|
The FDA Just Dropped Its CIO Title The regulator split IT from AI. For some CIOs that’s a warning. For others it’s an opening. Life Sciences CIO Weekly • Coverage: October 19 to October 25, 2026 FDA eliminated its CIO title this week and handed its technology and AI agenda to a deputy commissioner. That’s a regulator reorganizing because AI is changing the work, and the rest of the week shows how fast that change is coming:
Yet Gartner found only 13% of CIOs see significant value from AI, and Bain found only 16% of sponsors and CROs redesigning roles around it. The tools are arriving faster than most organizations are adapting to them. 🔍 The Quick Read
Reading something a colleague should see? Forward the whole edition or copy the section that fits their world. If this reached you from someone else, subscribe free here to get every edition, plus access to the back archive. 📌 This Week’s LeadFDA eliminates its CIO role and moves tech and AI to a deputy commissioner ↗The regulator now separates running IT from leading on technology and AI. On October 20, Pink Sheet reported that FDA’s recent reorganization eliminated the chief information officer position (Pink Sheet). Sanjay Sahoo, who held the CIO role, now leads a new Office of Mission Information Technology Services on an acting basis. The agency’s technology push sits with Jared Seehafer, FDA’s first deputy commissioner for technology and AI and a former CEO of regulatory software firm Enzyme (ExecutiveGov). The same week, Seehafer was the technology voice on FDA’s new guidance for drug companion apps. 💬 Joe’s Take: Whether a split like FDA’s reads as a warning or an opening depends on how the company already sees its CIO. If you’re seen as the manager of the old model, there may still be time, but you need to move fast. Replace the warnings-and-roadblocks message with the one your CEO and board want to hear: “I can lead this and help us capture the gains while managing the risk.” Then prove it with early AI wins in lower-risk areas that still deliver real ROI, starting with your own boss, usually the CEO or CFO. If you’re highly regarded and the split hasn’t happened yet, make it yourself. Appoint a strong leader to run IT and step into the forward-looking technology and AI role, with day-to-day operations reporting to you. FDA built that same structure, with a technology and AI leader on top and IT operations beneath. Its former CIO now runs the operations side. What to watch: Sponsor conversations on submissions, real-time review pilots and AI tools will now run through Seehafer’s office. 🤖 AI & DataOpenAI buys Orchestra Bio and moves into drug development operations ↗A model maker now wants the coordination layer that trial and planning software has owned. On October 20, OpenAI confirmed it bought Orchestra Bio, a San Francisco startup whose AI agents keep drug programs on track (SiliconANGLE). The agents watch studies, budgets and schedules. If a failed batch threatens a trial, they work out which timelines slip and weigh the options, and people decide. Orchestra joins Rosalind, OpenAI’s life sciences unit, whose model is already used by Amgen, Moderna and Novo Nordisk. Terms were not disclosed. Veeva shares fell on the news (GuruFocus). 💬 Joe’s Take: I’d start with a function-by-function fit assessment of what this kind of tool does against what your current platform does well. Broad platforms like Veeva are hard to beat at their core, but the further they stretch, the thinner they tend to get at the edges. An AI-first orchestration layer that coexists with Veeva could shore up those weak spots, and it may cover areas Veeva doesn’t touch at all. Veeva is building its own agents too, with its Falcon platform opening to early adopters in November, so ask three questions before you simply wait for it. Is this close enough to Veeva’s core strengths for it to be the best option? What will it add to an already significant Veeva bill? And do you want to deepen your dependence on any single platform vendor and give up even more negotiating leverage? What to watch: Which trial management and ERP connections OpenAI ships, and where agent recommendations get recorded. AstraZeneca and Oracle connect real-world data to trial recruitment ↗The value here depends on data from routine care, not on molecules. On October 20, AstraZeneca and Oracle signed a non-binding term sheet to use AI and real-world data for trial recruitment, earlier diagnosis, drug safety monitoring and real-world evidence (pharmaphorum). The first program, in Abu Dhabi with health company M42, will find patients with uncontrolled high blood pressure. More projects are planned in the U.S., Europe and the Middle East, each set up with local governments to meet data rules. No financial terms were disclosed (Alliance News). What to watch: Where de-identification happens, and how safety signals from routine care reach your safety team without duplicate case work. Lilly and Astellas add AI design partners worth about $1.5 billion combined ↗On October 19, Lilly agreed to pay Hong Kong-listed METiS TechBio up to $1.1 billion to design lipid nanoparticles that deliver drugs beyond the liver (Fierce Biotech). Two days later, Astellas signed a deal worth more than $400 million with AI Proteins for computer-designed miniproteins (Fierce Biotech). In both deals, small upfront payments carry large milestones. What to watch: A shared data model for partner experiments, and where a Hong Kong partner fits with Treasury’s new proposal below. ⚖️ Regulatory & PolicyFDA finalizes its rules for drug companion apps ↗What an app tells patients is now treated as drug labeling. On October 20, FDA issued final guidance on software that drug sponsors provide with their medicines (FDA). Apps paired with a device, such as an inhaler app, should generally be described in the prescribing information. Standalone apps, such as dose reminders and symptom trackers, belong there only if they are essential for safe use or show clinical benefit. Otherwise their content is generally promotional. Seehafer said companion apps are “moving beyond simple dose reminders toward tools that adapt to each patient.” The guidance also covers AI-enabled software (Orrick). 💬 Joe’s Take: This is one to watch closely. As I read it, the line that matters is when a companion app moves from reporting information to guiding how a patient uses the medicine, because that can affect outcomes. At that point the product is really software and drug together, and I’m not sure most organizations have decided where that responsibility sits. A practical first step is to list every companion app you have and sort them into those that only inform and those that guide dosing or use. The second group needs a named owner before its next release. What to watch: How FDA treats generative AI features that write patient-facing text. Treasury moves to curb U.S. biotech investment in China, including software ↗The covered list names bioinformatics and lab automation tools, not only molecules. On October 22, Treasury proposed adding biotechnology to the sectors covered by the COINS Act, which limits U.S. investment in China and other countries of concern (BioPharm International). The list includes bioinformatics tools and software for automated scientific discovery. It covers equity stakes, joint ventures and new facilities. Pure licenses may fall outside, but the exception does not cover transfers of technology or know-how. STAT called the proposal “more aggressive than anticipated” (STAT). Comments are due December 7. 💬 Joe’s Take: I’d give the CIO a defined role in these deals rather than a seat for the whole process. Start by handing business development and legal a short guidance document that spells out when IT needs to be involved and which questions IT will need answered. The most important one is what access the partner needs into your systems and data. The CIO should confirm that the scope matches what the partner actually needs and goes no further, and that the company can restrict that access and revoke it quickly if the situation calls for it. Once a deal looks likely, the CIO answers the guidance questions for that partner and sits down with legal and business development to review the relevant parts of the proposal. 📋 What IT should ask in a partner deal
Adapted from Matchpoint Partners and Morgan Lewis. What to watch: Any China-linked joint ventures or NewCos that touch bioinformatics, lab automation or AI discovery before December 7. EMA sets out data quality standards for adverse event reports ↗On October 20, the European Medicines Agency (EMA) opened consultation on a draft chapter of its data quality framework covering how adverse drug reaction reports are collected, managed and submitted (LexisNexis). It measures reliability, completeness, consistency, timeliness and relevance. Comments are due December 14. Many companies now use AI to take in, code and sort these reports. What to watch: How your AI-assisted case processing scores against the draft measures. EMA drafts platform trial guidance and opens the door to wearables ↗On October 19, EMA released a draft paper on confirmatory platform trials, which test several treatments under one protocol and add or drop arms over time (RAPS). A separate concept paper will weigh wearables as evidence in blood pressure trials. Comments on both close January 31. What to watch: Whether randomization, supply and data systems can add and drop arms without workarounds. FDA says generative AI device guidance is months away ↗FDA’s comment period on generative AI medical devices closed October 19 with more than 500 submissions. Rick Abramson of FDA’s Digital Health Center of Excellence said draft guidance will follow “in a matter of months” (MedTech Dive). Hospital and physician groups argued that makers, not providers, should monitor these devices after launch (MedTech Dive). What to watch: Monitoring for AI performance after launch as a maker’s job. 🔒 Cybersecurity & RiskMicrosoft ties the ConnectWise backup breach to a China-aligned group ↗A trusted app with wide Microsoft 365 access was the way in. On October 15, attackers used a stolen vendor credential for ConnectWise Cloud Backup to sign into 173 customer Microsoft 365 environments (The Hacker News). On October 21, Microsoft linked the campaign to Storm-0940, a China-aligned group that targeted hundreds of organizations, including chemical and manufacturing firms, with an AI-capable attack tool (Reuters). ConnectWise’s CEO said its fixes do not remove access already set up inside customer accounts. What to watch: A list of third-party apps with tenant-wide permissions, and whether Microsoft Graph activity logging is on. Quest discloses unauthorized access to its lab ordering platform ↗On October 22, Quest Diagnostics told the SEC that an outside party had accessed patient records in its Quanum Lab Services Manager, which clients use to order tests and get results (8-K filing). Quest said operations were not materially disrupted. Device maker Fisher & Paykel Healthcare also reported access to two employee email accounts. MedTech Dive counts at least seven medtech makers with cyber incidents this year (MedTech Dive). What to watch: Whether any trial or diagnostic work touches Quest’s client portals, and what sponsor data could be in scope. CISA flags a default setting in InterSystems IRIS for Health ↗On October 22, the Cybersecurity and Infrastructure Security Agency (CISA) warned that InterSystems IRIS for Health ships with encryption turned off by default, which could expose data in transit (CISA). Sponsors, CROs and real-world data firms use IRIS to move clinical data. InterSystems advises setting connections to “Required,” not just “Enabled.” What to watch: IRIS instances run by your CROs and data vendors. The fix is a setting change, so it can move quickly. AdvaMed will write industry cybersecurity standards ↗On October 19, AdvaMed chairman and ResMed CEO Mick Farrell said the group will develop standards for cybersecurity, privacy and interoperability, like a code of ethics, to “raise the bar of the whole industry” (MedTech Dive). AdvaMed is also building forums for chief information security officers. What to watch: Whether the standard covers ERP and order systems, where several 2026 attacks hit hardest. 🎯 Leadership & Operating ModelGartner: only 13% of CIOs see significant value from AI ↗The leaders are the ones with rules for when to stop. On October 19, Gartner released its survey of 2,002 CIOs (Gartner). Only 13% said AI has delivered significant or transformational value, and about one use case in five succeeds. 31% have rules for when a pilot should not go live, and 17% have rules for retiring AI already in use. Those with such rules are more than twice as likely to lead. Only 4% plan to redesign roles for people working with AI agents. Gartner’s Alicia Mullery said, “Volume is not value.” Gartner also forecast that 2027 IT spending will rise 15%, with memory costs staying high (Gartner). 💬 Joe’s Take: Plenty of AI pilots and small projects are already running, but I haven’t seen many life sciences companies retire one yet. It’s early days, and most CIOs are still building governance and aligning their organizations while that work is underway. We’re now in a world of rapid prototyping combined with token costs that grow with every run, so the exit rules can’t wait. Manage every pilot and project as one portfolio, and set a cost ceiling, a success measure and a review date at kickoff so the ones trending toward failure stop early. That discipline is what makes the early wins credible. What to watch: A 2027 budget that prices AI by actual usage, since Gartner says AI costs are set at run time. Bain: only 16% of sponsors and CROs are redesigning roles around AI ↗On October 21, Bain published a survey of 120 clinical trial professionals (Bain). 49% are piloting AI without changing any roles, and 16% are redesigning roles and workflows. Bain argues that asset teams should own the work, with functions as homes for expertise, and that AI should get more freedom in discovery than in clinical and manufacturing work. What to watch: Whether IT product teams start organizing around assets instead of departments. Boehringer puts IT and business services under one leader for AI ↗On October 22, Boehringer Ingelheim and Microsoft announced work on digital patient twins, computer models that could reduce the number of patients needed in control groups (Microsoft). Boehringer says it aims to become a “Frontier AI company.” The effort is led by Harsha Deshmukh, the board member responsible for both IT and global business services, who said AI adoption “depends on more than technology alone.” What to watch: A different answer from FDA’s: one leader owning both the technology and the process redesign. 💬 The Bottom Line — Joe’s TakeIs the org chart really the problem? I’d say it’s often a convenient answer. I hear CIOs and other leaders reach for a reorg when the real issue is where they spend their own time and attention. Even the structure I suggested earlier in this edition comes second. What matters is leaders stepping out of maintaining the present and leading their companies into the future, and with AI moving this fast, that can’t wait. Joel Barker showed in The Business of Paradigms how the way we’ve always done things filters what we can see. His best-known example is the Swiss watchmakers, who invented the quartz watch, dismissed it, and lost most of their market to the companies that embraced it. Building a bigger kingdom for the CIO misses the point. The right answer might even be a technology leader with no direct reports at all. Take a blue-sky look at how your company should run today, let go of the sacred cows, and draw the chart last. |
|
Further reading: Joel Barker on paradigms. As an Amazon Associate I earn from qualifying purchases. |
|
Ready to move beyond the digest? The LS CIO Community is where these conversations continue. How this is made: each edition is researched two ways in parallel, once with Perplexity and once with Claude, then reconciled into a single verified brief before Joe adds his take. This digest is an interpretive summary of publicly available information and does not constitute legal, regulatory, cybersecurity, or investment advice. Until next week, Founder, Leadership Inklings |