Cybersecurity, AI Governance & Digital Risk

• Identifying the clinical trial data, patient data, research data, genomic data, pseudonymized datasets, IP and real-world evidence that create the greatest cyber, privacy, biosecurity and geopolitical exposure
• Strengthening controls around who can access sensitive life sciences data and how that data may be used, shared or repurposed
• Balancing AI, real-world evidence and advanced analytics opportunities with stronger safeguards for patient trust, proprietary information and sensitive research assets
• Reducing downstream risk by tightening oversight of secondary use, vendor access, cross-border transfers and AI-generated outputs before an incident or dispute arises

• Navigating GDPR, cross-border transfer rules and evolving privacy requirements while enabling secure use of patient, clinical and research data
• Reducing CRO and vendor risk by strengthening due diligence, accountability and oversight across the research ecosystem
• Clarifying sponsor, CRO and third-party responsibilities for vulnerabilities, incidents, data handling and regulatory exposure
• Building scalable third-party risk strategies that support global research collaboration without weakening security, privacy or operational control

• Tabletop 1: Protecting Clinical Trial and Research Data in an AI-Driven Environment
• Tabletop 2: Managing CRO, Vendor and Cross-Border Research Risk
• Tabletop 3: Responding to Cyber, Privacy and Biosecurity Threats Across the Life Sciences Enterprise

• Mapping how FDA, HHS, NIH, BARDA and DoD expectations are converging around cybersecurity, AI governance, data stewardship, research security and biosecurity preparedness
• Aligning AI-enabled medical devices, clinical decision support tools and software-as-a-medical-device strategies with FDA expectations for safety, validation, documentation and lifecycle oversight
• Protecting patient, clinical and research data by strengthening HIPAA compliance, data-sharing controls and responsible AI use across regulated operations
• Preparing for federal funding, public health and biosecurity scrutiny by addressing research integrity, supply-chain resilience and sensitive data governance
• Managing federal contracting and DoD-related cybersecurity obligations by tightening CMMC readiness, supplier controls and protections for sensitive government and research data

• Safeguarding genomic, phenotypic, clinical and real-world datasets that create lasting privacy, cyber, IP and biosecurity exposure
• Tracking state genomic privacy laws, the DOJ Bulk Sensitive Personal Data Rule, research security requirements and growing scrutiny of foreign access to health and genomic data
• Controlling access to sequencing data, biobanks, proprietary algorithms and research collaborations before sensitive assets are reused, transferred or exposed
• Clarifying ownership, licensing, training rights and derivative-use restrictions when genomic datasets are used to build or validate AI models
• Enabling precision medicine and AI-driven research while maintaining defensible governance across legal, privacy, compliance, security and research teams

• Protecting clinical trial data, patient data, research assets and AI training datasets from unauthorized access, cyber threats and data leakage
• Tracking clinical trial data flows across sponsors, CROs, vendors, trial sites and cross-border systems to maintain control over approved uses
• Building scalable privacy and cybersecurity controls for multinational trials while managing country-specific requirements and operational complexity
• Preparing for cyber incidents that could disrupt study timelines, compromise data integrity, affect patient trust or trigger regulatory scrutiny

Apply the LAB’s key lessons in a fast-moving life sciences crisis involving cyber risk, sensitive data, supplier exposure, clinical trial disruption, AI governance and biosecurity concerns. Working in table teams, attendees will pressure-test how legal, compliance, privacy, cybersecurity, procurement, clinical operations and business leaders should respond when patient trust, research continuity, contracts and organizational reputation are all on the line.

Each table will work through one scenario and report back with key decisions, blind spots and practical takeaways.

• Assessing a critical supplier flagged under emerging biosecurity concerns while balancing regulatory obligations, contractual commitments and business continuity
• Responding to a suspected CRO data compromise while evaluating notification duties, investigation steps, vendor accountability and legal exposure
• Managing clinical trial disruption while protecting patient safety, preserving data integrity and minimizing delays
• Containing potential exposure of sensitive patient and research data while addressing privacy, cybersecurity, litigation, communications and regulatory risk

Learn where human review meaningfully reduces risk and where it simply creates false comfort. This session will focus on practical controls for ensuring AI oversight is tied to real decisions, consequences and accountability.

• Determining when a human should approve, monitor, audit or be removed from a process based on risk, consequence and decision type
• Designing escalation thresholds, exception handling and intervention triggers that activate human involvement before errors become business, legal or customer-impacting events
• Operationalizing oversight by defining reviewer responsibilities, authority, response times, documentation requirements and audit trails

DORA, NIS2, the Cyber Resilience Act and the EU AI Act are creating overlapping expectations around resilience, product security, third-party risk, AI governance, documentation and accountability. This session will help U.S. companies identify where they can build common controls instead of treating each mandate as a separate compliance project.

• Mapping where DORA, NIS2, the Cyber Resilience Act and the EU AI Act overlap across governance, documentation, resilience and accountability
• Preparing for heightened scrutiny of digital operations, critical ICT providers, subcontractors and supply chains
• Managing the complexity of NIS2 implementation as EU member states move at different speeds and create uneven compliance obligations
• Assessing how the Cyber Resilience Act changes expectations for secure-by-design products, vulnerability management and software lifecycle controls
• Translating EU AI Act requirements into practical processes for AI classification, procurement, oversight and documentation

• Strengthening vendor contracts with enforceable security standards, AI-use restrictions, fourth-party controls and risk-based obligations
• Using audit rights more effectively to verify vendor controls, trigger deeper reviews and avoid disputes after an incident
• Allocating financial risk through indemnity, liability, insurance and recovery provisions that hold up when a vendor failure creates exposure
• Coordinating the first 72 hours of a third-party incident by improving notice, cooperation, evidence access, investigation support and regulatory readiness

Organizations increasingly face multiple reporting obligations triggered by the same incident, each with different timelines, thresholds and stakeholders. This session focuses on how to manage overlapping disclosure obligations, coordinate decision-making under pressure and build scalable reporting processes that stand up to regulatory scrutiny.

• Reconciling CIRCIA, SEC disclosure requirements, state breach notification laws, sector-specific obligations and contractual reporting commitments when reporting clocks start simultaneously
• Building escalation and decision-making protocols that help legal, security, privacy, communications and executive teams determine what must be reported, when and to whom
• Managing conflicting definitions of materiality, covered cyber incidents, notification triggers and reporting thresholds across regulatory and contractual frameworks
• Coordinating internal investigations and fact gathering while preserving the ability to meet reporting deadlines as new information emerges

As AI agents become embedded in business operations, organizations must manage tools that can access sensitive data, execute workflows, interact with third parties and act with increasing autonomy. This session will focus on how legal, privacy, cybersecurity, compliance and business teams can enable agentic AI while maintaining control over security, accountability and liability.

• Defining ownership, escalation paths and decision-making authority for AI agents that can act across enterprise systems
• Reducing security and privacy risk by tightening controls around data access, permissions, identity, monitoring and sensitive information handling
• Negotiating stronger vendor protections around data ownership, model training, sub-processors, audit rights, incident coordination and accountability for agentic services
• Managing the shift from content risk to action risk as AI agents create new concerns around unauthorized decisions, unintended outcomes and operational disruption

• Reducing enforcement and False Claims Act exposure tied to cyber self-attestations, certifications and contractual representations
• Tracking evolving CMMC timelines while continuing to strengthen cybersecurity maturity and federal contracting readiness
• Strengthening internal oversight of cyber representations before they are submitted to customers, prime contractors or government agencies
• Documenting policies, controls, exceptions and remediation efforts that support defensible compliance positions
• Aligning federal cyber requirements with AI adoption, vendor oversight and operational priorities without creating new contract or certification risk

• Identifying where employees are using AI tools, automated workflows and unauthorized platforms outside approved governance channels
• Protecting sensitive data from unintended exposure through stronger access controls, data segmentation and acceptable-use rules
• Creating practical approval pathways that allow business teams to use AI without bypassing legal, privacy, cybersecurity and compliance safeguards
• Monitoring AI use across the enterprise to detect risky behavior, reinforce accountability and reduce unauthorized data sharing
• Turning shadow AI insights into a more scalable governance strategy that supports innovation without losing control

Test your organization’s ability to respond when ransomware, AI-enabled threats, legal exposure, regulatory reporting, insurance, vendor risk and business continuity collide. In this capstone tabletop, attendees will work through high-pressure decisions and benchmark how legal, cybersecurity, privacy, compliance, communications, insurance and business teams should respond in the first critical hours of a modern attack.

• Identifying gaps in escalation, governance, decision-making and response planning before a ransomware incident occurs
• Evaluating how AI-enabled threats are changing attacker speed, sophistication, detection and response strategy
• Managing legal, regulatory, insurance, contractual and indemnity decisions while the facts are still developing
• Coordinating internal and external stakeholders across legal, cybersecurity, privacy, communications, business, vendors, insurers and law enforcement
• Benchmarking practical steps to strengthen readiness, reduce exposure and improve outcomes before the next crisis