Insights

Do you want your startup to expand and become a major player in your industry? If so, you will most likely need to seek capital from outside investors to help you build infrastructure and fulfill orders.

The UK government has launched a consultation that could fundamentally change the UK’s corporate reporting framework. The consultation was published on 7 September 2026 and closes on 30 November 2026. 

When federal law enforcement agencies issue subpoenas to companies for information about their customers, the subpoenas or cover letters often contain boilerplate nondisclosure language. This language generally directs companies not to notify those customers and implies that there may be legal consequences for doing so. But as two lawmakers recently called out in a formal letter to the U.S. Supreme Court and the U.S. Government Accountability Office (GAO), this boilerplate language may not carry the force of law.

In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

Part Two of a Two-Part Client Alert Series. This Alert builds on the discussion in Part One, which surveyed Bear Creek (2017), Copper Mesa (2016), South American Silver (2018), Eco Oro (2021), and Lupaka (2025).

September 2026 marks the first anniversary of the corporate criminal offence of failure to prevent fraud coming into force under section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). The Home Office guidance recommends that organisations review their fraud prevention measures at least every 12 months.

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

The General Services Administration (GSA) has begun sending out email notifications of a “known glitch” affecting certain System for Award Management (SAM) registrations as far back as spring 2026.  

Between 2021 and 2025, Medicaid spending on ABA therapy grew six times faster than the number of children who received services, making it one of the fastest-growing areas of Medicaid expenditure, according to CMS. On August 4, 2026, CMS released a toolkit to help state Medicaid and CHIP agencies strengthen their programs and limit fraud, waste, and abuse tied to increased demand for ABA therapy. In 2025, Medicaid spent about $10 billion on ABA and related therapy services for children with ASD — a dramatic increase from the $2 billion spent in 2021. 

The U.S. Government Accountability Office’s (GAO) recent decision in Viderity Inc.—Costs, B-424422.5, Sept. 1, 2026, offers useful insight into what constitutes a legally sufficient conflict of interest investigation. The decision arose in an unusual procedural posture: Viderity initially protested, alleging that an agency evaluator had a personal conflict of interest. After the agency took corrective action, Viderity filed a cost entitlement claim requesting that GAO direct the agency to reimburse Viderity’s protest costs. In evaluating that claim, GAO assessed whether Viderity’s underlying protest ground was “clearly meritorious.”

Until recently, Belgian law did not have a general regulatory framework for internal investigations. Companies wishing to conduct an investigation had to navigate a fragmented set of rules that covered general principles and, to a limited extent, privacy and employee rights. The application of these rules to internal investigations was not clear, and it was therefore often difficult to put the rules into practice. This legal vacuum created significant risks, both for the integrity of the investigation itself and for the admissibility of any evidence gathered. 

Over the past several years, the biopharmaceutical industry has embraced artificial intelligence and machine learning (AI/ML) in near lockstep with the pace of AI/ML innovations. Today, industry leaders are using AI/ML to, among other things: discover and assess biological pathways, target chemical structures and sequences; design proteins; model pre-clinical and clinical trials; recruit and screen potential patient populations; evaluate clinical trial results and biomarker data; prepare regulatory filings; and manage supply chains. Deployment of new AI/ML models promises extraordinary advances in pharmaceutical development. However, as with any technological and scientific advances, the use of AI/ML also poses substantial legal risks that life sciences companies need to consider and proactively manage. 

On September 8, 2026, the U.S. Department of Labor's (DOL) Employee Benefits Security Administration (EBSA) issued “Field Assistance Bulletin No. 2026-03” to clarify compliance with the Mental Health Parity and Addiction Equity Act (MHPAEA) and nonquantitative treatment limitations (NQTL). Under the 2013 final rule implementing MHPAEA, health plans and issuers must use comparable processes, strategies, evidentiary standards, or other factors when applying NQTLs and they cannot apply such methods more stringently to benefits for mental health and substance use disorder (MH/SUD) compared to benefits for general medical and surgical care. While the bulletin doesn’t break much new ground on compliance, it does reaffirm existing enforcement priorities and expectations. 

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

This Alert, the first in a two-part series, surveys the legal landscape at the intersection of two issues that increasingly shape the outcome of mining and natural resources disputes regarding the protections available to foreign investors under investment treaties, as enforced through Investor-State Dispute Settlement (ISDS). The first is the prior consultation obligation imposed on States under the Indigenous and Tribal Peoples Convention, 1989 (No. 169), adopted by the International Labour Organization (ILO 169). The second is social license, the practical acceptance of a project by surrounding communities, which is distinct from but related to the formal State consultation duty. This Alert examines these issues across five foundational ISDS decisions:

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

On 3 September 2026, the European Commission adopted new Guidelines on the application of Article 102 TFEU to abusive exclusionary conduct by dominant undertakings. The Guidelines follow a public consultation on a draft published in August 2024 and reflect substantial stakeholder feedback. They replace the Commission's 2008 Guidance on enforcement priorities (which ceases to apply 30 days after publication of the new guidelines in the Official Journal) and represent the most significant reset of the Commission's Article 102 enforcement framework in nearly two decades. The Commission's stated aim is to set out principles and operational guidance, enhance legal certainty, and help companies self-assess their exclusionary-abuse risk.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

The UK Supreme Court has unanimously dismissed the appeal of Mr Francesco Costa, former chairman of Spring Media Investments Limited, in the first Supreme Court judgment to consider the scope of the duty under section 172(1) of the Companies Act 2006. The foundational position is that good faith requires honest conduct as well as honest thinking. A director's genuine belief that they are acting in the company's best interests will not excuse covert or disloyal conduct in pursuit of that belief. 

On September 4, 2026, the IRS published a notice of proposed rulemaking (NPRM) titled “Racial Nondiscrimination in Private Schools” (REG-119986-25). The proposed rule would extend the prohibition against racial discrimination in private schools to policies and practices that are intended to serve “remedial or diversity-related objectives,” such as those commonly associated with diversity, equity, and inclusion (DEI) initiatives. Under the proposed rule, any private primary or secondary school, college, professional or trade school, or university, would lose its tax-exempt status if it adopts, maintains, or enforces any policy or practice that considers race, color, or national or ethnic origin in the administration of any admissions policy, scholarship or loan program, athletic program, or other school-administered program. Comments are due November 3, 2026, and, if finalized, the proposed rule would go into effect on May 31, 2027.