LS CIO Digest – May 31, 2026
Life Sciences CIO Weekly Digest — Powered by Leadership Inklings

IQVIA’s 75% Phase I AI Benchmark Is Now Your Board’s Investment Question

Plus: FDA loses three leaders in 72 hours, COINS Act moves toward biotech, and cyber insurers are raising the bar on life sciences terms

Week of May 25–31, 2026  ·  ~13 min read  ·  Compiled with Perplexity and Claude AI.

Three independent forces converged this week to define the strategic agenda for life sciences technology leaders heading into summer: the first large-scale empirical validation of AI in drug discovery, a 72-hour leadership collapse at the FDA that left all three top regulatory positions simultaneously in acting status, and a congressional push to bring $136 billion in China biotech deals into a national security review framework. Each requires a decision or a readiness assessment before Q3 planning closes.


🤖 AI & Data

Two analyses from May converge on the same governance imperative: as agentic AI moves from pilot to production, the observability infrastructure required in regulated environments does not yet exist at most organizations — and IQVIA’s first credible Phase I benchmark will accelerate board pressure to deploy at scale regardless.

Agentic AI Without Observability Infrastructure Is a “Disaster Waiting to Happen” — Two CIO.com Analyses Frame the GxP Requirement

CIO.com analyses published May 19 and May 27 articulate the governance infrastructure now required as life sciences organizations move agentic AI into production across clinical, commercial, and manufacturing workflows — and the gap between what organizations have built and what regulated environments require is widening with each new deployment.

What happened:

  • The May 19 analysis defined a three-category AI classification: personal productivity (low risk), workflow support (moderate risk), and agentic action — agents that can initiate or influence operational outcomes — requiring explicit ownership, immutable activity logs, human approval thresholds, and defined escalation paths; the May 27 analysis added that agents should be “continuously verified rather than fully trusted,” with governance engineered into the architecture itself
  • Any agentic system operating in a GMP-relevant workflow — batch releases, safety signal flagging, regulatory document generation — must meet the validation standard of 21 CFR Part 11 and ICH Q10; most commercial agentic platforms do not provide the audit trail, version control, and exception handling infrastructure required out of the box

Why it matters to you:

  • Most life sciences AI governance programs have ethics policies and model registers — but relatively few have operational observability dashboards tracking what agents are doing and when outputs deviate; proliferation of agentic deployments across clinical, commercial, and manufacturing creates simultaneous compliance exposure across multiple regulated data domains
  • The ZS CDIO finding that only 40% of AI pilots reach scaled production, combined with IQVIA’s Phase I data below, means the governance gap is now a competitive cost, not just a compliance risk — organizations that cannot operate agents in validated environments are leaving measurable discovery advantage unrealized

📋 What to Watch: Inventory all agentic AI deployments in production or advanced pilot, mapped against the data assets each agent can access; for any deployment touching GxP-relevant workflows, treat the absence of validated observability infrastructure as a material compliance risk requiring Q3 remediation.

IQVIA Publishes the First Large-Scale AI Drug Discovery Dataset — 75% Phase I Success Rate Is Now Your Board’s AI Investment Benchmark

The IQVIA Institute’s May 13 analysis extending its Global R&D Trends 2026 report provides the first systematically grounded dataset on AI-enabled drug development outcomes — derived from IQVIA’s own clinical intelligence infrastructure, not vendor-claimed projections — and produces a 75% Phase I success rate for AI-enabled emerging biopharma programs.

What happened:

  • The AI advantage is concentrated in Phase I (candidate selection and early attrition reduction) — at Phase II, AI-enabled programs tracked on par with non-AI peers, signaling that downstream clinical operations and trial design are the next domain where AI must create measurable advantage; 15–20 AI-originated candidates are expected to enter pivotal trials in 2026
  • The global AI drug discovery market is projected to grow from $1.94B (2025) to $2.6B (2026) toward $16.5B by 2034 — figures boards and finance teams are now citing; for smaller EBPs unable to replicate hyperscaler deal scale, cloud-native platforms like AWS Amazon Bio Discovery (launched April 2026) provide an on-ramp to AI-enabled discovery without a dedicated AI COE

Why it matters to you:

  • Organizations not deploying AI screening in early-stage candidate selection are systematically accepting higher attrition rates — a claim now supported by independently sourced data that will appear in board AI investment discussions; CIOs need to be ready to answer the ROI question in IQVIA’s terms before the next planning cycle
  • The Phase II parity finding is a direct planning input for clinical informatics roadmaps: AI advantage in discovery does not automatically extend downstream, making clinical operations and data management the next investment priority — not additional discovery tooling

📋 What to Watch: Circulate the IQVIA 75% Phase I figure to finance and portfolio management teams before your next AI investment review; use the Phase II parity finding to prioritize clinical AI infrastructure as the next investment wave after discovery tooling.


⚖️ Regulatory & Policy

The FDA story dominates — but the COINS Act development deserves immediate attention from any life sciences organization with active China biotech relationships.

FDA Loses Commissioner, CDER Director, and CBER Director in 72 Hours — Acting Officials Now Hold All Three Top Regulatory Positions

In an extraordinary 72-hour sequence beginning May 12, Commissioner Makary resigned, acting CDER Director Høeg was removed, and acting CBER Director Szarama was simultaneously replaced — leaving Kyle Diamantas (a lawyer with no prior public health experience) as Acting Commissioner, Michael Davis as acting CDER Director, and Karim Mikhail (a former Merck executive) heading CBER. Morgan Lewis published formal legal analysis May 27 confirming that the 210-day statutory clock is running on all three acting appointments, placing a December 2026 expiration on the current leadership.

What happened:

  • CDER (authority over NDAs, BLAs, accelerated approvals, and complete response letters) and CBER (cell and gene therapies, vaccines, blood products) are now simultaneously held by acting officials — a configuration Capital Alpha Partners called “unprecedented”; the permanent commissioner search has not yet produced a named candidate as of May 31, and permanent recruitment is expected to be difficult given the political environment
  • BioSpace confirmed May 26 that the National Priority Voucher program, one-trial requirement reform, and real-time clinical trial initiative are continuing; STAT News reported that acting Commissioner Diamantas has earned unexpected respect from career FDA staff and key stakeholders

Why it matters to you:

  • Organizations with active or planned CDER and CBER submissions face increased information requests and potential resequencing of meetings; organizations with PDUFA action dates in the August–December 2026 window face the highest risk, as the acting leadership situation will be either resolving or transitioning again in that same period
  • The FDA’s career scientific staff is continuous through the political churn and formal review timelines continue running — but decision-making on novel or complex applications may face informal delays; direct engagement with division-level review teams may be more productive than Commissioner-level advocacy during the transition

📋 What to Watch: Place FDA guidance tracking, advisory committee schedules, and CDER/CBER communication on elevated monitoring cadence through December 2026; for pending Type A or Type B meetings, assess whether to request them proactively before new acting directors settle in, or defer until leadership stabilizes.

Congress Formally Pushes to Add Biotech to the COINS Act — $136 Billion in U.S.–China Life Sciences Deals Under Treasury Scrutiny

House Select Committee Chairman Moolenaar sent a formal letter to Treasury Secretary Bessent on May 21 urging biotechnology’s designation as a “prohibited technology” under the COINS Act of 2025, citing approximately $136 billion in cross-border out-licensing deals between U.S. pharma companies and Chinese biotech firms in 2025 and flagging four transaction categories: pharmaceutical IP licensing, drug discovery platform access, clinical R&D capabilities, and biologics manufacturing know-how.

What happened:

  • The COINS Act (enacted December 18, 2025, in the FY2026 NDAA) currently covers AI systems, semiconductors, quantum computing, and hypersonic systems — not biotechnology; Section 809 gives the executive branch discretionary authority to add sectors without new legislation; Treasury has until March 2027 to finalize implementing regulations, with civil penalties up to twice the transaction value and criminal penalties up to $1 million for willful violations
  • Fierce Biotech’s May 25 analysis with attorney Laurie Burlingame identified the “NewCo” structure — U.S. VCs forming biotechs on Chinese-licensed assets with sub-50% Chinese equity — as the deal type most immediately vulnerable; joint ventures are already a core covered transaction category under existing COINS Act text

Why it matters to you:

  • Life sciences organizations with active in-licensing arrangements, joint ventures, or platform access agreements involving Chinese companies — particularly AI drug discovery platforms where proprietary biological data flows into Chinese-origin models — face potential exposure; even pure cash licensing deals without equity may be drawn in depending on how Treasury defines covered transactions
  • A COINS Act compliance build-out is analogous in scope to GDPR data mapping or SOX controls: cross-functional work spanning legal, BD, IT, data governance, and enterprise risk management — infrastructure that takes months to build; organizations with active NewCo vehicles should engage legal counsel before Treasury initiates public comment, likely Q3–Q4 2026

📋 What to Watch: Work with general counsel and BD leadership now to inventory all existing and contemplated agreements involving Chinese counterparties in the four Moolenaar-flagged categories; complete this before Treasury’s Q3–Q4 2026 public comment process so your organization can design compliance infrastructure proactively, not reactively.


🔒 Cybersecurity & Risk

Two developments this week — the formal close of the West Pharmaceutical recovery and a structural shift in life sciences cyber insurance underwriting — together define the new baseline for pharma supply chain cyber risk management.

West Pharmaceutical’s Unit 42 Full Containment Letter Issued May 27 — The 23-Day Recovery Arc Is Your Supply Chain BCP Reference Scenario

On May 27, Palo Alto Networks Unit 42 issued its Full Containment Letter for West Pharmaceutical Services, confirming the unauthorized activity that began May 4 has been fully contained — formally closing the crisis that disrupted 50+ global manufacturing sites and making West the most detailed public ransomware recovery case study for a pharma supply-chain manufacturer. West has confirmed no material financial impact to 2026 guidance; forensic investigation into the scope of exfiltrated data remains ongoing.

📋 What to Watch: Use the 23-day arc — intrusion May 4, SEC disclosure in 3 days, operational restoration in 16, forensic close in 23 — as your supply chain BCP stress-test: can your operations sustain a strategic packaging or delivery device supplier offline for 3+ weeks? If not, that gap belongs in Q3 planning.

Life Sciences Cyber Insurance Underwriters Are Changing the Terms — IT/OT Segmentation and GMP Data Integrity Plans Are Now Renewal Prerequisites

Three major medtech incidents in 12 weeks — Stryker (March), Intuitive Surgical (March), and West Pharmaceutical (May) — have prompted specialty cyber insurance underwriters to move validated IT/OT segmentation and GMP-specific incident response documentation from advisory recommendations to underwriting prerequisites for life sciences coverage above $50 million, per insurance market analysts cited in the Bizjournals analysis.

What happened:

  • Verizon’s 2025 DBIR found third-party involvement in confirmed breaches doubled from 15% to 30% in a single year; IBM’s 2025 Cost of a Data Breach Report placed pharma sector average breach cost at $4.61 million — a figure that does not capture batch destruction costs under ALCOA++ requirements or FDA 483 observations for data integrity failures if GMP batch records are compromised during an incident
  • For CDMOs and pharma packaging suppliers, underwriters now require documented evidence that GMP-relevant systems — LIMS, MES, batch release systems, and electronic batch records — are protected by validated integrity controls and ALCOA+ data recovery procedures; policies that previously covered blanket cyber losses may now exclude GMP batch destruction losses if the insured cannot demonstrate data integrity was maintained throughout the incident

Why it matters to you:

  • The Nitrogen ransomware group’s May 13 attack on Foxconn — 8TB and 11 million files exfiltrated, including from medical device and diagnostic instrument customers — illustrates the supply chain tier below the OEM where design and firmware information creates downstream exposure for life sciences organizations using GxP instruments in regulated environments
  • CDMOs and CROs facing cyber insurance renewal now face a binary outcome: produce IT/OT segmentation validation documentation and GMP-specific recovery procedures, or face coverage exclusions or materially increased premiums — not advisory feedback

📋 What to Watch: Engage cyber insurance brokers 90 days before renewal — not 30 — to complete IT/OT segmentation validations and GMP data integrity incident response documentation; organizations that cannot produce this evidence at renewal face coverage exclusions or materially increased premiums as a near-term reality.


🏢 Leadership & Operating Model

Two legislative developments signal federal intent to address the bio-literate talent gap that pharma CIOs name as their second-biggest AI scaling constraint — while the COINS Act creates new compliance operating model requirements that will need IT infrastructure to execute.

Two Bipartisan Biotech Workforce Bills Introduced — Federal Investment Is Coming, But the Bio-Literate AI Talent Gap Is Acute Now

MassBio’s May 28 policy update reported the introduction of two bipartisan House bills: the Biotechnology Workforce Alignment Act (McCormick/Khanna) directing NSF to align research priorities with workforce development, and the Federal Biotechnology Workforce Assessment Act directing OPM to define and assess the federal biotech workforce — both framing bio-literate talent as a national security competitiveness issue against China’s state-led biotech expansion.

What happened:

  • The Alignment Act creates industry-education-government partnership frameworks that could generate NIH-funded training programs and SBIR/STTR-eligible workforce projects; historically, similar legislation has translated into academic-industry partnerships that life sciences CIOs can engage through university relations and government affairs teams
  • The ZS CDIO survey found talent and skills as the second-highest constraint (58% of respondents) blocking AI scale in life sciences — specifically the intersection of AI/ML capability with regulated biology domain knowledge: scientists who can validate AI outputs against GxP standards and AI product owners with GMP deployment experience

Why it matters to you:

  • Federal investment through NSF and OPM frameworks addresses the supply deficit on a 5–10 year horizon; the near-term talent acquisition strategy must explicitly target the “bio-literate AI” profile — competed for simultaneously by pharma companies, hyperscalers building life sciences verticals, and AI-native biotech startups — at compensation levels that reflect that competition
  • Organizations can engage university relations teams now to position for the academic-industry partnership frameworks the bills would create — getting ahead of formal program design rather than responding to published RFPs

📋 What to Watch: Monitor the Biotechnology Workforce Alignment Act through your government affairs team; audit current job requisitions for bio-literate AI profiles to confirm your compensation is competitive — federal programs are years away, but the talent market is moving this quarter.

COINS Act Biotech Expansion Creates a New IT Compliance Program — Transaction Screening, Data Segregation, and Reporting Infrastructure Required

While the COINS Act’s regulatory trajectory is covered in the Regulatory section, the operating model and technology implications deserve separate treatment: if Treasury implements COINS Act regulations including biotechnology, life sciences organizations will need compliance infrastructure that does not exist in most BD/legal/IT architectures today.

What happened:

  • A COINS Act compliance program is analogous in scope to GDPR data mapping or SOX controls: cross-functional work spanning legal, BD, IT, data governance, and enterprise risk; the highest-risk data flows involve AI drug discovery platform agreements where proprietary biological data is uploaded into Chinese-origin platforms — these may constitute covered national security transactions under an expanded COINS Act
  • Even if full prohibition does not materialize, a notification pathway for NewCo vehicles and equity-backed licensing arrangements requires deal tracking, government reporting protocols, and data segregation capabilities that need IT system configuration and validation — infrastructure that takes months to build

Why it matters to you:

  • CIOs at companies with active NewCo vehicles or Chinese AI drug discovery platform access agreements need to engage legal counsel before Treasury initiates public comment — waiting for final guidance creates a compressed implementation window with maximum regulatory scrutiny
  • The compliance program design requires technology infrastructure decisions — transaction classification systems, data room documentation standards, ongoing monitoring dashboards — that are CIO-scope, not solely legal or BD scope

📋 What to Watch: Inventory all existing and contemplated agreements with Chinese counterparties in the four Moolenaar categories before Q3 2026; design transaction classification, data room documentation, and ongoing monitoring infrastructure proactively — not as a reactive response to Treasury guidance.


💡 Editor’s Perspective

  • The IQVIA 75% benchmark and the agentic AI observability gap are two sides of the same problem. The Phase I data validates AI investment at the board level, creating pressure to deploy at scale. The governance gap means organizations deploying at scale without validated observability infrastructure are building compliance debt in direct proportion to their AI ambition. These are not sequential challenges — they are simultaneous, and both land in the CIO’s office.
  • The FDA leadership vacuum and the COINS Act expansion are coinciding at the worst possible moment for regulatory strategy. Organizations that need FDA engagement on complex applications are doing so with acting officials whose institutional authority is uncertain — while simultaneously being asked to assess whether their China biotech partnerships are about to become national security transactions. Both require elevated monitoring cadence through at least December 2026.
  • West Pharmaceutical’s 23-day recovery arc and the cyber insurance underwriting shift tell the same story. The attack surface for life sciences technology organizations extends to every packaging, delivery device, and ancillary materials supplier. Insurers reached this conclusion before most pharma BCP plans were updated. The question is not whether a critical supplier will experience an extended cyber disruption, but whether your continuity planning accounts for it.
  • The biotech workforce legislation and the COINS Act operating model requirement converge on the same organizational gap. Congress is building supply-side infrastructure for bio-literate AI talent on a 5–10 year horizon. The COINS Act compliance build-out needs cross-functional talent — legal, IT, data governance, enterprise risk — intersecting life sciences domain knowledge right now. Federal programs are years away; the talent market is moving this quarter.

🔗 Top 5 Must-Read Links

  1. IQVIA Institute: Credible Signal on AI-Enabled Programs, May 13, 2026 — Primary source for the 75% Phase I success rate; the most rigorously sourced AI drug discovery performance dataset in circulation and essential reading before any board AI investment discussion.
  2. The FDA Group: FDA Leadership Changes Tracker (Current as of May 20, 2026) — Clearest current-state summary of the FDA leadership roster; bookmark for regulatory affairs IT teams monitoring the impact on active submissions and CDER/CBER meetings.
  3. Fierce Biotech: Will COINS Act Kill China Biotech Licensing Boom? (May 25, 2026) — Best single-source analysis of COINS Act expansion risk for life sciences; includes NewCo structure legal assessment from attorney Laurie Burlingame and transaction category breakdown.
  4. West Pharmaceutical Services: Company Impact Updates (Full Containment, May 27) — Primary source for the Unit 42 Full Containment Letter; the definitive reference scenario for life sciences supply chain ransomware recovery and BCP planning.
  5. CIO.com: The AI Governance Imperative You Can’t Afford to Ignore (May 27) — Most actionable current-cycle governance template for life sciences CIOs building production agentic AI oversight infrastructure; essential for any organization with agents in or approaching GxP workflows.

The decisions that matter most this week don’t require new technology investment — they require clarity about what you have deployed, who owns it, and whether it can withstand a regulatory or legal inquiry. The FDA vacuum, COINS Act exposure, and cyber insurance shift all share the same test: when the question comes, is your documentation ready? If any of these threads are live in your portfolio, hit reply — this community is most useful before a decision is made, not after.

Ready to move beyond the digest? The LS CIO Community is where these conversations continue.

Join the LS CIO Community →


This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice.

Until next week,

Joe Miller

Founder, Leadership Inklings

Keep Reading