Tech Policy & Regulation Weekly — Mar 09, 2026
Photo: kslaw.com
Week of March 9, 2026
The Big Picture
Three regulatory clocks hit zero this week — simultaneously — and most of the policy world is still watching the Iran coverage. The FTC owes the country a statement by Tuesday, March 11, 2026, on whether state AI bias laws are effectively preempted by federal consumer protection law. The FDA is days from a decision on Eli Lilly's oral weight-loss pill that will reset pricing dynamics for the entire GLP-1 market. And BIS just dropped a $95 million enforcement hammer on Cadence Design Systems for funneling chip-design software to a Chinese military lab through a front company — a signal that semiconductor export enforcement has moved from policy speeches to real money. If you work at the intersection of technology and compliance, this is a week to read your inbox before your news feed.
This Week's Stories
⚡ The FTC Has Until Tuesday to Tell the Country What Federal AI Policy Actually Means
Your state's AI bias rules might be about to get frozen — and you'll know by Tuesday, March 11, 2026.
When President Trump signed his AI preemption executive order in December 2025, he buried a time bomb inside it: the Federal Trade Commission must issue a policy statement by March 11, 2026 describing how the FTC Act applies to AI and, critically, when state laws requiring AI systems to alter truthful outputs are preempted by federal law barring deceptive practices. The same deadline requires the Secretary of Commerce to publish an evaluation identifying state AI laws deemed "burdensome" enough to refer to the DOJ's newly created AI Litigation Task Force.
Two deliverables. Same deadline. Tomorrow, March 11, 2026.
Here's what makes this genuinely consequential rather than just procedural. California's SB 53 established first-in-the-nation safety disclosure obligations for frontier AI developers. Colorado's Anti-Discrimination in AI Law takes effect in June 2026. Texas has its own framework in motion. If the FTC issues the statement, advocates say it would provide the DOJ with a legal theory for challenging those laws in court. If the FTC does not issue the statement, the preemption effort could stall and companies would continue navigating the patchwork.
But there's a leverage play beyond litigation. The executive order also instructs Commerce to condition $42 billion in broadband infrastructure funding (the BEAD program) on the repeal of state AI regulations deemed onerous — putting states that enforce AI laws in the position of potentially forfeiting broadband money. That's a real pressure lever even if the preemption theory is legally contested.
A recent enforcement signal adds context: the FTC earlier set aside a 2024 consent order against Rytr, a generative AI company, in what commentators read as the Commission recalibrating what counts as an actionable "deceptive" AI claim. That suggests the substance of Tuesday's publication matters as much as its existence.
Legal reality check: an executive order is not a statute and cannot itself invalidate state law. Companies should continue complying with applicable state AI laws until a court says otherwise. But if both deliverables are published on March 11, 2026, expect state AG responses within hours.
Signal: In motion — FTC statement pending; state laws currently in force and enforceable
Lilly's Oral Weight-Loss Pill Is Days From an FDA Decision That Resets the GLP-1 Market
The next chapter of the obesity drug wars may be written by the FDA this month — and it's as much a drug pricing story as a pharma one.
Eli Lilly expects an FDA approval in March 2026 for oral orforglipron, which the agency already tapped for its National Priority Voucher program — a relatively new FDA mechanism that shrinks review timelines from months to weeks. The oral GLP-1 market is projected to capture around 20% of the $80 billion obesity GLP-1 market by decade's end, and while Novo Nordisk's oral Wegovy has a head start, Lilly's drug showed added success with diabetes patients that could give it a competitive edge.
This isn't just about which pill wins. An FDA approval this month could effectively set the pricing baseline for the next round of Inflation Reduction Act drug price negotiations in this class — new entrants with separate intellectual property can reset the negotiation clock.
Meanwhile, the FDA is squeezing the GLP-1 gray market from the other direction. On March 3, 2026, the agency issued 30 warning letters to telehealth companies for marketing compounded GLP-1 products with false or misleading claims, including implying equivalence to branded drugs like Ozempic and Wegovy. Brand manufacturers are already suing platforms that imply equivalence, combining trademark and false-advertising theories with FDA's enforcement narrative. For telehealth platforms and digital marketers, the risk profile is now both regulatory and civil.
Also on the March docket: a gene therapy for a rare, often-fatal childhood immune disease (severe leukocyte adhesion deficiency-I) where a tiny trial of 9 patients showed 100% survival at 12 months. That decision will test how much evidentiary weight the FDA under Commissioner Makary places on small-trial, high-unmet-need gene therapies — a question with massive implications for the cell and gene therapy industry's investment calculus.
Signal: Finalized, effective soon — PDUFA decision dates imminent
Cadence Pays $95 Million for Routing Chip-Design Software to a Chinese Military Lab Through a Front Company
BIS's settlement database quietly published a blockbuster. The Bureau of Industry and Security imposed a $95 million administrative penalty on Cadence Design Systems for illegal exports of electronic design automation (EDA) hardware, software, and semiconductor design technology to parties on the Entity List — the government's blacklist of foreign entities deemed security risks. A concurrent DOJ agreement adds $45 million in forfeitures.
The details are the signal. Cadence admitted that employees of its Chinese subsidiary knowingly transferred sensitive technology to entities developing supercomputers for China's military and nuclear programs — specifically through a front called "Central South CAD Center," an alias for the National University of Defense Technology. The mechanism — a renamed account used to launder sales to a blacklisted customer — is exactly the playbook BIS is now scrutinizing across the semiconductor design software sector.
This wasn't an isolated action. Reporting this week also flagged a roughly $252 million fine against Applied Materials for alleged unauthorized shipments of semiconductor equipment to China. The pattern is unmistakable: export-control enforcement is moving beyond software into tools and gear, and fines are large enough to change supply-chain economics.
Meanwhile, the compliance landscape keeps getting more complex. The H200 chip export rule that went live January 15, 2026 — shifting certain AI chip exports to China from presumptive denial to case-by-case review — is now generating its first real license applications. BIS updated its Entity List in early March 2026, adding several Chinese firms and tightening the upstream compliance picture. A proposed federal procurement ban on chips from key Chinese foundries by 2027 would force contractors to audit bills of materials. And multiple outlets report the administration is considering a "global gatekeeper" model that would require licenses for advanced AI chips shipped anywhere outside the U.S. — not just to China.
Every EDA, ECAD, and TCAD vendor with Chinese operations should treat Cadence as a stress-test of their own know-your-customer procedures. And every chip company should note: under the AI Diffusion framework, "authorized" IC designer status will expire on April 13, 2026, unless BIS approval applications are filed. Fabless chip designers headquartered in allied countries should treat April 13, 2026 as a hard deadline to have applications submitted.
Signal: In force — final enforcement actions setting precedent; compliance deadlines approaching
The EU AI Act's Labeling Rules Just Got Real — Even as Brussels Debates Buying More Time
If you've been treating the EU AI Act as a 2027 problem, this week should recalibrate your timeline.
On March 5, 2026, the European Commission published the second draft of its Code of Practice on marking and labeling AI-generated content — a binding implementation document under the AI Act. The transparency rules, including Article 50 on marking AI-generated content, come into effect in August 2026. A final code is expected by June 2026, which means the second draft is the last realistic window to influence the labeling standard before it locks. For anyone pushing AI-generated content into EU markets — synthetic media, AI-written marketing, AI-dubbed video — this is the moment to engage.
Simultaneously, the Commission's "Digital Omnibus" proposal is working through the European Parliament and could push back some high-risk system deadlines from August 2026 toward late 2026 or 2027. But the Commission also missed a February 2026 deadline to publish detailed guidance for high-risk systems — and then published implementation guidelines on March 7, 2026 that emphasize mandatory safety evaluations and broader extraterritorial reach. That combination — missed technical guidance but a simultaneous political push — creates a confusing operational window.
Adding pressure: the European Data Protection Board and European Data Protection Supervisor issued a joint opinion endorsing the Digital Omnibus direction, and a proposed "Digital Fairness Act" aims to harmonize consumer-protection rules around dark patterns and exploitative personalization with the AI Act. The general-purpose AI code of practice comment round closed with several major U.S. labs refusing to co-sign transparency obligations like model-weights disclosure — underscoring a transatlantic compliance divergence that multinational developers must now design around.
Practical takeaway: treat the March 7, 2026 guidance as an enforcement signal even if the Omnibus could alter timing. Build a compliance pathway that can be tightened or phased rather than a single go/no-go switch. And watch the Internal Market and Consumer Protection (IMCO) Committee and the Legal Affairs (JURI) Committee of the European Parliament — committee-stage dockets in April/May 2026 — for trilogue scheduling that could reset the August compliance calendar.
Signal: In motion — binding labeling code on track for August; Digital Omnibus could shift high-risk timelines
FERC's Transmission Reforms Go Live, Grid Cyber Rules Tighten, and States Start Asking Hard Questions About Data Centers
The energy and infrastructure regulatory picture tightened on multiple fronts this week, and the common thread is that AI-driven electricity demand is now a named regulatory concern — not just an industry talking point.
FERC Order 1920-A took effect after a denied emergency stay, immediately accelerating long-term scenario-based transmission planning and cost allocation reforms for regional transmission organizations. Expect near-term compliance filings and cost-allocation disputes. Separately, FERC approved several NERC reliability standards at its February 2026 meeting, continuing to layer more detailed cyber controls on the bulk power system — the direction is toward continuous, auditable cyber monitoring as a regulatory requirement, not a best practice.
On the capacity market side, PJM's proposed capacity price-collar extension through 2030 is before FERC — if approved, large loads (notably data centers) should revisit hedging and siting assumptions.
Meanwhile, Chevron publicly warned that proposed amendments to California's Cap-and-Invest program would cripple the survivability of the state's remaining refineries, forcing policymakers to balance economic concerns against climate goals. And at the state level, New York is pushing a legislative and regulatory effort to temporarily pause certain new data-center projects while studying their rate and environmental impacts — the kind of process that often becomes a template for other high-load states.
One more: EPA finalized a PFAS drinking water rule on March 8, 2026 that sets enforceable limits for several compounds and starts phased monitoring in 2027 — an immediate cost and permitting factor for operations with significant water footprints, including data centers and semiconductor fabs.
Signal: In force — transmission reforms live; cyber standards binding; state-level data center scrutiny emerging
⚡ What Most People Missed
- The Supreme Court just cemented a major constraint on AI-generated content. On March 2, 2026, the Court declined to hear Thaler v. Perlmutter, leaving in place the ruling that purely machine-generated works cannot receive U.S. copyright. For companies monetizing AI outputs as proprietary assets, this reduces available IP protections and may change licensing, valuation, and contract drafting — effective immediately.
- The UK government owes Parliament two AI-and-copyright reports by March 18, 2026. Under the Data (Use and Access) Act 2025, the government must publish its position on AI training data rights and copyright protection for AI-generated outputs. A December 2025 progress report noted that a majority of respondents supported mandatory licensing. If the UK moves that direction, it creates a third major regulatory track — different from the U.S. (no federal rule) and the EU (transparency plus opt-out). Anyone training models on web-scraped content with UK exposure should read these reports the day they drop.
- The OCC just proposed turning banks into stablecoin gatekeepers. A notice of proposed rulemaking published March 2, 2026 would create a federal supervisory framework for "payment stablecoin" issuers under the GENIUS Act — licensing, capital, redemption, and reserve requirements that push dollar tokens toward bank-like narrow purposes. Comment windows are open. Payments, treasury, and token teams need to read the Federal Register.
- FDA authorized investigational use of the first CRISPR-edited pig organs in human clinical trials. The agency cleared a CRISPR-engineered pig liver product for xenotransplantation clinical trials, marking a major step that could redraw transplant and biotech investment strategies if early results are positive, and an accelerator for companion diagnostics and IP licensing across the CRISPR ecosystem.
📅 What to Watch
- If the FTC issues its AI policy statement Tuesday, March 11, 2026, the DOJ's AI Litigation Task Force could receive a blueprint for challenging state laws — but the real second-order move is whether Commerce simultaneously triggers the BEAD broadband funding condition, which would put states in the position of choosing between AI enforcement and billions in infrastructure money.
- If Lilly's orforglipron gets approved this month, it doesn't just add a competitor to the GLP-1 market — it resets the IRA drug price negotiation clock for the entire oral obesity drug class, because new entrants with separate IP create a fresh negotiation timeline that branded incumbents can't control.
- If the EU's Digital Omnibus advances through committee votes in April/May 2026, it could soften the August 2, 2026 compliance deadline for high-risk AI systems — but the labeling code is on a separate, faster track, so companies that treat the Omnibus delay as a blanket reprieve will find themselves out of compliance on transparency obligations that didn't move.
- If BIS formalizes the reported "global gatekeeper" model, requiring licenses for advanced AI chips shipped anywhere outside the U.S., compliance scope expands from a China-focused problem to a worldwide supply-chain restructuring — and the timing may be dictated by the late-March 2026 Trump-Xi meeting rather than ordinary rulemaking channels.
- If New York's data-center moratorium and environmental study proceed, expect copycat proposals in other grid-constrained states within months — effectively creating a new category of siting risk where "AI/data center" load is treated as a distinct regulatory problem rather than generic industrial demand.
That's the week. Three deadlines, two enforcement records, and one quiet Supreme Court denial that may matter more than all of them. Forward this to someone who still thinks AI regulation is a 2027 problem.