Insights

As of November 4, 2026, the state attorney general elections point to increased enforcement in 2027, particularly in consumer protection, antitrust, AI, health care, and data centers.[1] Businesses should prepare for more investigations under existing laws and proposals for new legislation or rules. Campaign commitments indicate priorities, but their timing and implementation remain uncertain.[2]

On October 29, 2026, the Federal Trade Commission (FTC) and attorneys general from Colorado, Florida, Illinois, Iowa, Nebraska, Oklahoma, and Utah, joined by Los Angeles County Counsel and the San Francisco City Attorney, sued Toast over allegedly deceptive advertising, hidden fees, and cancellation barriers. The bipartisan lawsuit shows that federal, state, and local regulators continue to work together on consumer protection, including claims involving business customers. Like the Seek Capital, First American Payment Systems, and newly announced Riverside Payments matters discussed below, the Toast case concerns allegedly misleading sales claims, unexpected costs, and difficulty canceling services, this time in restaurant technology.

The Centers for Medicare and Medicaid Services (CMS) is proposing significant changes to the way Affordable Care Act (ACA) health insurance exchanges verify consumer eligibility before federal subsidies are made available.  

The U.S. Food & Drug Administration (FDA) recently issued final guidance — Regulatory Considerations for Prescription Drug Use-Related Software (PDURS) — to address when and how software disseminated by (or on behalf of) sponsors fits into existing drug-labeling requirements. The agency describes this as a response to longstanding uncertainty and a push toward a clearer, more consistent approach across FDA’s drug and device centers. 

On October 29, 2026, the U.S. Department of Labor’s (DOL) Employee Benefits Security Administration (EBSA) issued a 350-page final rule requiring providers of pharmacy benefit management services and their affiliated brokers and consultants to disclose fees and compensation received to fiduciaries of covered large, self-insured ERISA group health plans. According to DOL’s accompanying fact sheet, the disclosures will give employers more visibility into the payments PBMs may receive from various sources and help fiduciaries evaluate and monitor arrangements over time. 

Recent sustain decisions by the U.S. Government Accountability Office (GAO) in Fluor Federal Solutions, LLC and Reliance Test & Technology send a clear message: when an agency tries to fix a Procurement Integrity Act (PIA) violation by committing a second one, the cure can be just as fatal as the disease. The cases involved the U.S. Air Force’s $1.8 billion procurement for O&M services at Elgin Air Force Base. During discussions, the Air Force inadvertently released a pricing overview slide with all offerors’ bottom-line evaluated costs to Reliance Test & Technology, which immediately notified the agency of the error. In response, the Air Force decided to level the playing field by providing the same information to all the other offerors in the procurement, stating, “[o]fferors may consider this disclosure in their [final proposal revision].”

On 8 October 2026, Crowell & Moring, King's College London, and the Competition Law Center at George Washington University co-hosted the 7th EU Competition Law Conference at De Warande in Brussels. Mark Meador, Commissioner at the US Federal Trade Commission (FTC), delivered the opening keynote address, followed by four panels bringing together practitioners, regulators, academics, and in-house counsel to discuss the latest developments in EU, UK, and US competition law enforcement. Among other things, the panels examined algorithmic pricing; the European Commission's (Commission) new guidelines on exclusionary abuses under Article 102 TFEU (Article 102 Guidelines); the impact of dominant positions in merger reviews; and lessons from the enforcement of the Digital Markets Act (DMA) and the UK’s Digital Markets, Competition and Consumers Act. 

The Ruling, in Plain Terms 

A recent GAO decision,  Encon Desbuild JV4, LLC, highlights a critical pitfall for contractors: GAO dismissed as untimely a protest filed within 10 days of a “debriefing” because the debriefing was not “required” under GAO’s precedent and the applicable regulations.  This was true even though the contracting officer incorrectly told the contractor that the debriefing was required and provided under FAR part 15. 

On October 20, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division announced a new whistleblower rewards initiative, the Fraud Whistleblower Incentive Program (WHIP). Assistant Attorney General Colin M. McDonald issued a directive earlier this month directing Division leadership to design and implement policies and programs that incentivize whistleblowers to bring forward credible information pertaining to fraud. The new WHIP incentive pays awards of $10,000 to $30,000 for qualifying tips at or around the time criminal charges are filed or unsealed, rather than years later at case resolution.

On 27 October 2026, the UK Ministry of Defence (“MOD”) published UK Defence Footprint 2026 (the “Footprint”), bringing together defence spending and industrial initiatives, including previously announced investments, and setting out planned defence spending of £298 billion over the next four years. On the same day it published the Footprint, the UK government published an announcement outlining the Warsaw Defence Plan, the first phase of cooperation under the UK-Poland Security and Defence Partnership Treaty, including on drones, cyber security and defence procurement. Together, they highlight two complementary priorities: strengthening the UK’s defence industrial base and deepening cooperation with its allies. 

On October 19, 2026, President Trump signed an executive order (EO) titled “Advancing Women’s Health to Improve Outcomes in All Phases of Life,” establishing new federal infrastructure dedicated to improving women’s health research, clinical translation, and coordinated policy leadership. The EO creates a White House Women’s Health Task Force and directs the U.S. Department of Health and Human Services (HHS) to establish a new Women’s Health Division within the National Institutes of Health (NIH).  

One of the two landmark climate-disclosure laws California enacted in 2023 has its first reporting deadline in just over two weeks, amid continued uncertainty regarding its constitutionality.  

The LCIA's 2025 Annual Casework Report contains a finding that should command the attention of any business with commercial exposure to Africa or the Middle East. Participation from the Middle East and North Africa (MENA) rose to almost 15% of the LCIA's caseload in 2025, and the UAE alone is now the third most represented jurisdiction globally, overtaking every non-Anglophone jurisdiction in the world.[1] That shift did not happen in isolation. It coincided with the entry into force of the Arbitration Act 2025 (the 2025 Act) — the most significant reform of English arbitration law in a generation — and a dramatic surge in parties deploying the LCIA's procedural toolkit more aggressively than ever before.[2]

A proposed rule published October 20, 2026, outlines a framework that would require Medicare Advantage (MA) plans to verify and update their provider directories at least once every 90 days, report an accuracy score to the Centers for Medicare and Medicaid Servies (CMS), and publicly post it on their directories. CMS says the proposed changes will improve data connectivity and accuracy in provider directories across the health care system. 

On October 16, 2026, the U.S. Centers for Medicare and Medicaid Services (CMS) issued a proposed rule implementing key sections of the Consolidated Appropriations Act (CAA) of 2026, Section 6224 (“Modernizing and Ensuring Pharmacy Benefit Manager Accountability”). The agency also proposes a conforming change mandated by section 6219 of the CAA (“Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals”) that would reduce the generic-drug copayment from $1 to $0 for full-benefit dual eligible individuals. Comments to the proposed rule are due December 15, 2026.   

On October 16, 2026, the United States District Court for the District of New Hampshire denied Coca-Cola Beverages Northeast, Inc.’s motion to dismiss the U.S. Equal Opportunity Employment Commission’s (EEOC) Title VII sex discrimination lawsuit arising from a women-only company-sponsored event. The Court held that the EEOC had “plausibly met” the applicable legal standard “by pointing to missed networking opportunities, the potential deprivation of paid time off, and the denial of perks including a company-paid hotel stay, food, and beverages.” This ruling is a clear sign that employer-sponsored events limited to employees of one sex carry legal risk, even when the employer’s intent is to address workforce imbalances or attendance at the event does not lead to measurable advantages. 

Crocs, Inc. recently filed a petition for a writ of certiorari before the U.S. Supreme Court (No. 26-421), asking the Court to review and resolve the question: “Whether an agency disposition is final as to some issues, thus triggering deadlines for judicial review, while other issues decided in the same disposition remain subject to further executive or administrative review.”

The life sciences sector is uniquely vulnerable to the inherent risks of AI-generated evidence in drug development and discovery. This client alert focuses on five core challenges: hallucinations, skewed predictions from unrepresentative training data, the opacity of AI reasoning, input sensitivity that undermines reproducibility, and adversarial manipulation of training data. To address these risks, companies should use experimental validation and human oversight as the common legal and regulatory safety net. This entails among other measures auditing AI outputs, characterizing training data, and structural oversight. Companies also should prepare for evolving frameworks and guidance from the U.S. Food and Drug Administration (FDA) and the European Union (EU) that address use of AI in drug discovery and development .  

New Federal Acquisition Supply Chain Security Act (FASCSA) orders from the Department of Homeland Security (DHS), the Department of War (DoW), and the Director of National Intelligence (DNI) require the exclusion and removal of products and services by DeepSeek and its affiliated entities (collectively, DeepSeek).1 The DoW and DNI orders are laid out in their entirety within the SAM.gov downloadable spreadsheet of FASCSA orders, and neither provides details about the reasons for excluding or removing DeepSeek. By contrast, the civilian order, published on October 20, 2026, identifies DeepSeek’s free open-source artificial intelligence (AI) models as “present[ing] multiple threat vectors.” These include threat vectors associated with the company’s known technical vulnerabilities, obligation to provide the government of the People’s Republic of China certain access, and the fact that information collected by the company’s apps and AI models could be used to create “actionable intelligence” about the U.S. government.