|
AI Gets Its Rulebook FDA, HHS and EMA spent the week setting the rails for AI in regulated work Life Sciences CIO Weekly • Coverage: September 28 to October 4, 2026 AI in life sciences got less flashy and more real this week. FDA’s device center put AI lifecycle and change-control guidance at the top of its list. HHS launched a trial program that expects simulations regulators can reproduce. EMA signaled a major rebuild of the EU clinical trials system. Novartis, meanwhile, brought in CAS to standardize and enrich its chemistry data and make it searchable alongside CAS’s reaction library. The theme is simple: the rails for AI in regulated work are being laid, and IT is laying a lot of the track. On the risk side, two actively exploited edge flaws need attention now, and Boston Scientific’s cyber outage now has a price tag. 🔍 The Quick Read
Reading something a colleague should see? Copy the section that fits their world and pass it along, or forward the whole edition. And if this reached you from someone else, you can subscribe free here to get it every week. 🤖 AI & DataNovartis hires CAS to make its chemistry data AI-ready ↗Novartis is turning its reaction records into AI-ready data it can search alongside CAS’s library of about 160 million reactions. On September 29, 2026, CAS (Chemical Abstracts Service), a division of the American Chemical Society, announced a collaboration with Novartis Biomedical Research. Novartis’s experimental reaction data sits across electronic lab notebooks, reports, shared drives and partner platforms. CAS will standardize it using its Intelligence Hub data transformation services, then build Novartis a custom discovery platform on its SciFinder architecture. Researchers will be able to search their own enriched data alongside CAS’s roughly 160 million curated reactions (AllSci). No financial terms were disclosed. Handing that work to a vendor raises its own questions: who owns the enriched data, how proprietary reactions stay separate from a vendor’s platform, and who governs combined internal and external search. 💬 Joe’s Take: This is a smart strategic move by Novartis: put CAS’s expertise and its 160 million curated reactions in front of its scientists. Buying curation can make sense, as long as the company keeps ownership of its data and of the result. What matters most is ownership and no leakage of trade secrets or anything else the company wants kept private. The contract has to draw a hard line between the company’s data and the vendor’s platform, and the safeguards have to stay in force over time, with ongoing monitoring and auditing, not just a signed agreement. What to watch: How much of their own reaction, assay and formulation data peers can actually feed to a model, and what their curation contracts say about ownership. AbbVie brings Valkai’s AI into clinical development ↗AbbVie is aiming AI at clinical operations, where results depend on how well clinical data is connected. On September 29, 2026, AbbVie announced a partnership with Valkai, a life sciences AI platform, to deploy purpose-built AI across targeted areas of clinical research for faster insights and shorter development timelines. Andrew Campbell, M.D., AbbVie’s VP of clinical sciences, said it could cut time spent on manual processes and put more attention on scientific interpretation and clinical strategy. Nicholas Donoghoe, EVP and chief business and strategy officer, tied the move to the rising volume and complexity of clinical data. AbbVie did not disclose financial terms or name the programs involved. What to watch: Which clinical workflows AbbVie turns on first, and whether your own electronic data capture (EDC), clinical trial management (CTMS), electronic trial master file (eTMF) and safety data are connected well enough to support something similar. Xaira shows its antibody-design platform and first pipeline ↗A seven-week de novo design cycle, if it holds, raises the bar for how fast lab and data pipelines must turn. On October 2, 2026, Fierce Biotech reported that Xaira Therapeutics, which launched in 2024 with more than $1 billion, detailed its generative antibody-design platform. CEO Marc Tessier-Lavigne said the main focus is a model that designs antibodies that are drug-ready from the start. Xaira disclosed four preclinical programs, including an oncology candidate designed from scratch in seven weeks and one aimed at a receptor long considered hard to target with antibodies. It is open to applying the platform to partners’ targets. What to watch: AI-native biologics partners arriving through business development, and whether your diligence and data-sharing patterns are ready for them. Roche makes “AI independence” an R&D target ↗Roche now reports AI’s share of portfolio decisions to investors, and peers will be asked for theirs. At its Pharma Day on September 28, 2026, Roche said it is pursuing AI independence in R&D and has started building autonomous, AI-driven labs. Aviv Regev, head of Genentech Research and Early Development, said 40% of pipeline decisions from Q4 2025 through Q2 2026 had a tracked AI or computational contribution. Roche says its Target Nexus tool is on track to contribute to 80% of research portfolio decisions by the end of 2026 (Reuters). What to watch: How Roche defines and audits “AI contribution” to a decision, and who owns the data lineage behind it. ⚖️ Regulatory & PolicyCDRH puts AI lifecycle and PCCP guidance at the top of FY2027 ↗Final guidance would turn model change control, versioning and monitoring into formal operating requirements. On October 1, 2026, the Center for Devices and Radiological Health (CDRH) at the U.S. Food and Drug Administration (FDA) published its proposed FY2027 guidance agenda: 11 final and three draft documents (RAPS). The top finalization priorities are lifecycle guidance for AI-enabled device software (draft from January 2025) and predetermined change control plans (PCCPs; draft from August 2024). A PCCP lets a manufacturer pre-agree with FDA how a product, such as an AI model, can change after clearance without a new submission. PCCP was also a priority last year and was not finalized. CDRH also prioritized a new draft on generative AI conversational devices for mental health. Lower on the list are drafts on device software functions and postmarket cybersecurity management. Comments are due November 30, 2026, to docket FDA-2012-N-1021. 💬 Joe’s Take: It’s good to see AI moving toward the same controls and discipline that have proven themselves over the years in conventional software development and change control. I look forward to seeing what comes back from industry. If you’re a CIO with a stake in this, consider submitting comments by the November 30 deadline so any concerns you have are on the record and addressed going forward. This is a chance to help shape the direction, so use it. What to watch: Whether PCCP is finalized this time, and whether your application lifecycle management (ALM), quality and machine learning operations (MLOps) tools can produce PCCP-grade change records. HHS launches SURPASS for AI-run trials regulators can reproduce ↗HHS wants simulation code, assumptions and outputs documented well enough for regulators to rerun them. On September 30, 2026, the Department of Health and Human Services (HHS) announced SURPASS (Simulation-augmented, Real-time Platform Adaptive Seamless Trials) through the Advanced Research Projects Agency for Health (ARPA-H) (RAPS). It combines a “phaseless” design engine built on digital twins and predictive models, a continuous inference engine that reduces reliance on large control groups, and an agentic layer that automates trial startup and operations. Companion programs cover faster site activation (STACK), national consent and data access (COMMONS) and patient-contributed real-world data (CINCH). HHS said simulation tools, assumptions, code and outputs used for regulatory decisions must be documented and shareable so regulators can reproduce and interrogate them. Solicitation summaries are due by the end of November, with full proposals due January 22, 2027. 💬 Joe’s Take: Here’s a question for fellow CIOs and IT leaders: have you seen anything like this in regulation before? I don’t recall a requirement that an agency be able to rerun a company’s simulations and reproduce its results, or verify work at this level of detail. It makes sense that regulators want that check while AI simulations are changing this fast and the stakes are this high. Still, it’s a level of rigor I haven’t seen before. If you have, I’d like to hear about it. What to watch: Performer selections, any data or consent standards from COMMONS, and whether your statistical computing environment could reproduce a simulation on request. EMA plans a major CTIS rebuild for the Biotech Act ↗The EU’s mandatory trial system of record is heading for new integration points and data models. The European Medicines Agency (EMA) said in highlights from its September Management Board meeting, published October 1, 2026, that the proposed Biotech Act’s clinical trial changes affect about 70% of current Clinical Trials Information System (CTIS) functionality. The changes include faster assessments, more flexible major modifications, risk-based authorization and simplified combined medicine, device and diagnostic studies. The first changes could apply in early 2028, and work on a new CTIS platform is set to start in early 2027. The board has flagged Biotech Act impacts on CTIS since late 2025 (BioXconomy). What to watch: The CTIS roadmap, and 2027 to 2028 budget for integration rework in regulatory operations and clinical IT. E2B(R3) safety reporting is now mandatory ↗FDA now accepts postmarket adverse event reports only in the newer international data format. Since October 1, 2026, FDA requires drug, biologic and combination product manufacturers to send individual case safety reports (ICSRs), the electronic records of single adverse events, in the E2B(R3) format. E2B is the International Council for Harmonisation (ICH) standard for sending these reports electronically, and R3 is its third revision, a restructured and more detailed message. FDA stopped accepting the older E2B(R2) version for postmarketing reports after September 30, so any safety database, contract research organization (CRO) or affiliate still producing R2 files will have its submissions turned away. The same week, FDA also updated Form 356h, used for marketing applications, and Form 1571, used for investigational new drug (IND) applications, to collect data required under its user-fee programs (FDA). What to watch: Acknowledgments and rejection rates from FDA’s submission gateway in the first weeks, including reports sent by CROs and affiliates. 🔒 Cybersecurity & RiskFortiMail and Cisco SD-WAN flaws under active attack ↗Both products sit at the edge of networks that connect plants, labs, partners and regulatory email. On October 1, 2026, Fortinet confirmed that CVE-2026-104286, a critical (9.8) flaw in its FortiMail email security gateway, was exploited as a zero-day. It lets an unauthenticated attacker write files to the device, and the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. Reports differ on whether fixed versions have shipped (BleepingComputer). Fortinet’s workarounds are to disable the identity-based encryption (IBE) feature or cut internet access to the management interface, and it has published indicators of compromise. On September 30, Cisco disclosed active exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager, the console for its software-defined wide area network (SD-WAN) products. It lets an unauthenticated attacker use the management application programming interface (API) as an administrator (The Hacker News). The KEV catalog lists eight Cisco SD-WAN flaws added in 2026. 💬 Joe’s Take: You shouldn’t let this one pass by. These flaws sit at the heart of company infrastructure, and many organizations run these vendors. CIOs should get with their security officers and network engineers now to confirm whether either product is in their environment, and ask their contract development and manufacturing organizations (CDMOs) and managed service providers the same question. If FortiMail is in the mix, apply Fortinet’s workarounds while you wait on a patch. There’s always a long list of urgent work, but this goes near the top. What to watch: Exposure at CDMOs and managed service providers, and the Fortinet advisory for fixed builds. Boston Scientific’s outage gets a price tag as iRhythm notifies patients ↗In both cases the attackers got in through business IT systems. Wells Fargo estimates Boston Scientific’s August 25 cyber incident will cost about $300 million in Q3 sales and roughly $0.13 per share, from eight days of downtime, according to coverage on September 28, 2026. That is an analyst estimate. Boston Scientific reports its own results October 28. The investigation found the attacker came in through one external-facing network device and reached part of the on-premises IT environment, with no evidence of reaching plant-floor controls. Manufacturing, ordering and shipping stopped anyway (Industrial Cyber). On October 2, iRhythm said it had begun notifying people affected by a June breach of third-party-hosted business applications. It reported no impact on its devices or patient safety (SEC 8-K). 💬 Joe’s Take: Never waste a crisis. CIOs and security officers should put reports like this in front of their peer executives to make the case for funding the people, tools and resources it takes to protect the company. Proactive security spending often gets deferred. That may have been tolerable once, but with AI accelerating how fast attackers move, rolling the dice is no longer a defensible strategy. What to watch: Boston Scientific’s October 28 outlook, and which manufacturing execution (MES), enterprise resource planning (ERP) and order-to-ship systems your plants cannot run without. Threat-sharing protections survive the September 30 sunset, until December 11 ↗Legal cover for sharing threat data with peers and government now runs about 10 more weeks. The stopgap funding law signed September 2 took effect October 1, 2026. It extends the Cybersecurity Information Sharing Act of 2015 through December 11, keeping liability and antitrust protections for companies that share threat indicators (Federal News Network). Industry groups warned a lapse would have undermined GOLD EAGLE, a new government-industry clearinghouse for fixing vulnerabilities. What to watch: Whether your sharing agreements with the Health Information Sharing and Analysis Center (Health-ISAC) and peers have a fallback if the law lapses in December. 🎯 Leadership & Operating ModelPhRMA names Eric Cantor CEO, and he names AI on day one ↗The industry’s main policy voice now lists AI among its priorities. On September 29, 2026, the Pharmaceutical Research and Manufacturers of America (PhRMA) named former House Majority Leader Eric Cantor its next president and CEO, effective November 9. He succeeds Stephen Ubl, who has led PhRMA since 2015 and stays on as an adviser through January 15. Cantor said he wants to expand patient access and use the promise of AI to speed discovery (Fierce Pharma). What to watch: Requests from government affairs for defensible AI productivity evidence and current input on AI governance and China-linked vendors. BD’s new CIDO starts with an AI supply chain mandate ↗Another large medtech has hired a tech-sector CIO with an operations and AI remit. Arthur Hu took office as executive vice president and chief information and digital officer (CIDO) of BD (Becton, Dickinson and Company) on September 30, 2026, coming from Lenovo, where he was global CIO. CEO Tom Polen tasked him with embedding AI into BD’s work, and has said BD is investing in a standardized digital platform to run AI across its end-to-end supply chain. Hu succeeds Denise Russell Fleming, who retires at year end. What to watch: Hu’s first priorities. FDA commissioner vote slips past the midterms ↗At least another quarter without a confirmed FDA leader. On September 29, 2026, STAT reported that FDA commissioner nominee Heidi Overton will not get a Senate vote until after November 9, and that a single Republican vote could sink the nomination in committee (RAPS). What to watch: Whether agenda items such as final AI device guidance keep moving without a confirmed commissioner. 💬 The Bottom LineThis week’s AI news was mostly about rules and foundations. FDA’s device center put AI lifecycle and PCCP guidance at the top of its list, HHS built reproducibility into its trial program, and EMA began planning a major rebuild of the EU’s clinical trial system. Sponsors kept investing in the groundwork, with Novartis making its chemistry data AI-ready and AbbVie bringing AI into clinical development. On the risk side, two actively exploited edge flaws and an estimated $300 million outage showed again how much exposure sits in business IT. Ready to move beyond the digest? The LS CIO Community is where these conversations continue. How this is made: each edition is researched two ways in parallel, once with Perplexity and once with Claude, then reconciled into a single verified brief before Joe adds his take. This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice. Until next week, Founder, Leadership Inklings |
