Insights

The U.S. Food & Drug Administration (FDA) is seeking feedback on a regulatory framework that could be used to evaluate generative artificial intelligence (GenAI)-enabled medical devices. Such devices could create new types of risks because their outputs can vary and evolve, unlike more traditional software-enabled devices. An August 18, 2026, discussion paper (“Considerations for the regulation of GenAI-enabled medical devices”) discusses potential regulatory considerations for GenAI-enabled medical devices. 

On Tuesday, August 25, 2026, the U.S. Department of Justice (DOJ) announced that Deloitte LLP and several of its subsidiaries agreed to pay, collectively, $21.5 million to resolve allegations that Deloitte violated the False Claims Act (FCA) by failing to comply with new anti-discrimination requirements incorporated into its federal contracts, by discriminating against employees and applicants on the basis of race and sex, and by allocating and seeking reimbursement for costs related to those practices under its federal government contracts. This resolution is the second of its kind under DOJ’s recently launched Civil Rights Fraud Initiative, following a similar settlement by IBM in April 2026.

Enbrel (etanercept) is one of the best-selling biologic drugs in the United States, approved to treat rheumatoid arthritis and other serious inflammatory conditions. Etanercept was launched as Enbrel in 1998 as a treatment for moderate to severe rheumatoid arthritis, and was later approved to treat additional inflammatory diseases including plaque psoriasis, psoriatic arthritis, ankylosing spondylitis, and polyarticular juvenile idiopathic arthritis.  

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in United States v. Florida Medical Associates, LLC, – F.4th –, 2026 WL 2581886 (11th Cir. Sept. 1, 2026) (the “Zafirov appeal”) overturning the district court and holding that the qui tam provisions of the False Claims Act (“FCA”) do not violate the Appointments Clause of Article II of the United States Constitution because relators are not officers of the United States that occupy “continuing positions.” The Eleventh Circuit did not reach other arguments made by the parties and remanded the case to the District Court for the Middle District of Florida to address two other constitutional arguments challenging the FCA’s qui tam provisions based on Article II’s Vesting and Take Care Clauses. 

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) jointly issued a final rule that, for the first time, gives the term “unsafe or unsound practice” a binding regulatory definition.[1] With it came a uniform standard for Matters Requiring Attention (MRAs) and revised OCC examination manuals.[2]The Federal Reserve did not join the rulemaking, but has adopted comparable standards through guidance. What that means for holding companies and state-chartered institutions is addressed below.[3] The regulation takes effect November 2, 2026, and the revised OCC examination manuals took effect upon their issuance on August 27.

On August 20, 2026, the College Sports Commission (CSC) released a memorandum outlining how its Department of Investigations (DOI) is approaching enforcement of name, image, and likeness (NIL); revenue sharing; and roster limit rules. The memo signals that the CSC’s enforcement apparatus is fully operational and that Division I institutions should prepare for direct investigative engagement.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List — established through the Secure and Trusted Communications Networks Act — to include foreign-produced connected power inverters and advanced robotic devices, following an executive branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products without an exception or approval.

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

In a significant and unanimous ruling, the D.C. Circuit upheld the Environmental Protection Agency’s (“EPA”) final rule designating perfluorooctanoic acid (“PFOA”) and perfluorooctanesulfonic acid (“PFOS”) as “hazardous substances” under the Comprehensive Environmental Response, Compensation, and Liability Act (“CERCLA”), denying the petitions of seven industry groups seeking to overturn that designation.[1] CERCLA, also known as the “Superfund Statute,” allows EPA to require potentially responsible parties to fund cleanup of hazardous substances.

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.

Algorithmic pricing tools commonly used by businesses to increase efficiency and profits are under increasing antitrust scrutiny. This summer, federal regulators, state attorneys general, and state legislatures grappled with competing businesses providing nonpublic, competitively sensitive data to common algorithmic platforms. The Third Circuit deepened an emerging circuit split with the Ninth Circuit on algorithmic pricing liability, reviving antitrust claims against Atlantic City casino-hotels in a decision with direct implications for any company that uses a common pricing platform. See Crowell’s recent client alert. And New Jersey enacted two landmark laws—the FAIR Act and the Fair Price Protection Act—directly regulating algorithmic rent-setting and surveillance pricing. See Crowell’s recent client alert.

A recent U.S. Court of Federal Claims (COFC) decision serves as an important reminder that when the Government Accountability Office (GAO) denies a protest, this is not necessarily the end of the road. Often, contractors retain the right to file a new protest at the COFC, which conducts its own de novo review of the procurement record. This so-called “second bite at the apple” protest is a powerful tool as the COFC’s recent decision in Chugach Logistics & Facility Services JV, LLC v. USA makes clear.

On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement.

On August 21, 2026, the Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) published three coordinated final rules that eliminate – from a regulatory perspective – federal contractor affirmative action requirements for women and minorities and narrow contractor affirmative action requirements regarding individuals with disabilities. The final rules: (1) formally rescind the implementing regulations for Executive Order (EO) 11246 effective October 26, 2026; (2) narrow Section 503 affirmative action requirements regarding individuals with disabilities, generally effective September 21, 2026; and (3) update VEVRAA coverage thresholds and enforcement procedures effective September 21, 2026.

On August 13, 2026, the Centers for Medicare and Medicaid Services (CMS) published its final rule banning the use of federal funds — through Medicaid and the Children’s Health Insurance Program (CHIP) — to pay for gender-affirming care for children and youth. The final rule takes effect October 13, 2026 (“Prohibition on Federal Medicaid and Children's Health Insurance Program Funding for Sex-Rejecting Procedures Furnished to Children”). While CMS finalized several key elements of its late-2025 proposed rule (Client Alert December 24, 2025), the proposed Medicare hospital Condition of Participation rule remains in proposed form.

A Virginia federal court recently delivered a useful reminder for trade secret owners: a missing NDA is not automatically fatal if the company can show it treated the information as genuinely confidential. In WeightPack, Inc. v. Mitchell, No. 3:25-cv-927 (E.D. Va. July 23, 2026), the court denied a former employee’s motion to dismiss trade secret claims under both the Defend Trade Secrets Act (DTSA) and the Virginia Uniform Trade Secrets Act (VUTSA). The court held that the employer had plausibly alleged reasonable measures to protect secrecy even though the employee never signed a nondisclosure or confidentiality agreement.

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

On August 12, 2026, the White House released a National Security Presidential Memorandum (NSPM), marking a seismic shift in U.S. cybersecurity policy and establishing a framework to authorize private-sector companies to conduct offensive cyber operations—historically strictly prohibited by federal law—against foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs).  It builds on an executive order issued in March 2026 that directed federal agencies to develop plans to combat cyber-crimes against Americans.