Chai Raises $400M as FDA Sends Its First AI Warning Letter

AI drug discovery hits “deployment” the same week it draws its first cGMP enforcement. Introducing a new feature, Joe’s Take, on what it means for IT leadership.

Life Sciences CIO Weekly • Coverage: July 13–19, 2026

A quick note before we dive in. Starting this week, the digest carries a new feature called Joe’s Take: short notes where I add a practitioner’s read on the stories that matter most, drawn from years leading IT in biotech, biopharma, and pharma. The aim is to turn the week’s headlines into something you can use in this week’s staff meeting.

One theme frames the week. The pace of AI in life sciences is exposing a gap that no CIO can close alone. Reimagining IT from a keep-the-lights-on service into a strategic partner, properly funded and with the leadership role elevated to match, is a decision the whole company has to make. It is not a challenge to hand to the CIO. The stories below show why that decision gets more urgent by the week.

🤖 AI & Data

Chai Discovery raises $400M to fuel antibody AI used by Lilly, Pfizer, Novartis

San Francisco-based Chai closed a $400M Series C at a $3.8B valuation, its third round in under a year, with a paying base of Lilly, Pfizer, and Novartis and a new argenx partnership announced July 15. Its Chai-2 model claims a 16% hit rate in de novo antibody design, roughly 100x better than earlier computational methods. CEO Joshua Meier says AI drug discovery has moved “from promise to deployment.”

💬 Joe’s Take: When R&D wants to license an engine like this, the temptation for IT is to weigh in on how good the solution is. Resist it. That’s their call, not ours. My first questions are about security and controls: how does this plug into our R&D data and internal systems safely? Lead with “let’s find the fastest safe path to what you want,” not a stop sign. Our job is to enable the bet, not grade it.

AI-discovered drugs face a clinical reality check

A July 17 BioPharma Dive analysis found few AI-discovered drugs have reached the clinic. They tend to outperform in Phase 1, but that edge does not reliably hold in later-stage trials. Bright spots (Insilico’s rentosertib into Phase 3; Recursion’s REC-4881) sit alongside failures (Verge’s ALS candidate; two Recursion setbacks). The pattern so far is that AI de-risks and accelerates early discovery but has not yet proven it clears the late-stage efficacy bar.

💬 Joe’s Take: The “what did all this AI spend buy us?” question that may come from the CEO should not land on the CIO’s desk after the fact. If it does, governance failed up front. These are not technology decisions, and the tech lead does not own the benefit. They are shared bets the CEO and the exec team approve together. Set that governance early, and the reality-check question gets answered before it is ever asked.

Insilico signs $177M CNS pact with China Medical System

Insilico’s second CMS deal in five months, worth up to $177M plus royalties for a mass-market CNS indication identified by its PandaOmics platform, extends a remarkable licensing streak (Lilly, SK Biopharm, Servier, Takeda, and more). One AI engine, plugged into partner after partner. It is the buy-versus-build question CIOs will keep being asked.

Other AI signals this week

An OpenADMET competition concluded that better data beats bigger models for drug-metabolism prediction. Deep Origin won a $31.7M ARPA-H contract to build an FDA-qualifiable “virtual human” in-silico platform. And OpenAI-backed Biossil bought a failed antibiotic for $500K to test the AI drug-rescue thesis, a reminder to retain and structure legacy R&D data as a monetizable asset.

⚖️ Regulatory & Policy

FDA’s first AI-focused cGMP warning letter

FDA cited Purolea Cosmetics Lab for using AI to generate SOPs, product specifications, and master batch records without adequate quality-unit review, then rejected the excuse that “the AI agent never identified the requirement.” Regulatory counsel framed it as a traditional cGMP action in which AI removed human oversight, and expects cross-center AI-for-GMP guidance within one to two years.

💬 Joe’s Take: The failure here was not AI. It was letting AI output into the record on the assumption it is complete and correct. The fix mirrors what labs have done for decades: layered review. Make level one an AI agent whose job is to play devil’s advocate, trained on the regulatory questions a quality unit or inspector would ask, poking holes in the first AI’s work. Level two is the human, verifying that the adversarial pass actually happened and then doing the review only a human can. After that, keep the old disciplines: spot-checks and periodic deep-dive audits of the whole system, including the AI that wrote the document.

CDER adds AI computer-software-assurance guidance to its 2026 agenda

Among four new topics, the most significant for IT and quality leaders is a supplemental guideline on computer software assurance (CSA) for AI-based systems used in drug manufacturing and clinical investigations. It signals that FDA will extend its risk-based CSA framework explicitly to AI/ML in GxP settings.

💬 Joe’s Take: The first move costs nothing and gets skipped anyway. Sit down with your regulatory and quality leads, make sure everyone understands what is coming, and build a plan to support it before the guidance is final. This is where the CIO, or head of AI, earns the “change agent” part of the title. You are not taking on more ownership than you should. You are leading the plan.

EMA publishes consolidated ICH E6(R3) Good Clinical Practice guideline

The unified GCP text now makes sponsor oversight of service providers and computerised systems an explicit, documented duty, with a dedicated data-governance section requiring validated systems, audit trails, and traceability. Annex 2 (decentralized and real-world-data elements) takes effect in the EU on January 15, 2027. Map your clinical-data and system controls against it now.

Also on the regulatory radar

FDA’s draft MDUFA commitments for FY2028 through 2032 emphasize AI-enabled technology and real-world evidence, with tight comment deadlines. And the EU tightened safety-feature audit-trail access while Swissmedic advanced eCTD v4.0 (technical target: end of 2026).

🔒 Cybersecurity & Risk

Abbott investigates two simultaneous intrusions: vishing-to-SSO and a portal breach

ShinyHunters claims a mid-June voice-phishing attack compromised a Microsoft Entra SSO account and pivoted into connected SaaS (ServiceNow, SharePoint, Databricks, Coupa) at Abbott’s Cancer Diagnostics unit, the same playbook used against Medtronic, Stryker, and others. A second actor claims a separate breach through a third-party-hosted customer portal.

Ransomware pivots from hospitals toward pharma and health-tech vendors

A Comparitech tracker found H1 2026 healthcare ransomware up 14%, but attacks on healthcare businesses and vendors (pharma manufacturers, health-tech, billing) jumped 36% while direct-care providers rose just 3%. The most active groups were Qilin, The Gentlemen, LockBit, and INC. With the stricter HIPAA Security Rule slipped to July 2027, CIOs cannot wait. Self-adopt MFA, penetration testing, and formal risk analysis now.

Also this week

The Chaos group listed CDMO Aphena Pharma Solutions, claiming 142GB exfiltrated (unverified), which is a supply-chain exposure for every sponsor that outsources to them. And a joint NSA/CISA advisory (AA26-194A) flagged a Russian FSB router-targeting campaign that explicitly named healthcare, with a KEV remediation deadline on end-of-life Cisco gear. Legacy, flat plant-floor networks are exactly the target.

🏢 Leadership & Operating Model

KPMG Global Tech Report finds a persistent life sciences AI value gap

Surveying 124 life sciences tech leaders, KPMG found a segment whose digital initiatives generate less than 1% of revenue, what it calls a “maturity plateau.” Its prescription is to move from project-based delivery to a product operating model, and to let no AI pilot proceed without a validated path to production and a ringfenced integration budget.

💬 Joe’s Take: KPMG’s “move from projects to a product model” prescription assumes an IT org with room to breathe. Most don’t have it. They are underfunded and pinned to keeping the lights on, running change on thin project budgets. The block isn’t that leaders can’t grasp the product model. It’s that no one has resourced or reimagined IT to make the leap. And that is not an IT problem to solve alone. It is the company deciding whether IT is a cost center or a strategic partner.

AI leadership consolidates at Edwards Lifesciences and Merck KGaA

Edwards hired Parminder Bhatia (ex-GE HealthCare CAIO) to build an “AI, Product and Platforms” org for regulated device software. Merck KGaA’s Walid Mehanna now leads a roughly 300-person centralized data-and-AI function with formal ethics governance and a 36,000-user internal GPT suite. Two credible but very different operating-model templates.

Also on the move

Parexel elevated Boris Braylyan to Chief Data & Digital Officer. GSK named Nikita Popov SVP of R&D Technology Transformation, embedding tech leadership inside R&D. And Dr. Reddy’s rehired a Global Head of IT Infrastructure & Operations, a reminder that infrastructure resilience, not just AI, stays board-visible.

💬 The Bottom Line — Joe’s Take

If there is one thread through this week, it is that the winners will not be the companies with the biggest AI org charts. GSK’s and Merck’s models do not transplant into a mid-size biotech. What travels is partnering: pairing IT tightly with R&D or the function in question, backed by a one-time investment to stand it up. That only happens if the company reimagines IT as a strategic partner, funds it accordingly, and elevates the role, and if the head of IT steps up as a business leader rather than only a technologist. It is a shared challenge for CEOs and IT leaders alike, and it is the real work behind every AI headline above.

Ready to move beyond the digest? The LS CIO Community is where these conversations continue.

Join the LS CIO Community →

This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice.

Until next week,

Joe Miller

Founder, Leadership Inklings