Insights

Do you want your startup to expand and become a major player in your industry? If so, you will most likely need to seek capital from outside investors to help you build infrastructure and fulfill orders.

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in U.S. ex rel. Zafirov v. Florida Medical Associates LLC, holding that the qui tam provisions of the False Claims Act are constitutional because relators are not officers of the United States who occupy continuing positions established by law. The decision overturned the 2024 district court ruling that sparked a wave of constitutional challenges to qui tam suits and aligns the Eleventh Circuit with the Fifth, Sixth, Ninth, and Tenth Circuits on the issue. The constitutional debate is far from over, however, as the decision is limited to the constitutionality under the Appointments Clause. The court remanded the case for further evaluation of the parties’ Take Care and Vesting Clause arguments. At the same time, similar constitutional arguments are pending in the Third Circuit, related to the largest-ever FCA judgment in a non-intervened case, and multiple Supreme Court justices have already signaled potential willingness to weigh in on the qui tam provisions’ constitutionality. Crowell's FCA attorneys explain these developments and what's next in a “Feature Comment” published in The Government Contractor.

On September 15, 2026, the U.S. Court of Appeals for the Fifth Circuit issued a significant decision in East Fork Enterprises, Inc. v. EPA, vacating EPA’s 2024 methylene chloride risk management rule and the underlying revised unreasonable-risk determination under Section 6 of the Toxic Substances Control Act (TSCA). The court granted the industry petitioners’ challenge, denied Sierra Club’s petition, and remanded the matter to EPA.

The FTC notched a recent win in federal court, securing a permanent injunction halting the combination of the two dominant brands of construction adhesives, Loctite and Liquid Nails.  In the recently unsealed decision, the court focused on the extensive head-to-head competition between the parties and the importance of brand equity in siding with the FTC, offering important lessons for merging parties.   

The U.S. Department of Health and Human Services’ (HHS) Office of Research Integrity (ORI) published its long-anticipated Guidance on Generative Artificial Intelligence in August. The guidance explains how generative AI (GenAI) use is evaluated under the revised research misconduct regulations (42 CFR Part 93), which took effect January 1, 2025, and became applicable to new allegations on January 1, 2026. The new guidance builds on prior guidance documents regarding the definitions of fabrication, falsification, and plagiarism, as well as revised evidentiary standards. As of April 30, 2026, institutions were required to have compliant policies on file with ORI as part of their annual report covering 2025. 

On September 21, 2026, the Small Business Administration announced an extension of the comment period for two previously proposed rules that, as currently constructed, would significantly expand the pool of entities eligible to qualify for small business set-aside procurements. The extension is slated to be formally published on September 24, 2026.  While the comment period was originally to close on September 21, in response to requests for additional time, SBA has extended the comment period for an additional 60 days with comments now due by November 20, 2026.

The UK government has launched a consultation that could fundamentally change the UK’s corporate reporting framework. The consultation was published on 7 September 2026 and closes on 30 November 2026. 

When federal law enforcement agencies issue subpoenas to companies for information about their customers, the subpoenas or cover letters often contain boilerplate nondisclosure language. This language generally directs companies not to notify those customers and implies that there may be legal consequences for doing so. But as two lawmakers recently called out in a formal letter to the U.S. Supreme Court and the U.S. Government Accountability Office (GAO), this boilerplate language may not carry the force of law.

In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

Part Two of a Two-Part Client Alert Series. This Alert builds on the discussion in Part One, which surveyed Bear Creek (2017), Copper Mesa (2016), South American Silver (2018), Eco Oro (2021), and Lupaka (2025).

September 2026 marks the first anniversary of the corporate criminal offence of failure to prevent fraud coming into force under section 199 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA). The Home Office guidance recommends that organisations review their fraud prevention measures at least every 12 months.

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

The General Services Administration (GSA) has begun sending out email notifications of a “known glitch” affecting certain System for Award Management (SAM) registrations as far back as spring 2026.  

Between 2021 and 2025, Medicaid spending on ABA therapy grew six times faster than the number of children who received services, making it one of the fastest-growing areas of Medicaid expenditure, according to CMS. On August 4, 2026, CMS released a toolkit to help state Medicaid and CHIP agencies strengthen their programs and limit fraud, waste, and abuse tied to increased demand for ABA therapy. In 2025, Medicaid spent about $10 billion on ABA and related therapy services for children with ASD — a dramatic increase from the $2 billion spent in 2021. 

The U.S. Government Accountability Office’s (GAO) recent decision in Viderity Inc.—Costs, B-424422.5, Sept. 1, 2026, offers useful insight into what constitutes a legally sufficient conflict of interest investigation. The decision arose in an unusual procedural posture: Viderity initially protested, alleging that an agency evaluator had a personal conflict of interest. After the agency took corrective action, Viderity filed a cost entitlement claim requesting that GAO direct the agency to reimburse Viderity’s protest costs. In evaluating that claim, GAO assessed whether Viderity’s underlying protest ground was “clearly meritorious.”

Until recently, Belgian law did not have a general regulatory framework for internal investigations. Companies wishing to conduct an investigation had to navigate a fragmented set of rules that covered general principles and, to a limited extent, privacy and employee rights. The application of these rules to internal investigations was not clear, and it was therefore often difficult to put the rules into practice. This legal vacuum created significant risks, both for the integrity of the investigation itself and for the admissibility of any evidence gathered. 

Over the past several years, the biopharmaceutical industry has embraced artificial intelligence and machine learning (AI/ML) in near lockstep with the pace of AI/ML innovations. Today, industry leaders are using AI/ML to, among other things: discover and assess biological pathways, target chemical structures and sequences; design proteins; model pre-clinical and clinical trials; recruit and screen potential patient populations; evaluate clinical trial results and biomarker data; prepare regulatory filings; and manage supply chains. Deployment of new AI/ML models promises extraordinary advances in pharmaceutical development. However, as with any technological and scientific advances, the use of AI/ML also poses substantial legal risks that life sciences companies need to consider and proactively manage. 

On September 8, 2026, the U.S. Department of Labor's (DOL) Employee Benefits Security Administration (EBSA) issued “Field Assistance Bulletin No. 2026-03” to clarify compliance with the Mental Health Parity and Addiction Equity Act (MHPAEA) and nonquantitative treatment limitations (NQTL). Under the 2013 final rule implementing MHPAEA, health plans and issuers must use comparable processes, strategies, evidentiary standards, or other factors when applying NQTLs and they cannot apply such methods more stringently to benefits for mental health and substance use disorder (MH/SUD) compared to benefits for general medical and surgical care. While the bulletin doesn’t break much new ground on compliance, it does reaffirm existing enforcement priorities and expectations. 

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

This Alert, the first in a two-part series, surveys the legal landscape at the intersection of two issues that increasingly shape the outcome of mining and natural resources disputes regarding the protections available to foreign investors under investment treaties, as enforced through Investor-State Dispute Settlement (ISDS). The first is the prior consultation obligation imposed on States under the Indigenous and Tribal Peoples Convention, 1989 (No. 169), adopted by the International Labour Organization (ILO 169). The second is social license, the practical acceptance of a project by surrounding communities, which is distinct from but related to the formal State consultation duty. This Alert examines these issues across five foundational ISDS decisions: