines.

Cooley’s life sciences and healthcare regulatory team will continue to closely monitor these developments and their implications for companies across the clinical and commercial landscape. For any questions on how these proposals might affect your development timelines, how to engage with FDA, or how to submit comments in response to the RFIs or FDA’s guidance documents, please contact one of the lawyers listed below.

Cooley senior regulatory analyst Kelly Marco also contributed to this alert.

Notes

Medicare and State Health Care Programs: Fraud and Abuse; Request for Information Regarding the Federal Anti-Kickback Statute and Beneficiary Inducements CMP, 91 Fed. Reg. 37902 (June 24, 2026).
Id. at 37903.
Id.
Id. at 37904 – 37905.

Illinois Mandates Independent AI Audits: What Developers Should Know

Tue, 07 Jul 2026 19:40:28 Z

I. Illinois SB 315 signals next phase of AI regulation – from transparency to verification

Over the last several years, lawmakers in the United States and around the world have increasingly focused on regulating AI systems through transparency, documentation and internal risk management requirements.

Recent frameworks, such as California’s Transparency in Frontier Artificial Intelligence Act (TFAIA), New York’s amended Responsible AI Safety and Education (RAISE) Act and portions of the European Union’s AI Act, generally require developers to assess and disclose how they identify, evaluate and manage AI-related risks. Common obligations include transparency reports, system/model cards, risk assessments, governance frameworks and incident reporting.

Illinois’ recently enacted Artificial Intelligence Safety Measures Act (AISMA) builds on these existing frameworks by introducing a significant new requirement: independent verification. Rather than relying solely on developer-created documentation and self-reported compliance measures, AISMA requires covered large frontier model developers to undergo audits by independent third parties. This move reflects a broader shift in regulatory efforts from requiring companies to document how they manage AI risk to requiring them to demonstrate that those processes are actually operating as intended. This is a significant change from self-reported compliance, mirroring a trend in third-party audit requirements in content regimes like the EU’s Digital Services Act and South Carolina’s Age-Appropriate Code Design.

AISMA may represent the next phase of AI regulation – one focused not only on disclosure, but also on third-party verification.

II. Key elements of the law

Who does Illinois’ law apply to?

Developers responsible for the most advanced foundation models.

The law regulates “frontier models” (models trained using more than 10²⁶ floating-point or integer operations) and imposes obligations on frontier developers broadly. However, its most significant requirements fall on “large frontier developers” – those with annual gross revenues exceeding $500 million.

When does it go into effect?

AISMA's effective date is January 1, 2027. However, certain provisions are phased in the following year, including the Frontier AI Framework (January 1, 2028) and the independent audit requirement (January 1, 2028, or 90 days after first qualifying as a large frontier developer, whichever is later).

What does the law require?

Mandatory framework: Large frontier developers must establish, implement, comply with and publicly publish a Frontier AI Framework that:

Describes how the developer incorporates national and international standards and industry best practices.
Defines and assesses catastrophic risk thresholds.
Applies mitigation measures to address potential catastrophic risks.
Reviews risk assessments and mitigations before deployment and significant internal use.
Uses third-party evaluators.
Updates and maintains its framework over time.
Protects unreleased model weights through cybersecurity controls.
Identifies and responds to critical safety incidents.
Implements internal governance processes.
Assesses catastrophic risks arising from internal use of frontier models, including risks associated with models circumventing oversight mechanisms.

Transparency report: Before deploying a new frontier model, or a substantially modified version of an existing model, a frontier developer must publish, among other things, the model’s release date, supported languages, output modalities, intended uses, applicable use restrictions and contact information for the developer.

Large frontier developers must also disclose summaries of catastrophic risk assessments, assessment results, involvement of third-party evaluators and other measures taken to comply with their Frontier AI Framework.

Developers may satisfy many of these disclosure requirements through existing system cards or model cards.

Ongoing reporting to regulators: Large frontier developers must provide the Illinois Emergency Management Agency and Office of Homeland Security (Agency) every three months (or on another reasonable schedule) with summaries of assessments regarding catastrophic risks arising from internal use of frontier models.

In addition, frontier developers must report any “critical safety incident” to the Agency and the Illinois attorney general within 72 hours after learning facts sufficient to establish a reasonable belief that such an incident has occurred, or within 24 hours to an appropriate authority where the incident “poses an imminent risk of death or serious physical injury.”

Independent audits: Developers must annually retain an independent third party to audit compliance with AISMA, which:

Evaluates whether the developer has substantially complied with AISMA.
Assesses the developer’s internal controls and governance processes.
Identifies any material deviations from statutory requirements.
Provides recommendations for improvement where appropriate.

Auditors must possess appropriate expertise, operate free from specified conflicts of interest and conduct their reviews in accordance with generally accepted auditing standards and best practices.

Within 30 days of receiving the report, the developer must publish a high-level summary of the audit findings, publish a redacted version of the audit report and provide the audit report to the Agency and the Illinois attorney general.

III. Illinois compared with California and New York

What do all three state laws have in common?

Illinois joins a growing number of states seeking to regulate the development and deployment of frontier AI models. Before Illinois enacted AISMA, both California and New York had enacted regulatory frameworks for frontier model developers. Although the details differ, California’s TFAIA and New York’s RAISE Act impose a common set of obligations, including AI framework requirements, transparency and reporting obligations, catastrophic risk assessments, critical safety incident reporting and enforcement by the state attorney general. Together, these laws reflect a broader trend toward requiring frontier model developers to document and disclose how they identify, assess and manage catastrophic AI risks.

Like California’s law, AISMA includes whistleblower protections and internal reporting mechanisms intended to surface AI safety concerns before they develop into critical incidents.

Like New York’s law, AISMA requires large frontier developers to make registration-style disclosures, identify responsible contacts and pay assessments supporting administration of the regulatory regime.

What ultimately sets Illinois’ law apart?

Against this shared backdrop, what distinguishes Illinois from both states is its audit requirement. Neither California’s TFAIA nor New York’s RAISE Act require covered developers to undergo independent audits of their compliance programs. Illinois moves beyond transparency toward independent auditing. The statute reflects the view that AI governance programs should not only be self-reported, but also undergo external verification.

IV. AI audits in the global context

Although Illinois is the first US state to require annual independent audits of frontier model developers, the concept of independent review and ongoing audits is not unique to AISMA. Similar themes are increasingly appearing in AI regulatory frameworks around the world. For example:

EU AI Act: Providers of certain high-risk AI systems must satisfy conformity assessment requirements and maintain technical documentation, risk management procedures and post-market monitoring processes – reflecting a similar push for documented and verifiable compliance measures.
EU Digital Services Act (DSA): Very large online platforms and search engines must conduct systemic risk assessments and undergo independent audits. Though not AI-specific, the DSA reflects the same regulatory shift toward requiring organizations to demonstrate governance effectiveness through independent, external review.
Vietnam’s AI law: Vietnam’s AI law takes a risk-based framework tied to particular AI systems based on their risk classification. High-risk AI systems must undergo conformity assessments, audits and independent testing before deployment and following significant changes. Medium- and low-risk systems are subject to key obligations, such as transparency and incident reporting. Both the Illinois and Vietnam frameworks reflect a similar underlying interest in independent review of AI systems.

Taken together, AISMA’s audit requirement may be less of an outlier than it initially appears. Instead, it represents a growing trend toward companies not only maintaining governance programs, but also programmatically demonstrating that those programs are operating effectively.

V. How AI audits differ from audits clients already know – and why that matters

Most companies are already familiar with financial, cybersecurity and privacy audits. While there are some common elements, AI audits are different in several important ways.

Unlike traditional compliance exercises, AI audits require organizations to evaluate and substantiate complex judgments regarding:

Evaluating and substantiating judgments about model safety and catastrophic risks.
Assessing internal governance processes and deployment decisions.
Demonstrating and verifying the actual effectiveness of risk mitigation measures.

This expanded evaluation scope creates both strategic advantages and potential legal vulnerabilities for frontier developers.

Opportunities include:

Independent audits can help organizations concretely demonstrate compliance with evolving AI governance and regulatory obligations – mitigating the risk of regulatory inquiries.
External verification increases confidence in model safety and security among regulators, customers, investors and the public.
Rigorous audits can identify weaknesses in internal risk management programs before they escalate into enforcement or litigation issues.

Risks include:

Audit reports may inadvertently become roadmaps for regulators by exposing governance deficiencies, unresolved risks or gaps between documented policies and actual practices.
Although these audits can improve governance, the findings may also become relevant evidence in regulatory investigations, enforcement actions or litigation.

VI. Practical steps companies should consider now

Although AISMA’s audit requirement does not take effect until January 1, 2028, or 90 days after an organization first qualifies as a large frontier developer, companies should begin their preparations well before the first audit cycle arrives.

Frontier labs looking to prepare for the audit should consider:

Assessing whether current or anticipated AI development activities could trigger audit requirements.
Building and operationalizing audit-ready governance structures, which can take a long time to design and launch.
Reviewing documentation practices with a view to maintaining consistent model evaluations, safety testing, risk assessments and incident response records.
Reviewing the role of legal privilege in audit processes.

While independent third-party audits represent a new frontier for AI regulation, navigating first-of-their-kind statutory audit frameworks is not new territory for Cooley. Combining market-leading AI legal acumen with proven, practical experience guiding clients through novel external audit regimes around the globe, Cooley serves as a trusted strategic advisor to technology companies on their most complex digital regulation challenges.

Navigating the SFC’s Operational Rulebook on Listed Closed-Ended Alternative Asset Funds

Tue, 07 Jul 2026 14:27:14 Z

On June 30, 2026, the Securities and Futures Commission (SFC) published Frequently Asked Questions on Listed Closed-ended Alternative Asset Funds (FAQs), accompanied by the Takeovers Executive’s Practice Note 28 (PN 28). Together, these instruments signal a shift of regulatory focus from the gating criteria of the February 2025 Circular – which established the baseline eligibility framework for listed closed-ended alternative asset funds (LAFs) – to the day-to-day operational requirements that govern LAFs after listing. For alternative asset managers, accessing Hong Kong’s retail capital markets via an LAF entails public company governance obligations, robust investor protection safeguards and exit rights enforceable by investors.

This alert provides a practical operational roadmap for alternative asset managers, cross-referencing the Code on Unit Trusts and Mutual Funds (UT Code), the Main Board Listing Rules (MBLRs), the Codes on Takeovers and Mergers and Share Buy-backs (Codes) and the Overarching Principles (OAP).

1. Structural thresholds

1.1 Segregation of liquidity profiles

The SFC enforces a strict alignment of liquidity profiles within umbrella entities. To prevent systemic cross-contamination, the SFC prohibits comingling LAFs with open-ended unlisted funds or conventional exchange-traded funds (ETFs) under a single umbrella. Open-ended structures require liquid portfolios to meet periodic redemptions, whereas LAFs warehouse private, illiquid alternative assets.

However, multi-strategy managers can establish multiple LAFs under a single, dedicated LAF umbrella, provided all sub-funds are closed-ended (e.g., separate sub-funds for private equity buyouts, private credit and infrastructure debt). This provides commercial economies of scale by consolidating establishment costs and regulatory filings on the Stock Exchange of Hong Kong (SEHK), subject to a case-by-case demonstration of robust asset and liability ring-fencing.

1.2 Master-feeder integration

International asset managers can deploy master-feeder architectures to channel Asian retail and institutional capital into established offshore master funds (e.g., in the Cayman Islands, Delaware or Luxembourg), enabling fund managers to list a Hong Kong feeder into an existing flagship strategy.

The master fund must be acceptable to the SFC. Principles and rules under the UT Code and the Circular on streamlined requirements for eligible exchange-traded funds adopting a master-feeder structure will generally be applicable to the feeder fund structure.
The listed Hong Kong feeder fund must mathematically align its investment restrictions, borrowing limits and valuation methodologies with the SFC retail product standards.
Managers must ensure feeder investors receive proportionate voting and economic rights equivalent to direct master fund investors, mitigating structural subordination.

1.3 Capital deployment window

Unlike institutional “blind pools” with multi-year capital calls, LAFs raise capital upfront via an initial public offering (IPO). To mitigate early-stage uninvested capital drag, the SFC permits an operational ramp-up period:

The investment period to build out the portfolio must generally not exceed one year from the IPO.
Uninvested capital during this 12-month window may be held in cash, cash equivalents or highly liquid money market instruments.
Sponsors must explicitly disclose the deployment timeline and interim cash-management strategy in offering documents (pre-listing assets must be disclosed as well), balancing rapid deployment against their fiduciary duty of rigorous due diligence under OAP General Principle 6 (diligence).

2. The governance mandate

Because LAFs are listed and available to retail investors, the SFC mandates a governance architecture that mirrors Chapter 3 of the MBLRs. These provisions must be hardwired into the LAF’s constitutive documents (trust deed, articles of incorporation or limited partnership agreement).

2.1 Board composition and independent oversight

The SFC requires independent oversight to police subjective valuations of illiquid assets and connected transactions. Constitutive documents must stipulate that at least one-third of the board (with an absolute minimum of three) are independent nonexecutive directors (INEDs). The structural application depends on the legal form:

Corporate LAFs: The requirement applies directly at the fund board level.
Noncorporate LAFs (e.g., unit trusts): The requirement is pushed upward to the board of the management company. This requires global managers to reconstitute the boards of their private Hong Kong management subsidiaries to include at least three INEDs.
Audit committee: An audit committee matching MBLRs standards must be established at the fund level (corporate) or management company level (unit trust) to scrutinize financial reporting, risk management and Level 3 asset valuations.

2.2 Enhanced unitholder rights

Departing from manager-friendly offshore private equity terms, the FAQs empower retail unitholders by enhancing minority control:

Requisition of meetings: Minority holders with a maximum threshold of 10% of voting rights can convene an extraordinary general meeting (EGM) and add resolutions.
Removal of management company: Can be achieved via an ordinary resolution. Crucially, the manager and its associates can vote their own units and count toward the quorum, allowing sponsors with significant co-investment stakes to defend against hostile removals.
Replacement manager and auditor: Appointing a replacement manager requires SFC’s prior approval and an ordinary unitholder resolution. Removing an auditor also requires an ordinary resolution, preventing managers from unilaterally dismissing auditors over valuation disputes.
Proxy mechanics: Constitutive documents must expressly entitle the Hong Kong Securities Clearing Company to appoint proxies, ensuring beneficial owners holding units through the Central Clearing and Settlement System can vote.

2.3 Contractual replication of SFO Part XV disclosures

To maintain market transparency regarding concentrated ownership, LAFs must replicate the substantial shareholder disclosure regime. For corporate LAFs, Part XV of the Securities and Futures Ordinance (SFO) applies statutorily. For noncorporate unit trusts, the trust deed must contractually replicate Part XV, forcing unitholders crossing the 5% ownership threshold to notify the manager and the SEHK. This identifies potential concert parties and alerts the market to hostile takeover threats.

3. Takeovers, mergers and application of Practice Note 28

To prevent regulatory arbitrage stemming from the fact that unit trusts and partnerships fall outside the strict statutory definition of a “company” under the Codes, the SFC mandates that constitutive documents for all LAFs must explicitly bind the fund, its managers and its investors to the Codes.

3.1 The REIT analogy under PN 28

PN 28 establishes that because LAFs share governance and yield-focused profiles with real estate investment trusts (REITs), the Takeovers Executive will treat them equivalently:

The 30% mandatory general offer (MGO) trigger: If an investor or concert party accumulates 30% or more of an LAF’s voting rights, they must launch a mandatory general offer to all unitholders at the highest price paid in the preceding six months.
Concert party aggregation: The Takeovers Executive will scrutinize relationships between parallel funds managed by the same sponsor to determine if their holdings must be aggregated against the 30% threshold.
Frustrating actions: Under Rule 4 of the Codes, once a bona fide offer is communicated, the management company is strictly prohibited from taking frustrating actions (e.g., issuing units or selling material assets) without unitholder approval.

This framework protects retail investors from creeping takeovers while restricting activist hedge funds from aggressively buying out discounts to net asset value (NAV) without triggering a public offer.

4. Share buyback mechanics

Closed-ended alternative funds routinely trade at a discount to NAV due to the illiquidity premium of their underlying assets. Share buybacks are indispensable tools to support secondary market prices, and the FAQs integrate the UT Code requirements with MBLRs Rule 10.06.

4.1 On-market versus off-market execution

On-market execution: Independent unitholders may grant the management company a specific approval or general mandate by ordinary resolution, permitting on-market buybacks up to a cap of 10% of total issued units/shares (excluding treasury shares) per financial year, enabling tactical interventions when the NAV discount widens.
Off-market execution: These require specific unitholder approval by independent holders. Where the buyback targets specific holder(s), approval must be by extraordinary resolution; where the buyback is structured as a general offer to all holders, approval may be by ordinary resolution. Both mechanisms mitigate the risk of related-party bailouts.

4.2 The dual-cap pricing mechanism

To safeguard fund assets and protect nonselling investors, repurchases under MBLRs 10.06 are bound by a strict dual-cap pricing mechanism. The purchase price cannot exceed the lower of:

A 5% premium over the average closing price of the units for the five preceding trading days on the SEHK.
The most recently published NAV per unit.

4.3 Pricing limits and manager duties

If an LAF trades at a 30% discount to NAV, the 5% premium cap means the manager executes the buyback at a deep discount to actual asset value. Buybacks at such prices are generally expected to be accretive to the NAV of remaining long-term holders.

Managers must execute a rigorous fiduciary assessment prior to any buyback, ensuring that the intervention will not impair working capital, breach the 30% borrowing limit or force a fire sale of illiquid assets.

5. Pre-listing asset injections, valuations and connected transactions

Valuing private equity, private credit or unlisted infrastructure relies heavily on subjective, Level 3 discounted cash flow models. The FAQs impose precautions against valuation conflicts.

5.1 Pre-listing asset injections and due diligence

When a sponsor seeds an LAF with assets transferred from its proprietary balance sheet, the valuation must be transparently disclosed in the offering documents and included in the audited financial statements.

If the listing agent assumes the dual role of sponsor, it is legally accountable for conducting independent due diligence on these underlying valuations.
The management company must establish and document valuation policies and processes, which should be subject to the oversight of the audit committee of the LAF.

5.2 Connected transactions (MBLRs Chapter 14A)

Asset transactions between an LAF and its management company, investment delegates or connected persons trigger compliance with the UT Code and the Fund Manager Code of Conduct, including the arm’s length and best interests requirements under 10.11 of the UT Code. Beyond OAP General Principle 4, which mandates that providers avoid conflicts of interest, the SFC may also, on a case-by-case basis with reference to MBLRs Chapter 14A, impose additional requirements tailored to the specific transaction. By way of illustration, such additional requirements may include:

Formal review and approval by the INEDs.
A detailed shareholder circular and/or an independent financial adviser’s fairness opinion.
Affirmative approval from independent unitholders at a general meeting; where applicable, the connected sponsor may be required to abstain from voting.

5.3 Co-investment and allocation policies

Where managers concurrently run parallel commingled funds or separately managed accounts, they must implement documented allocation measures. The LAF’s offering documents must outline the precise methodology used to distribute limited capacity private market opportunities (e.g., pro rata based on uncalled capital). Strict adherence to this policy must be disclosed annually in the fund’s audited report to ensure retail vehicles are not systematically disadvantaged in favor of institutional offshore flagship funds.

6. Investor exit rights and winding-up mechanics

A structural vulnerability of listed closed-ended funds is the NAV discount trap: When secondary market prices trade at a sustained and severe discount to underlying asset value, investors lacking a direct redemption mechanism are effectively locked in. The experience of an earlier-generation-listed, closed-ended vehicle in Hong Kong demonstrated this vulnerability. Where a fund held cross-border assets subject to foreign exchange controls or regulatory approval requirements, investor exit was further constrained because the orderly repatriation of underlying assets could not be guaranteed. The absence of a functioning market maker compounded the discount, and investors had no contractual mechanism to demand liquidation. The FAQs’ exit provisions are a direct regulatory response to these observed pathologies.

6.1 Unitholder-initiated voluntary winding up

Q&A 5(k) of the FAQs introduces a mandatory exit mechanism that fundamentally recalibrates the balance of power between retail investors and fund managers. The constitutive documents of every LAF must empower unitholders to initiate a voluntary winding up, delisting and withdrawal of SFC authorization by extraordinary resolution at any time after one year from the listing date. This right to mandatory withdrawal cannot be contractually disapplied or deferred beyond the initial one-year lock-up period.

Practically, this provision represents a significant departure from the traditional general partner/limited partner dynamic. Unlike institutional private equity where capital is commonly locked for 10 to 12 years without unilateral right of exit, the LAF regime now empowers the investors: If a fund trades at an insurmountable NAV discount, underperforms post-listing or fails to deploy capital efficiently within the mandated window, retail investors hold the right to initiate a voluntary winding up after 12 months, compelling a distribution of the underlying net assets.

6.2 Contested wind-downs and change of control

The legal right to wind up is distinct from the ability to execute a wind-down smoothly. Fund managers and investors should anticipate several friction points:

(a) Phased liquidation timelines. Where the underlying portfolio includes assets subject to regulatory approval prior to repatriation, for instance, assets held under QFII quotas that require tax clearance from PRC authorities, interim distributions may be made from offshore liquid assets while onshore positions remain suspended. This bifurcated realization process can span several months, during which investors receive only partial value and the fund remains in a protracted limited-operation phase.

(b) Regulatory waivers during wind-down. During liquidation, the SFC has demonstrated willingness to grant case-by-case operational relief from ongoing disclosure obligations that have become commercially impractical, including relief from continuous suspension announcements under UT Code 10.7, relief from updating offering circulars and publishing closing NAVs under UT Code 8.11, and permission to consolidate annual reporting with a final termination audit under UT Code 11.6. Managers should engage the SFC proactively at the earliest stage of a wind-down to identify and secure the appropriate waivers.

(c) Cost provisioning. Constitutive documents should require the manager to set aside an appropriate liquidation reserve from fund assets once a termination notice is issued. Failure to adequately discharge liquidation costs (including trustee fees, regulatory filings, tax advisers and asset disposal expenses) can erode the final distribution to unitholders. Where a voluntary winding-up resolution is requisitioned by a minority bloc or coincides with a change-of-control situation, the interaction with the Codes demands careful navigation. Once a bona fide offer for an LAF has been communicated, Rule 4 of the Codes prohibits frustrating actions by the management company without unitholder approval. In a contested wind-down scenario, managers must therefore assess whether any portfolio disposal, asset transfer or restructuring proposed during the liquidation period constitutes a frustrating action, and if so, whether independent unitholder consent is required before proceeding. The overlap between the UT Code wind-up mechanics and the Codes’ offer period restrictions creates a compliance window that must be managed with precision and care.

7. Integration with MPF pension capital

The commercial scalability of the LAF regime is significantly bolstered by the Mandatory Provident Fund Schemes Authority’s (MPFA) recent policy alignment. The MPFA issued guidance indicating a case-by-case willingness to approve “listed PE funds” for Mandatory Provident Fund (MPF) portfolios under Section 8(2)(c) of Schedule 1 to the Mandatory Provident Fund Schemes (General) Regulation.

The MPFA will evaluate whether an LAF maintains acceptable volatility, charges reasonable fees and adheres to core MPF investment restrictions. Inclusion on the MPFA-approved list could provide LAFs with access to long-term retirement capital, subject to case-by-case approval, potentially broadening the investor base beyond the retail segment.

Strategic implications for alternative asset managers

The updated regime is another major step toward the maturation of Hong Kong’s capital liquidity profile. The regulatory intent is unmistakable: to democratize access to private markets while imposing uncompromising, public market governance standards and robust exit mechanisms. For asset managers, the structural implications are profound.

The ability to launch multiple LAFs under a single, segregated umbrella presents an efficient capital-raising mechanism. However, the price of admission to the SEHK is full compliance with public company governance norms. Managers must prepare for board structures dominated by INEDs (even within private management subsidiaries running unit trusts), rigorous scrutiny of pre-listing asset valuations by listing agents, and the right of minority unitholders to requisition EGMs and, after one year from listing, to initiate a voluntary winding up.

Furthermore, navigating the Codes under PN 28 requires meticulous ownership monitoring. Sponsors must track concert party aggregations relentlessly to avoid inadvertently triggering a 30% MGO, while simultaneously utilizing MBLRs 10.06 buyback mechanics to surgically manage NAV discounts.

Ultimately, the success of the LAF regime will depend on how effectively managers can deploy capital within the mandated one-year window, how transparently they navigate connected transactions and whether they can actively manage secondary market liquidity to avoid structural traps. The regulatory architecture provides a rigorous pathway for alternative fund formation in Asia. The onus now shifts to the market to execute within these boundaries.

FCC Proposes Expansive E-Rate Program Review

Mon, 06 Jul 2026 13:55:00 Z

The Federal Communications Commission (FCC) adopted a Notice of Proposed Rulemaking and Further Notice of Proposed Rulemaking on June 25 on how it can ensure E-Rate-funded services are advancing educational outcomes. The FCC proposes to narrow the scope of services and equipment eligible for E-Rate support and to adopt new rules aimed at protecting children online and providing oversight of third-party consultants.

Evaluating E-Rate Program success

The FCC seeks input from interested parties on whether and to what extent the E-Rate Program has fulfilled its mission to ensure that schools and libraries in the United States “have access to advanced telecommunications services.” Citing the increase in broadband connectivity across schools nationwide, the FCC seeks comment on whether continued support for special construction of networks and managed internal broadband services is necessary. The FCC is also considering reducing support for internet access.

The FCC uses the National School Lunch Program eligibility and urban/rural status to determine an applicant’s discount rate. The FCC seeks comment on whether this is still an appropriate method for calculating support and whether it should limit E-Rate support to areas where applicants face the highest costs for E-Rate-supported services. In practical terms, such a change likely would reduce funding to suburban and urban areas and could direct more funding to rural areas. It also seeks comment on whether continued support for self-provisioned network construction and dark fiber is necessary, given private investment and other federal infrastructure funding programs, such as the Broadband Equity, Access, and Deployment (BEAD) program.

Children’s safe use of E-Rate-funded services

Under E-Rate Program rules, applicants must certify that the services requested through the program will be used primarily for educational purposes. The FCC seeks comment on how it can ensure that E-Rate-funded networks and services are being utilized for these purposes, and also requests input on the measures schools and libraries are taking to limit screen time.

Reexamining CIPA

The FCC currently interprets the Children’s Internet Protection Act (CIPA) restrictions to apply only to the use of devices owned by schools or libraries receiving E-Rate support for internet access, internet service or internal connections. The FCC seeks comment on this interpretation. The FCC also seeks comment on whether social networking sites are “harmful to minors” under CIPA and whether the FCC can impose additional protections to limit screen time.

Strengthening oversight of consultants and consulting firms

Consultants and consulting firms support E-Rate Program applicants across all phases of the program, including assisting with the submission of FCC Form 471 applications, responses to program integrity assurance review and audit inquiries. The FCC seeks to prevent the potential for fraud due to consultants’ influence on the competitive bidding process and lack of direct oversight by the Universal Service Administrative Company or the FCC.

Defining ‘consultant’

The FCC proposes defining a “consultant” as “any non-employee working on behalf of a school, library, consortium that includes an eligible school or library, or service provider that participates in or is seeking to participate in the E-Rate program and who assists the school, library, consortium that includes an eligible school or library, or service provider, whether or not for a fee, with any aspect of participating in the E-Rate program, including, but not limited to, the application, competitive bidding, or disbursement processes.”

The FCC seeks comment on whether the proposed definition should exclude certain individuals, such as certain nonemployees working on behalf of service providers in the ordinary course of their commercial relationship (e.g., channel partners, resellers, agents, authorized dealers). It also asks for comment on whether there is anything unique about the service provider-channel partner relationship and how channel partners are compensated that warrants excluding them from the definition.

Consultant certification and registration

The FCC proposes requiring service providers to submit an annual consultant certification and disclosure form and establishing a consultant registration database for individual consultants. The certification would require consultants to certify compliance with E-Rate Program rules.

Prohibiting percentage-based fee arrangements

The FCC is concerned that fees based on a percentage of money received under E-Rate may be contrary to the efficient use of limited funding and create incentives for consultants to encourage applicants to request more E-Rate funding than needed. The FCC proposes, and seeks comment on, strict prohibition on applicants and service providers from entering into any fee arrangement based on a percentage of the E-Rate contracts with and/or disbursements to the applicant or service provider the consultant represents.

Lowest corresponding price (LCP)

The LCP rule requires service providers to offer equipment and services to E-Rate eligible schools and libraries at prices less than or no higher than the lowest price the service provider charges similarly situated nonresidential customers for the same or similar equipment or services. The FCC seeks to clarify the scope and meaning of the rule and invites comment on whether it should modify the E-Rate rules to deter violations of the LCP rule.

For more information on the proposed rules and the potential impact, please reach out to one of the Cooley lawyers listed below.

Show Me the Money (or the Wage Range): New State Pay Transparency Laws

Mon, 06 Jul 2026 07:00:00 Z

Several states recently enacted new pay transparency laws imposing salary history bans, wage range disclosures, recordkeeping and other obligations on employers. Below is a summary of key provisions in Virginia, Maine, Connecticut and Delaware, along with recommended compliance steps.

Virginia: Salary history ban, wage range disclosure and private right of action

Effective July 1, 2026, Virginia employers must disclose the wage or salary range in all public and internal job postings (including promotions and transfers). Notably, the law has no minimum employee threshold and broadly applies to “employers,” defined in the state Labor Code as any entity “doing business in or operating within this Commonwealth who employs another to work for wages, salaries, or on commission.”

The range (minimum and maximum wage or salary for the position) must be set in good faith by reference to applicable pay scales, prior ranges, equivalent-position salaries or the budgeted amount. The range’s breadth is relevant to whether it has been set in good faith. In addition, employers are also prohibited from seeking or relying on an applicant’s wage or salary history, except where voluntarily disclosed, in which case the employer may use it only to support a higher offer consistent with federal and state equal pay laws. Unlike some other pay transparency laws, the law does not require a description of benefits in postings. It is unclear whether the law’s pay disclosure requirements cover remote positions that could be performed in Virginia or only positions physically performed in Virginia.

The law provides for attorney general enforcement and a private right of action. For attorney general enforcement, employers may face civil penalties of up to $1,000 for a first violation and up to $5,000 for subsequent violations, plus legal and equitable relief. For the private right of action, an aggrieved individual must sue within one year. In this case, for posting or good-faith range violations, the individual must first give the employer a 15-business-day written cure period; if the employer corrects the posting, no action may be brought. A written notice received from any person relating to a particular posting constitutes adequate notice for the duration of such posting. Employees may recover actual damages, plus legal and equitable relief.

Maine: Wage range disclosure and recordkeeping

Effective July 29, 2026, Maine employers with 10 or more employees must include the prospective pay range in all job postings, whether made directly or through a third party. Commission-only positions, however, need not include the range, but must indicate that the position is commission-only. The “range of pay” means the range the employer anticipates relying on when setting wages, determined by reference to:

Any applicable pay scale.
Previously determined range of wages for the position.
Actual range of wages for those currently holding equivalent positions.
The budgeted amount for the position.

Upon request, employers must also disclose to current employees the pay range for their position. Employers must maintain records of each position and the employee’s pay history for the duration of employment and three years after termination. The Maine Department of Labor will enforce the law.

Connecticut: Existing obligations expanded to include upfront wage ranges and benefits

Effective October 1, 2026, Connecticut’s HB 5003 expands existing pay transparency requirements, which currently only require disclosure of wage ranges in certain circumstances. Under HB 5003, which broadly applies to all employers regardless of size, employers must now include the wage or wage range and a general description of benefits in all internal and public job advertisements. The “wage range” must be set in good faith and may include references to any applicable pay scale or previously determined range for the position. “Benefits” include health insurance, retirement benefits, fringe benefits, paid leave and any other compensation other than wages offered with the position. HB 5003 also clarifies that the law covers positions performed in Connecticut and positions where the employee works outside the state but reports “directly to a supervisor, office or other worksite located within the state.”

Existing disclosure requirements for applicants and employees have also been expanded. For applicants, if the position has not been advertised, employers must provide the wage range and general description of benefits upon the earlier of the applicant’s request, or before any discussion of compensation or offer is made. For employees, employers must provide the wage range and benefits information upon hire, upon a change in position or upon the employee’s first request.

The law also expands anti-retaliation protections to cover refusal to interview, hire, promote or retain employees who exercise their rights under the law. Private actions must be brought within two years, and punitive damages are no longer recoverable in such actions.

Delaware: Wage range disclosure and recordkeeping

Effective September 26, 2027, Delaware employers with more than 25 employees must disclose the hourly or salary compensation or hourly or salary compensation range and a general description of benefits and other compensation applicable to the position in all internal and external job postings. The range must reflect the minimum to maximum pay for the position, set in good faith by reference to any applicable pay scale, previously determined range, equivalent-position salaries or the budgeted amount. The breadth of the disclosed range is a factor in assessing good-faith compliance. The law covers jobs located in Delaware and noninternational remote positions offered by Delaware-based employers. Notably, the law does not clarify whether the 25-employee threshold includes only Delaware-based employees or also those located outside the state.

Commission-based roles must disclose that fact but are not required to include a wage range, while tipped roles must disclose that fact and the base wage or range. If a posting was not made available to an applicant, the employer must provide the range and benefits description before any offer or compensation discussion and at any time at the applicant’s request. Temporary or immediate-hire positions are exempt from wage range disclosure obligations, with the Department of Labor tasked with promulgating regulations for these job opportunities necessitating immediate hire. Employers must retain job descriptions and salary history for each employee for at least three years. Employers are not liable for job postings that are digitally replicated or reposted by third parties without their consent. The Department of Labor will enforce the law. For a first offense, employers will receive a written warning; subsequent offenses carry civil penalties of $500 to $10,000 per violation.

Next steps

Employers operating in Virginia, Maine, Connecticut and Delaware should take the following steps to ensure compliance:

Audit job postings. Confirm that all postings for covered jurisdictions include good-faith compensation ranges and, where required, benefits descriptions.
Update salary history practices. If not done already, eliminate wage history inquiries from applications, interview protocols and recruiter instructions, and train hiring managers accordingly.
Establish recordkeeping protocols. Maintain job descriptions, compensation ranges and employee pay histories for the required retention periods.
Map jurisdictional coverage. Identify which positions are covered under each state’s law, with careful attention to remote work positions.
Strengthen anti-retaliation compliance. Where applicable, train managers and supervisors on the anti-retaliation protections under each law, including prohibited conduct, such as refusing to interview, hire, promote or retain employees who exercise their rights.
Monitor guidance and implementing regulations. Several of the new laws leave important implementation questions unanswered, and agency rulemaking or regulatory guidance may provide further clarity. Employers should track developments as new guidance emerges.
Monitor pay data reporting developments. The Equal Employment Opportunity Commission (EEOC) recently proposed eliminating EEO-1 Component 1 pay data reporting, which may prompt states and localities to enact their own workforce data collection requirements, and some already have. For example, Massachusetts’ pay transparency law requires employers required to file EEO-1 reports with the EEOC to also submit those reports to the state annually, and New York City recently enacted a multistage pay data reporting and pay equity study law, which will require large employers to report pay data to a designated city agency. Other jurisdictions, including Colorado, have enacted or proposed similar measures. Employers with multistate operations should monitor this evolving landscape closely and build state-level reporting compliance into their broader pay equity programs.

If you have questions about pay transparency laws or are interested in conducting a privileged pay equity audit, please contact the Cooley employment team.

Small State, Big Bite: What Sets Vermont’s New Privacy Law Apart

Tue, 30 Jun 2026 20:32:00 Z

Vermont became the 23rd state to enact a comprehensive consumer privacy law with the Vermont Data Privacy and Online Surveillance Act (VDPOSA), which was signed into law on June 16, 2026. At a high level, the VDPOSA takes the now-familiar US state law approach of a controller/processor framework with consumer rights. But it also includes a number of more expansive and distinctive provisions – such as low applicability thresholds for sensitive data and stand-alone provisions for consumer health data – that put it alongside Connecticut at the more aggressive end of the state consumer privacy law spectrum. As a result, despite Vermont’s small size, companies may need to reevaluate and update their multistate privacy compliance programs to account for these new requirements from the Green Mountain State.

Below, we describe key features of the VDPOSA and what companies should do to evaluate and update their compliance status before the law takes effect on January 1, 2028.

Low applicability thresholds

The VDPOSA’s general applicability thresholds encompass companies that:

Control or process personal data for at least 35,000 Vermont residents.
Control or process sensitive data for at least 3,000 Vermont residents.
Offer for sale in trade or commerce personal data of at least 3,000 Vermont residents.

The regular personal data threshold of 35,000 residents is not particularly low relative to Vermont’s population. However, the VDPOSA’s thresholds for sensitive data and sales of personal data are more aggressive than similar laws in most other states. Vermont does not go as far as Connecticut, whose similar thresholds are triggered by processing any amount of sensitive data or selling any amount of personal data, but its thresholds of 3,000 are still quite low. As a result, they could easily ensnare companies that are handling sensitive data or selling personal data at any sort of scale, particularly given the law’s broad definitions of “sensitive data” and “sale.”

Consumer health data

The VDPOSA also includes consumer health data protections that only a few other states – such as Connecticut via its consumer privacy law, Washington via its stand-alone My Health My Data Act and Nevada’s similar law – have enacted laws to protect. Companies that handle any amount of consumer health data must meet the law’s provisions related to such data, regardless of whether they meet the general VDPOSA thresholds discussed above.

The law’s requirements for consumer health data include requiring an affirmative opt-in consent before selling, or offering to sell, consumer health data and prohibiting geo-fencing within 1,850 feet of any healthcare facility (for the purpose of identifying, tracking, collecting data from or sending any notification to consumers regarding their health data). The VDPOSA also requires a company’s employees and contractors to be subject to a contractual or statutory duty of confidentiality before accessing consumer health data. Companies processing consumer health data must ensure that they comply with these requirements, which may also require updating existing applicable contracts to include a contractual duty of confidentiality.

Due to the VDPOSA’s broad definition of consumer health data, and the relevant obligations being triggered if a company handles any amount of consumer health data, companies could easily become subject to these requirements, even if they do not think of themselves as a healthcare-related business.

Expansion of sensitive data and additional obligations

As referenced above, the VDPOSA’s definition of sensitive data is, like Connecticut’s, one of the broadest among the 23 state consumer privacy laws. For example, Vermont includes financial account numbers with login credentials and certain government-issued identification numbers as sensitive data. Vermont also – similar to California, Colorado and Connecticut – treats neural data as a type of sensitive data, albeit limiting it only to data generated by the central nervous system, instead of both the central and peripheral nervous systems. Vermont also follows recent privacy laws’ trend of explicitly including nonbinary or transgender status as sensitive data.

In addition to the VDPOSA being triggered by a company’s control or processing of sensitive data of only 3,000 Vermont residents, handling such sensitive data triggers heightened obligations, including a requirement to obtain affirmative opt-in consent from consumers before processing their sensitive data. Additionally, Vermont requires companies to only process data that is necessary in relation to the purpose they disclose to consumers when they collect their data, and to obtain opt-in consent from consumers before selling any sensitive data.

Companies should assess their sensitive data collection and disclosure practices to ensure that their handling of data elements treated as sensitive data in Vermont complies with the VDPOSA.

Transparency about AI training

Reflecting recent regulatory and legislative concerns about AI, Vermont, like Connecticut, imposes a transparency obligation on companies regarding large language models (LLMs). Companies must include, in their privacy notice, a statement disclosing whether they collect, use or sell personal data for the purpose of training LLMs. For the many companies that leverage personal data in training their AI models, or sell personal data to train LLMs, this obligation will likely require updates to their current privacy disclosures and could generate additional consumer friction.

Broadening the right to access

Vermont has followed the lead of Connecticut and Minnesota in expanding a consumer’s right to access information about a company’s handling of their personal data. Under the VDPOSA, a consumer can obtain a list of third parties to which the company has sold the particular consumer’s personal data – or, if the company does not maintain this list, it must instead provide the consumer with a list of all third parties to which the company sells personal data of consumers generally. Even if companies take the latter, less granular approach that is not specific to the particular consumer making the access request, for many companies preparing to honor such requests is likely to require nontrivial back-end data mapping and other compliance work.

Derived data

Data derived from other information about a consumer is commonly understood to be personal data. However, the VDPOSA goes a step further by including derived data as a stand-alone defined term and explicitly including it as a type of personal data.

Enforcement and cure period

The VDPOSA does not contain a private right of action, so like most other state consumer privacy laws, it will be enforced exclusively by the state attorney general. Similar to some other state laws, Vermont also includes a 60-day cure period for a limited time following the law’s initial rollout – between January 1, 2028, and June 30, 2029 – to help businesses ease into compliance with the VDPOSA.

Interestingly, Vermont’s legislators also included a statement that if additional resources are not provided to the Office of the Attorney General to enforce the VDPOSA, then the General Assembly may consider adding a private right of action. This statement is unique among state consumer privacy laws, and the addition of a private right of action would represent a seismic shift in enforcement and potential exposure for companies. However, it appears unlikely that such a private right of action will make it into law in Vermont, as it would undoubtedly face vociferous opposition from industry.

What should companies do?

Due to Vermont’s relatively aggressive and distinctive provisions for certain types of personal data and activities, companies should work closely with privacy counsel to assess potential exposure under the VDPOSA, as well as similar provisions under Connecticut’s amended consumer privacy law. Relevant steps should include:

Assess whether you are in scope of the VDPOSA. Vermont’s relatively low and distinctive thresholds for certain activities – such as selling personal data or handling sensitive data or consumer health data – will bring many companies within scope of the law. Companies should carefully assess whether they are engaging in such activities, particularly given the broad ways that terms like “sensitive data,” “consumer health data” and “sale” are defined under the VDPOSA.
Revisit your sensitive data and consumer health data practices and obligations. Vermont includes many additional data elements as sensitive data and expands companies’ obligations for handling of sensitive data. It also has separate obligations that trigger if a company handles any amount of consumer health data (which is also defined as a type of sensitive data). These obligations related to specific data types may require additional compliance efforts.
Update privacy notices. Vermont requires companies to disclose in their privacy notice whether any personal data is collected, used or sold for training LLMs. Companies should also review their privacy notice for other updates needed to address the VDPOSA, such as whether their disclosures about their handling of sensitive data are accurate under the VDPOSA’s broad definition of that term.
Track data flows for sales of personal data. Under the VDPOSA, consumers have the right to obtain a list of all third parties to which their personal data is sold, so companies should conduct internal data mapping and similar exercises to ensure that they can fulfill this obligation. Companies also need to understand their personal data sales to assess whether they meet the VDPOSA’s applicability thresholds, one of which triggers if a company sells personal data of at least 3,000 Vermont residents.

Summer Doldrums – or Time to Think About 2027 Executive Compensation Programs?

Tue, 30 Jun 2026 13:23:31 Z

‘Let’s go surfin’ now
Everybody’s learnin’ how
Come on and “comp safari” with me!’

School is out, and vacations are in full force. At the risk of throwing cold water on hot summer fun, one question you nonetheless should be asking yourself now as a professional responsible for executive compensation is, in the fall, what will you wish you had done last summer? Some more surfing? Of course. But that still leaves enough time to get ahead of the compensation curve so that, when November rolls around, you’re well clear of where you need to be (and perhaps even feeling a bit smug) instead of wishing there were just a couple more weeks to prepare.

And so, what does that type of summer reading list look like? The most logical first step probably is to look at your compensation committee meeting checklist and identify those items that would benefit from a head start, even (and perhaps especially) those items that are not fully ripe for some time, which could include things like the following:

Evaluate how in-flight 2026 compensation programs are faring, and, as a result, whether there may be reason to give early thought to changes for the 2027 programs.
Evaluate whether the existing programs are resulting in any unanticipated risks due to changes in economic and geopolitical circumstances since grant.
Evaluate whether new-hire practices remain generally appropriate to avoid undue scrambling at the time of hire.
Evaluate the adequacy of share reserves given dilution projections so that you can start marshaling support for an increase.
Consider whether any additional clawback protections may be appropriate considering your circumstances.
Evaluate the adequacy of compensation governance procedures generally and whether changes should be put in place for the coming compensation season.
Give thought to whether the annual proxy disclosure could benefit from a fundamental refresh, which is a notoriously time-consuming exercise and ill-fitted to a pivot late in the year.
Make sure any annual stockholder outreach is on track and preferably ahead of pace, whether driven by reason of say-on-pay results or otherwise.

Of course, if you don’t already have a compensation committee meeting checklist, one thing that should be near the very top of your summer list is to develop one. And, for companies that do have a checklist, another item for consideration is whether any changes in content or timing are appropriate.

One of the best ways to do that is to find time for an informal meeting with the compensation committee chair to get their views on what is and is not working and what might be best handled differently. Having that meeting when there actually is time for quiet reflection will be most effective and likely also greatly appreciated by the chair.

That also might give rise to discussion about the need for collateral actions that could be scheduled for the fall, such as committee member education sessions about, for example, the status of the proposed executive compensation disclosure rule changes, shifts in market practices and any other noteworthy trends.

In a similar and complementary vein, a reach-out to your compensation consultant (if you have one) to get their views on the foregoing and any other items they see as important to the coming compensation season will better position you to address those matters when the time comes.

Finally, similar considerations to all of the foregoing apply where a compensation committee has been delegated responsibilities that often are lodged with other board committees, such as succession planning and human capital issues generally.

* * *

Sorry to bum you out when all you want to do is surf and then surf some more, but it’s just a word to the wise: A little time found and spent now likely will save you a lot of time later and result in a much smoother process when time is short and you are wishing it were still the dog days of summer.

Cooley’s compensation and benefits group is ready to help you craft an efficient review of the type contemplated here so that you still have plenty of time to rejoice in those summer doldrums. For our friends attending the 2026 Society for Corporate Governance National Conference in Nashville from July 7 to 10, please reach out – we’d love to connect with you!

What Employers Should Know About Washington’s New Ban on Noncompete Agreements

Mon, 29 Jun 2026 07:00:00 Z

On March 23, 2026, the Evergreen State became the latest state to enact a near wholesale ban on all employment noncompete agreements, effective June 30, 2027. The new law has significant implications for employers – voiding existing agreements retroactively, broadening the definition of what constitutes a now banned noncompete (including certain repayment agreements, such as sign-on or retention bonus agreements) and narrowing permissible nonsolicitation agreements. Below is a summary of the key changes, what remains permissible and steps employers should take to prepare.

The recent history and current landscape of Washington’s noncompete law

Washington’s crackdown on noncompetes began in 2020, when the state imposed restrictions – including a minimum compensation threshold for entering into a noncompete (equal to $126,858.83 as of January 1, 2026); an 18-month noncompete duration limit; a “garden leave” provision requiring employers to pay base salary during enforceable post-layoff periods; a prohibition on adjudication outside Washington or application of choice-of-law principles or substantive law of any jurisdiction other than the state of Washington; and moonlighting and anti-poaching provisions.

Initially, the restrictions applied only to traditional noncompetes and not to:

Confidentiality agreements.
Agreements not to solicit an employee to leave an employer.
Agreements not to solicit a current or former customer of an employer to cease or reduce the extent to which it is doing business with the employer.
Certain restrictions in connection with the sale of a business.

In 2024, the state again expanded its restrictions on noncompete agreements, broadening the definition of noncompetes to include agreements that directly or indirectly prohibit accepting or transacting business with a potential customer, clarifying that the customer nonsolicitation exception applies only to current customers. Further, the amended noncompete law narrowed the sale-of-business exception and required employers to provide notice of a noncompete “no later than the time of the initial oral or written acceptance of the offer.”

Washington’s new near-total ban

In enacting HB 1155, the legislature found that earlier reforms “did not go far enough,” citing that noncompetition covenants “restrict workers’ mobility, impede efforts to correct inequities, and significantly suppress workers’ wages across all sectors.” Washington joins several other states that have banned noncompetes, including California, Minnesota, North Dakota and Oklahoma.

Scope of the prohibition

The new ban voids nearly all noncompetes regardless of an employee’s salary or when an employee entered into the noncompete agreement. Similar to California’s law on noncompetes, Washington’s amended noncompete law defines a noncompete broadly as “every written or oral covenant, agreement, or contract that prohibits or restrains an employee or independent contractor from engaging in a lawful profession, trade, or business of any kind.” As of June 30, 2027, employers are prohibited from entering into, attempting to enter into, enforcing, attempting to enforce or threatening to enforce a noncompete. Employers will also be prohibited from representing that an employee or contractor is subject to a prohibited noncompete covenant (to such employee, contractor or any third party).

Repayment agreements included in prohibition

Following the recent trend on restricting certain repayment agreements (e.g., New York, California), Washington also joins the bandwagon by expanding the definition of a noncompete to also include any agreement that “threatens, demands, requires, or otherwise effectuates that an individual return, repay, or forfeit any right, benefit, or compensation as a consequence of the individual engaging in a lawful profession, trade, or business of any kind.” As a result of this expanded definition, agreements requiring repayment of retention bonuses, advanced payments or similar benefits upon departure may constitute prohibited noncompetes. Employers should review any such repayment agreement or provision to determine whether they fall within this expanded definition.

The law applies retroactively: All existing noncompete agreements, including repayment agreements, are void and unenforceable as of the effective date, regardless of when they were signed. However, legal proceedings filed before the effective date remain governed by the prior version of the law.

Notice requirement

Similar to California’s AB 1076 playbook, which required employers to notify current and former employees that noncompete clauses in their agreements were void, HB 1155 imposes its own notice requirement. By October 1, 2027, employers must make “reasonable efforts” to provide written notice to all current and former employees and contractors with active noncompetes that their agreements are void and unenforceable. The legislative history of HB 1155 does not clarify what constitutes a “reasonable effort” to provide written notice. However, to err on the conservative side, employers may consider providing both physical mail and email notice to current and former employees that any active noncompete clauses in their agreements are void and unenforceable.

Permissible covenants

The following provisions are excluded from the noncompete ban:

Nonsolicitation agreements: Nonsolicitation agreements remain enforceable in limited circumstances. Nonsolicitation of current employees is permissible and includes agreements prohibiting solicitation “of any employee of the employer to leave the employer.” Further, current or prospective customer nonsolicitation provisions are permissible only if they:

Are limited to preventing an employee from shifting business away from the employer where the employee established or substantially developed a direct relationship with the customer or prospective customer “through the employee’s work for the employer.”
Do not exceed 18 months following employment.

Notably, unlike the current law, which prohibits all prospective customer nonsolicitation agreements, HB 1155 appears to now permit them, provided that they meet the foregoing requirements. Importantly, any agreement that directly or indirectly prohibits a worker from accepting or transacting business with a customer is treated as a noncompete – not a nonsolicitation agreement – and is therefore banned.

Confidentiality and trade secret agreements: Agreements that protect confidential information, trade secrets or inventions are not affected by the ban.
Sale of business: Noncompetes entered into in connection with the purchase or sale of the goodwill of a business remain enforceable, but only if the person signing the agreement holds an ownership interest of 1% or more in the business.
Franchise agreements: A noncompete entered into by a franchisee in connection with a franchise sale that complies with applicable franchise law is still permitted.
Educational expense repayment: Employers may still require repayment of out-of-pocket educational expenses, provided the agreement:

Expires within 18 months of the employee’s start date.
Limits repayment to a pro rata portion of the remaining time in that 18-month period.
Releases the employee from the repayment obligation if the employee separates for “good cause,” as defined in the state’s unemployment benefit statute.

Further, the noncompete ban does not affect Washington’s existing moonlighting limitations under RCW 49.62.070, which remain unchanged. Under that provision, employers cannot restrict, restrain or prohibit employees earning less than twice the applicable state minimum wage (or, less than $34.26 an hour as of 2026) from working for another employer, working as an independent contractor or being self-employed. In addition, employers may continue to impose moonlighting restrictions on employees earning at or above that threshold.

Penalties for noncompliance

As before, persons “aggrieved” by a violation of the law have a private right of action. Further, the Washington attorney general may bring enforcement actions on behalf of affected workers. If a court or arbitrator finds a violation, the employer must pay the greater of the worker’s actual damages or a statutory penalty of $5,000, plus reasonable attorneys’ fees, expenses and costs. Notably, liability is triggered even when an employer merely attempts to enforce a noncompete or suggests that one still applies.

Next steps for employers

Because employers must provide written notice to all employees and contractors subject to an active noncompete by October 1, 2027 (regardless of when it was signed), employers should consider updating their practices before the June 30, 2027, effective date.

Employers can take the following steps to prepare for compliance:

Audit all existing agreements. Review all employment and contractor agreements, offer letters and related documents to identify provisions that may qualify as a noncompete under the law’s expanded definition. Beyond just noncompete and certain customer nonsolicitation agreements, this includes stay-or-pay agreements, training repayment agreement provisions (TRAPs) and other repayment obligations that could be construed as prohibited noncompetes.
Plan for mandatory worker notices. By October 1, 2027, employers must make reasonable efforts to notify current and former workers still within the term of a noncompete that those provisions are void. Employers should begin compiling a list of affected individuals, verifying contact information and identifying what “reasonable efforts” they will take to ensure compliance with this notice requirement. Note that this requirement also covers employees or contractors with repayment agreements that qualify as noncompetes under the law.
Evaluate and strengthen alternative protections. As noted, confidentiality and trade secrets agreements are not affected by the ban. Employers should assess whether such agreements, along with narrowly tailored nonsolicitation agreements, provide sufficient protection for the company’s legitimate business interests under the new law. Where insufficient, consult with counsel to strengthen these provisions and/or identify additional lawful strategies to safeguard the company’s interests.
Update templates and policies. Revise all standard employment agreement templates, confidential information and invention assignment agreement templates, restrictive covenant agreement templates, offer letter templates, contractor agreements and repayment agreements to remove or restructure any provisions that will be void under the new law.
Train HR and management. The law prohibits employers from representing to a worker that they are subject to a noncompete or attempting to enter into one. Employers should therefore ensure that HR personnel, managers and recruiters understand these broad prohibitions, as even an informal suggestion of enforceability could expose the company to liability.
Consider enforcement of existing noncompetes/repayment agreements. As noted above, the amended noncompete statute will not apply to legal proceedings commenced before June 30, 2027. Therefore, as such date approaches, employers may consider whether it may be prudent to commence litigation to enforce noncompete agreements (which, as emphasized above, also include repayment agreements) and to otherwise address breaches of any such agreements that have occurred before June 30, 2027.

If you have any questions about these laws or how to comply, please contact your Cooley employment lawyer or one of the lawyers listed below.

AI Chatbot’s Medical Claims Draw Regulatory Scrutiny

Fri, 26 Jun 2026 17:46:00 Z

On May 1, 2026, the Pennsylvania State Board of Medicine filed a complaint in the Commonwealth Court of Pennsylvania against Character Technologies, the corporate entity operating the Character.AI generative artificial intelligence platform.¹ The complaint raises immediate questions about state licensing board enforcement, but the regulatory picture it reveals extends further – to US Food and Drug Administration (FDA) oversight and an accelerating wave of state legislation targeting AI in healthcare. Character Technologies also faces a separate lawsuit brought by the Kentucky attorney general, which alleges that the company preys on children and leads them to self-harm.²

Background

The platform and the investigation

Character.AI is a generative AI platform with 20 million+ monthly users that allows users to create chatbot characters with specific personalities. A Pennsylvania Professional Conduct Investigator created an account, searched “psychiatry” and interacted with a character named “Emilie” described as a “Doctor of psychiatry.” Note that the character had approximately 45,500 user interactions as of mid-April, during which “Emilie” claimed to have medical credentials, offered to conduct a psychiatric assessment and represented that it held a valid Pennsylvania medical license, providing a fabricated license number.

Character Technologies does not hold a license to practice medicine in Pennsylvania.

The commonwealth’s case

Pennsylvania asserts that Character Technologies engaged in the unauthorized practice of medicine and surgery.³ The crux of the state’s allegations is that Character Technologies permitted its chatbot to hold itself out as a licensed psychiatrist by claiming a Pennsylvania license, using the title “psychiatrist” and providing a fabricated license number.

Character.AI contests the suit, reasoning that its user-created characters are fictional and intended for entertainment and roleplaying. The company points out that the platform includes in-chat disclaimers stating that characters are not real people and all statements should be treated as fiction, along with additional disclaimers warning users not to rely on characters for professional advice.⁴

Legal issues

State licensing

In Pennsylvania, medicine and surgery is defined as “[t]he art and science of which the objectives are the cure of diseases and the preservation of the health of man, including the practice of the healing art with or without drugs, except healing by spiritual means or prayer.”⁵ Medical doctors, including psychiatrists, as with most distinct healthcare professions (e.g., nurses, physician assistants, etc.), are licensed at the state level.

Further, Pennsylvania, like other states, prohibits the unauthorized practice of medicine, which includes:

Practicing medicine.
Purporting to practice medicine.
Holding forth as authorized to practice medicine through use of a title.
Otherwise holding forth as authorized to practice medicine.⁶

Given the breadth of these statutory prohibitions, the bar for demonstrating the unauthorized practice of medicine appears low. For example, a platform need not deliver clinical care in the traditional sense to run afoul of the statute; merely holding itself forth as authorized to practice medicine, whether through the use of a title, the assertion of credentials or other representations of licensure, may be sufficient. In this case, the complaint expressly alleges that the “Emilie” character represented that it was a medical doctor, claimed to have attended medical school at Imperial College London and to have been practicing psychiatry for seven years, asserted that it was licensed to practice medicine in Pennsylvania, and provided a fabricated Pennsylvania license number. Each of these allegations, standing alone or in combination, may be used as evidence that the chatbot held itself out as authorized to practice medicine.

‘Intended use’ and FDA’s medical device regulatory framework

The Character.AI matter also raises significant questions under federal law – specifically, whether a chatbot that performs diagnostic or treatment-related functions could be classified as a medical device⁷ subject to FDA oversight. Platform operators and their counsel should not assume that the absence of FDA enforcement to date reflects a settled regulatory position; to the contrary, the agency’s existing statutory and regulatory framework is more than sufficient to reach AI chatbot platforms with these types of functions, and the Pennsylvania complaint may accelerate federal attention to this space.

Under the Federal Food, Drug, and Cosmetic Act (FDCA), a product qualifies as a “device” if it is “intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease” or is “intended to affect the structure or any function of the body” – provided that, unlike a drug, it does not achieve its primary intended purposes through chemical action within or on the body and does not depend on being metabolized to achieve such purposes.⁸ Critically, FDA does not simply accept a company’s characterization of what its product is intended to do. Under 21 CFR § 801.4, a product’s “intended use” can be established by, among other things, its design, the circumstances surrounding its distribution, website claims, advertising, and oral and written statements. FDA evaluates the totality of the circumstances – how a product is actually used, what it actually communicates and what the objective evidence shows about the manufacturer’s intent.

Importantly, FDA regulates Software as a Medical Device (SaMD) in the same manner as other products, unless the software is subject to one of the statutory carve-outs from the 21st Century Cures Act, such as software intended for general wellness purposes.⁹ Thus, software that is intended for use in the diagnosis or treatment of a disease or condition is subject to regulation as a medical device under the FDCA.

While the FDCA may already provide a basis for reaching chatbot operators, enforcement to date has largely been driven by state attorneys general rather than FDA. That gap likely reflects issues of timing and resource constraints rather than any meaningful limitation in federal authority. In the current environment, states like Pennsylvania also appear more willing to devote their limited resources to enforcement in this space. For platform operators, that combination of latent federal authority and active state-level activity means the question is not whether regulatory scrutiny is coming, but how to be ready as it continues to evolve.

The best defense is a good offense

So, what can platform operators do now to get ahead of the regulatory curve? First, they can start with a regulatory risk assessment to map the landscape of applicable state laws across all jurisdictions in which the platform operates before deploying health AI features.

Based on that assessment, platforms can strengthen their regulatory position by calibrating their compliance practices either to the highest applicable state standards or to emerging national frameworks. The Federation of State Medical Boards, for example, announced in May 2026 the formation of a new workgroup charged with developing recommendations and model guidelines for state medical boards on the regulation of AI tools used in the practice of medicine. At the federal level, and as discussed further below, the Trump administration has also signaled its desire to establish a uniform federal framework for AI.¹⁰

Platform operators should also define and implement clear boundaries around what their AI systems can do in all healthcare contexts. This does not mean shutting down all health-related conversations, but it does mean drawing a line between providing educational information or a general wellness function and conduct or messaging that may appear to be providing clinical advice requiring a professional license, which is a distinction that matters equally under state unauthorized practice statutes and the FDA’s device classification framework. A chatbot offering generic stress-management tips will be analyzed differently than one that asks about symptoms, offers a diagnosis or recommends a treatment course. Those boundaries should be enforced through content moderation systems and model-level constraints, not through user-facing disclaimers alone, given that a company’s disclaimers may actually be used to demonstrate knowledge of the law and do not change a product’s status as a device under the FDCA.¹¹> Platforms that build these guardrails in before a regulator comes knocking will be in a far stronger position than those that wait and react.

Will the Character.AI case open the floodgates?

It is too early to say whether the Character.AI lawsuit will open the floodgates for state enforcement actions, but the conditions are there. State licensing boards now have a live case that hands them a roadmap for going after AI platforms whose responses stray into regulated territory. And they are not the only ones: A growing number of state legislatures have moved to regulate AI systems directly (e.g., California, Texas and Illinois), and more will follow.

These developments suggest a regulatory landscape that may become both broader and more varied over time – though federal pressure on state AI regulation is mounting. On December 11, 2025, President Donald Trump signed an executive order directing federal agencies to establish “a minimally burdensome national policy framework for AI.” While the order does not preempt existing state AI laws, it identifies several mechanisms for challenging state AI laws inconsistent with that policy, including Department of Justice litigation, Commerce Department review of “onerous” state laws, and a White House mandate to prepare a legislative recommendation establishing a uniform federal framework that would preempt state laws conflicting with the administration’s policy of sustaining and enhancing US global AI dominance through a minimally burdensome national framework.¹²

For now, state AI compliance obligations remain in effect. The scope of these regulations varies considerably from state to state, ranging from disclosure requirements mandating that users be informed they are interacting with an AI agent to data privacy obligations, advertising restrictions and other consumer protection measures. Of particular relevance to the issues raised by the Character.AI matter, Delaware recently enacted legislation that expressly prohibits a “nonhuman entity,” including an “agent powered by artificial intelligence,” from using professional titles or abbreviations associated with licensed healthcare professions, including, but not limited to, “advanced practice registered nurse,” “registered nurse,” “doctor” and similar designations.¹³ The Delaware law further prohibits the licensure of a nonhuman entity to practice medicine, nursing or related healthcare professions, and bars any such entity from engaging in the practice of medicine within the state. Legislation of this nature may reflect a growing desire among state legislatures to expressly address this practice in an attempt to rein in AI platforms that offer medical advice without state oversight – though their durability will depend on whether federal legal challenges to these laws materialize and succeed, or whether Congress moves to preempt them through a federal AI framework.

What makes the Pennsylvania case especially notable is how it started – not with a purpose-built health app, but with a single chatbot on a general-purpose platform that a state investigator found by searching “psychiatry.” The takeaway: Regulators are looking at what the AI actually says, and if those responses look like the practice of a licensed profession or the function of a regulated device, disclaimers may not be enough. That said, enforcement is not the only model. Some states have signaled a preference for regulatory partnership over litigation. Utah, for example, has entered into a regulatory mitigation agreement with mental health chat app ElizaChat, under a framework created by Utah law¹⁴ that allows companies to operate under agreed terms in exchange for regulatory flexibility. Whether other states follow Utah’s lead remains to be seen, but the gap between a regulatory partnership and an enforcement action may come down to whether the platform drew the lines itself before a regulator had to – or, where a regulator has already drawn them, whether the platform engaged constructively with those boundaries rather than ignoring them.

Notes

The Pennsylvania State Board of Medicine operates under the Pennsylvania Department of State, Bureau of Professional and Occupational Affairs.
Commonwealth of Kentucky ex rel. Coleman v. Character Technologies, Inc., No. 26-CI-00029 (Ky. Franklin Cir. Ct. filed Jan. 8, 2026).
In violation of Sections 422.10 and 422.38 of the Medical Practice Act.
Cailey Gleeson, “Pennsylvania Sues Character.ai Over AI Chatbot Allegedly Presenting Itself as Licensed Medical Professional,” Fierce Healthcare, May 7, 2026.
63 Pa. Stat. Ann. § 422.2.
63 Pa. Stat. Ann. § 422.10.
21 USC § 321(h)(1).
Id.
21 USC § 360j(o). See also, Cooley, “FDA Opens Aperture for Wearables in Latest General Wellness Guidance,” January 20, 2026.
“Ensuring a National Policy Framework for Artificial Intelligence,” Exec. Order No. 14365, 90 FR 58499, December 11, 2025).
See, e.g., United States v. 789 Cases of Latex Surgeons’ Gloves, 799 F. Supp. 1275, 1285 (D.P.R. 1992) (“Whether a product’s intended use makes it a device depends, in part, on the manufacturer’s objective intent in promoting and selling the product. All of the circumstances surrounding the promotion and sale of the product constitute the ‘intent.’ It is not enough for the manufacturer to merely say that he or she did not ‘intend’ to sell a particular product as a device.”).
“Ensuring a National Policy Framework for Artificial Intelligence,” Exec. Order No. 14365, 90 FR 58499, December 11, 2025. See also, Cooley, “Showdown: New Executive Order Puts Federal Government and States on a Collision Course Over AI Regulation,” December 12, 2025.
Del. H.B. 191, 153d Gen. Assemb. (2026).
UT Code § 13-72-302.

A New AIM: Key Proposed Reforms Impacting Innovative High-Growth Companies

Tue, 23 Jun 2026 15:38:21 Z

The London Stock Exchange (LSE) has set out significant proposed reforms to the AIM Rules for Companies (AIM Rules), with the important aim of refocusing and repositioning AIM compared to the Main Market and other international markets.

For innovative high-growth companies – particularly those in the technology and life sciences sectors, which make up a significant part of AIM’s growth-company ecosystem – several of the proposed changes are directly relevant. Below, we highlight the developments we consider most significant and share our perspective on each.

Shaping the future of AIM

The proposals – recently published in AIM Notice 62 and building on the broadly positive market reception to the LSE’s November 2025 Feedback Statement – are designed to modernise AIM, reduce unnecessary admission burdens and give founder-led, innovative and growing companies greater flexibility to operate when listed on AIM. A consultation on the proposals is open until 2 July 2026.

Running through all of these proposals is AIM’s explicit “buyer beware” market model. For the first time, the LSE is proposing to include this characterisation in the introduction to the AIM Rules themselves – making clear that AIM is a market for growth companies that carry a higher risk profile than the LSE Main Market, and that investors must form their own view of the merits and risks of any AIM investment. A proposed reduced regulatory burden for companies is, in other words, matched by an unambiguous statement of investor responsibility.

The working capital statement is going – a meaningful change for pre-revenue companies

Under the current AIM Rules, directors are required to include in the admission document a clean working capital statement confirming that the company has sufficient working capital for the next 12 months following admission. That requirement is supported by a working capital report prepared by a firm of accountants. The working capital diligence exercise can be costly and time-consuming, and the end result – the working capital report – is a private document not available to end investors, only covering a 12-to-18-month horizon.

In practice, this has been a pain point we frequently encounter for early-stage companies considering AIM. For tech and life sciences businesses – particularly those that are pre-profitability, reliant on milestone-linked financing or building out commercial infrastructure post-approval – making the unqualified positive statement that the current rules require has often been extremely difficult.

The LSE is proposing to replace the working capital statement with a requirement to clearly disclose the company’s capital resources, financial obligations and anticipated fundraising needs over the 12 months following admission. The shift – from a binary statement to a qualitative, disclosure-based framework – is more proportionate and better reflects how sophisticated investors in these sectors assess financial risk. It is also more honest. Early-stage companies should be able to tell their story clearly, including the fact that they expect to return to market for further capital, without that disclosure being treated as a disqualifying factor.

One practical issue remains worth flagging. Auditors must still be satisfied as to going concern status when signing off on a company’s annual accounts – and for early-stage companies with limited cash runway or uncertain funding outlooks, obtaining that sign-off can be a challenging process. If this process results in the accounts being published after the six-month deadline required by AIM Rule 19, this will trigger a suspension of the AIM listing, an outcome that the removal of the requirement for the working capital statement in the Admission Document does not prevent. Early and ongoing dialogue with auditors on going concern status therefore remains as important as ever, despite the other benefits of the proposed reform package.

UK GAAP is now accepted – a significant cost saving at admission

AIM companies incorporated in the UK may now use UK generally accepted accounting principles (GAAP) (FRS 102) rather than International Financial Reporting Standards (IFRS). Other local GAAPs may also be permitted where IFRS equivalency can be demonstrated. This change has already been applied in practice following the Feedback Statement and is now being formally incorporated into the AIM Rules.

For many UK tech and life sciences companies – particularly those whose sector peers also report under UK GAAP – this removes a significant and often costly accounting conversion exercise at the point of admission. It is worth noting, however, that companies with longer-term ambitions to step up to the LSE’s Main Market or list on US markets (including Nasdaq) as foreign private issuers will ultimately need to report in IFRS or US GAAP. Forward planning on accounting standards, and on the timing of upgrades to internal financial controls and reporting processes, remains important.

The Capital Access Window – managing fundraisings more effectively

For AIM companies – and particularly for life sciences businesses that regularly return to market for follow-on capital – one of the persistent practical challenges has been managing a fundraising process without inadvertently creating price volatility or information leakage. The dispersed investor bases that are common among AIM-listed life sciences companies compound the problem: Coordinating an approach to retail investors alongside institutional investors, while a live share price moves, has been a real execution risk.

The proposed Capital Access Window addresses this directly. AIM companies undertaking an equity fundraise will be able to voluntarily request a temporary trading suspension, creating a controlled window in which to approach investors – including retail investors – without the pressure of a live market. This builds on the framework introduced by the UK’s Public Offers and Admissions to Trading Regulations 2024 which permit greater retail investor participation in secondary offers on AIM (and the Main Market) without a prospectus.

The LSE has confirmed that requests for a Capital Access Window will be considered on a case-by-case basis, without a prescribed duration. That flexibility is the right approach; it reflects the reality that the needs of a seasoned life sciences issuer undertaking its fifth follow-on financing will differ from one accessing the market for the first time post-admission. Engaging early with your legal advisors, your Nominated Adviser and the LSE’s AIM team as a fundraising takes shape will be essential to making effective use of this mechanism.

Founder-friendly structures – dual-class shares and remuneration flexibility

Two of the proposed changes are particularly targeted at the founder-led companies that are central to AIM’s growth-company ecosystem.

First, special voting shares will be permitted at admission, enabling founders to retain control while accessing public capital markets. This mirrors the dual-class share structures that have been available on the Main Market substantively since 2025 and brings AIM into line with several of its international competitors. It removes what has been a structural barrier for ambitious founder-led businesses that have considered – and in some cases ruled out – an AIM admission.

Second, Nominated Advisers will no longer be required to provide a fair and reasonable opinion on nonstandard director remuneration arrangements where they are satisfied that reasonable commercial protections are in place. Where there is uncertainty, it can be resolved by putting the matter to a shareholder vote – a mechanism that aims to strike a balance between founder-friendly flexibility and investor protection. For tech and life sciences companies, where competitive remuneration packages are essential to attracting and retaining specialist talent, this is a practical and welcome change.

Governance – five areas and an issuer-specific approach

AIM companies will no longer be required to adopt and “comply or explain” against a specific corporate governance code. Instead, they will be expected to provide disclosure across five areas that investors have identified as consistently important: board composition; directors’ roles and responsibilities; remuneration and performance; risk and controls framework; and approach to investor relations.

This is a meaningful shift, in line with the proposed move toward greater investor responsibility and the aim of effective regulation. Many innovative growth companies have governance structures that are well-designed for their stage of development and investor base but do not map neatly onto any recognised code. The obligation to “explain” departures from a prescribed template has, in practice, often generated boilerplate disclosure – even if comparative benchmarking was a commendable aim. Requiring disclosure against five investor-prioritised areas, while leaving companies free to design governance arrangements appropriate to their circumstances, is arguably a more intelligent approach and has the potential to deliver more meaningful governance reporting. For investors, while there may be a little more work to do to understand, substantively and comparatively, the governance arrangements of each company, the hope would be that improved quality of governance disclosures will not make this burdensome.

The LSE is also proposing to give AIM companies the ability to disclose engagement with proxy advisors and a voluntary “right of reply” to third-party commentary, speculation or criticism – including on social media and investor bulletin boards. The LSE has been clear that misleading and sometimes abusive content posted anonymously about AIM companies and their directors on bulletin boards has been damaging to market confidence. AIM companies will now have the ability to respond formally and “on the record”.

Acquisitions – reduced friction for ‘buy-and-build’ strategies

Two changes reduce the regulatory friction associated with acquisition activity. The threshold for a transaction to constitute a “substantial transaction” – triggering shareholder disclosure requirements under AIM Rule 12 – is proposed to increase from 10% to 25% of class test thresholds, aligning AIM with the Main Market.

More significantly, an acquisition will no longer automatically be classified as a reverse takeover simply because it exceeds 100% in the class tests. What will matter is whether the acquisition results in a fundamental change to the company’s business, board or voting control. Under the previous approach, major acquisitions could trigger a full reverse takeover process – including a suspension of trading, a new admission document, a working capital report and updated financial statements – solely because of their size, regardless of whether they were genuinely transformative or fundamental to the company’s business. Many issuers and advisors will be aware of instances in which the old regime could apply disproportionate requirements for acquisitive companies, and the effort to correct this is notable.

For AIM companies pursuing buy-and-build strategies – a growth model that is particularly common among tech businesses assembling complementary capability stacks – these proposed changes have the potential to meaningfully reduce both cost and execution risk.

Other changes worth noting

AIM Notice 62 also proposes a new Express Market route to replace the current AIM Designated Market admission route. The new route is designed to give a broader range of international companies – those listed on markets operating to International Organization of Securities Commissions (IOSCO) standards – a streamlined path to AIM admission. There is also a new dual-market applicant route for companies seeking simultaneous admission to an Express Market and AIM, reducing the documentation burden for those transactions.

A separate consultation (AIM Notice 63) covers proposed changes to the AIM Rules for Nominated Advisers, including a reorientation of the Nominated Adviser role toward public corporate finance expertise rather than compliance monitoring – a shift that is likely to be welcomed by AIM companies and their advisors alike.

Conclusions

Taken together, the proposals in AIM Notice 62 represent the most substantive recalibration of AIM’s regulatory framework in years – and, for innovative and growing companies, the proposals appear to be, largely, in the right direction. The shift from binary compliance requirements to proportionate, disclosure-based frameworks; the removal of structural barriers to founder control; and the practical improvements to how fundraisings and acquisitions are managed, all show thoughtful consideration of the role of AIM in the changed public markets landscape, as well as promise in understanding AIM’s core constituency of companies and investors and their needs. The consultation closes on 2 July 2026.

If you would like to discuss how the proposals affect your specific situation, please reach out to the Cooley capital markets team.