Insights

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

This Alert, the first in a two-part series, surveys the legal landscape at the intersection of two issues that increasingly shape the outcome of mining and natural resources disputes regarding the protections available to foreign investors under investment treaties, as enforced through Investor-State Dispute Settlement (ISDS). The first is the prior consultation obligation imposed on States under the Indigenous and Tribal Peoples Convention, 1989 (No. 169), adopted by the International Labour Organization (ILO 169). The second is social license, the practical acceptance of a project by surrounding communities, which is distinct from but related to the formal State consultation duty. This Alert examines these issues across five foundational ISDS decisions:

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

On 3 September 2026, the European Commission adopted new Guidelines on the application of Article 102 TFEU to abusive exclusionary conduct by dominant undertakings. The Guidelines follow a public consultation on a draft published in August 2024 and reflect substantial stakeholder feedback. They replace the Commission's 2008 Guidance on enforcement priorities (which ceases to apply 30 days after publication of the new guidelines in the Official Journal) and represent the most significant reset of the Commission's Article 102 enforcement framework in nearly two decades. The Commission's stated aim is to set out principles and operational guidance, enhance legal certainty, and help companies self-assess their exclusionary-abuse risk.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

The UK Supreme Court has unanimously dismissed the appeal of Mr Francesco Costa, former chairman of Spring Media Investments Limited, in the first Supreme Court judgment to consider the scope of the duty under section 172(1) of the Companies Act 2006. The foundational position is that good faith requires honest conduct as well as honest thinking. A director's genuine belief that they are acting in the company's best interests will not excuse covert or disloyal conduct in pursuit of that belief. 

On September 4, 2026, the IRS published a notice of proposed rulemaking (NPRM) titled “Racial Nondiscrimination in Private Schools” (REG-119986-25). The proposed rule would extend the prohibition against racial discrimination in private schools to policies and practices that are intended to serve “remedial or diversity-related objectives,” such as those commonly associated with diversity, equity, and inclusion (DEI) initiatives. Under the proposed rule, any private primary or secondary school, college, professional or trade school, or university, would lose its tax-exempt status if it adopts, maintains, or enforces any policy or practice that considers race, color, or national or ethnic origin in the administration of any admissions policy, scholarship or loan program, athletic program, or other school-administered program. Comments are due November 3, 2026, and, if finalized, the proposed rule would go into effect on May 31, 2027. 

The U.S. Department of Transportation (DOT) published a final rule amending 14 CFR Part 234 that fundamentally changes how airlines report the causes of flight delays and cancellations. Effective October 19, 2026, the rule implements Section 511(b) of the FAA Reauthorization Act of 2024 by creating a new reporting category, the “Section 511(b) category,” for ten specific events that Congress determined are not attributable to airline control. The rule simultaneously narrows the existing "Air Carrier" reporting category by expressly excluding those same ten events.

The U.S. Food & Drug Administration (FDA) is seeking feedback on a regulatory framework that could be used to evaluate generative artificial intelligence (GenAI)-enabled medical devices. Such devices could create new types of risks because their outputs can vary and evolve, unlike more traditional software-enabled devices. An August 18, 2026, discussion paper (“Considerations for the regulation of GenAI-enabled medical devices”) discusses potential regulatory considerations for GenAI-enabled medical devices. 

On August 20, 2026, the Small Business Administration (SBA) proposed to materially amend the way it establishes size standards for purposes of federal procurement. SBA simultaneously issued two rulemakings. First, SBA published the 2026 Revised Size Standards Methodology white paper (2026 White Paper), which explains the proposed changes to SBA’s methodology for establishing size standards. Second, SBA published

 

On Tuesday, August 25, 2026, the U.S. Department of Justice (DOJ) announced that Deloitte LLP and several of its subsidiaries agreed to pay, collectively, $21.5 million to resolve allegations that Deloitte violated the False Claims Act (FCA) by failing to comply with new anti-discrimination requirements incorporated into its federal contracts, by discriminating against employees and applicants on the basis of race and sex, and by allocating and seeking reimbursement for costs related to those practices under its federal government contracts. This resolution is the second of its kind under DOJ’s recently launched Civil Rights Fraud Initiative, following a similar settlement by IBM in April 2026.

Enbrel (etanercept) is one of the best-selling biologic drugs in the United States, approved to treat rheumatoid arthritis and other serious inflammatory conditions. Etanercept was launched as Enbrel in 1998 as a treatment for moderate to severe rheumatoid arthritis, and was later approved to treat additional inflammatory diseases including plaque psoriasis, psoriatic arthritis, ankylosing spondylitis, and polyarticular juvenile idiopathic arthritis.  

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in United States v. Florida Medical Associates, LLC, – F.4th –, 2026 WL 2581886 (11th Cir. Sept. 1, 2026) (the “Zafirov appeal”) overturning the district court and holding that the qui tam provisions of the False Claims Act (“FCA”) do not violate the Appointments Clause of Article II of the United States Constitution because relators are not officers of the United States that occupy “continuing positions.” The Eleventh Circuit did not reach other arguments made by the parties and remanded the case to the District Court for the Middle District of Florida to address two other constitutional arguments challenging the FCA’s qui tam provisions based on Article II’s Vesting and Take Care Clauses. 

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) jointly issued a final rule that, for the first time, gives the term “unsafe or unsound practice” a binding regulatory definition.[1] With it came a uniform standard for Matters Requiring Attention (MRAs) and revised OCC examination manuals.[2]The Federal Reserve did not join the rulemaking, but has adopted comparable standards through guidance. What that means for holding companies and state-chartered institutions is addressed below.[3] The regulation takes effect November 2, 2026, and the revised OCC examination manuals took effect upon their issuance on August 27.

On August 20, 2026, the College Sports Commission (CSC) released a memorandum outlining how its Department of Investigations (DOI) is approaching enforcement of name, image, and likeness (NIL); revenue sharing; and roster limit rules. The memo signals that the CSC’s enforcement apparatus is fully operational and that Division I institutions should prepare for direct investigative engagement.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List — established through the Secure and Trusted Communications Networks Act — to include foreign-produced connected power inverters and advanced robotic devices, following an executive branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products without an exception or approval.

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

In a significant and unanimous ruling, the D.C. Circuit upheld the Environmental Protection Agency’s (“EPA”) final rule designating perfluorooctanoic acid (“PFOA”) and perfluorooctanesulfonic acid (“PFOS”) as “hazardous substances” under the Comprehensive Environmental Response, Compensation, and Liability Act (“CERCLA”), denying the petitions of seven industry groups seeking to overturn that designation.[1] CERCLA, also known as the “Superfund Statute,” allows EPA to require potentially responsible parties to fund cleanup of hazardous substances.

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.