The Lyceum: Tech Policy & Regulation Weekly — Mar 19, 2026

The loud speeches are slowing down, but the binding rules are not. This week, Commerce killed its most aggressive AI chip export experiment and then quietly expanded controls on packaging substrates; the FTC filed its first enforcement action against a biased AI hiring tool; and the FDA rewrote the biosimilar playbook, accelerated gene therapy approvals, and started cracking down on AI-generated drug ads — all in the same seven days. The pattern across every sector is the same: regulators are done theorizing and have started building the enforcement infrastructure that will define compliance for the rest of the decade.

If you thought AI bias was still an ethics-panel topic, the Federal Trade Commission just moved it into the enforcement column. On March 18, the FTC announced its first action against an AI hiring tool provider, alleging the system disproportionately rejected female applicants because of biased training data. The result: a $2.5 million settlement and a consent decree requiring ongoing audits.

The tool was used in retail hiring, and the FTC framed the case squarely under Section 5 — unfair and deceptive practices. No new statute was needed. The Commission is signaling that existing consumer protection law already covers discriminatory automated decision-making, and it intends to use that authority aggressively.

For HR-tech vendors and the enterprises that buy their products, this changes the procurement conversation immediately. Expect model audit requirements to become standard in vendor contracts, and expect indemnification clauses to get a lot more specific. The FTC didn't need Congress to act. It just needed a case bad enough to file.

Cloud providers and sovereign AI projects got a reprieve this week — and then immediately got something else to worry about. Commerce formally withdrew a draft proposal that would have required foreign buyers of large AI accelerator clusters to co-invest in U.S. AI infrastructure as a condition of purchase. The concept, logged at the White House's Office of Information and Regulatory Affairs as part of an "AI Action Plan Implementation" package, disappeared from the docket on March 14. Officials told Reuters it never went beyond a conceptual draft.

But the same week, BIS issued an interim final rule expanding export controls to cover advanced packaging substrates — the interposer and substrate technologies (think CoWoS) that physically connect logic dies to high-bandwidth memory in cutting-edge AI chips. This is a binding, immediately effective control that reaches into third-country supply chains. Companies buying advanced packaging services or designing multi-chip modules need to run new export-classification checks now, not next quarter.

The message from Commerce is clear: the blunt "pay-to-play" mechanism is dead, but fine-grained licensing, monitoring, and technical controls on the components that make AI chips work are very much alive. Reported drafts suggest a broader framework is still being designed — one with tiered volume thresholds and facility-access provisions for compliance verification. The specific mechanism changed. The underlying desire to trade market access for alignment did not.

Biologics are the drugs blowing up your pharmacy benefit budget; biosimilars are how you get leverage back. On March 9, the FDA issued revised draft guidance that further streamlines how copycat biologics can be developed and approved, expanding reliance on non-U.S. comparator products and taking a more flexible view of when full comparative efficacy studies are needed.

This isn't a tweak — it's a deliberate move to make comparative efficacy trials the exception rather than the rule for many biosimilars. That changes the capital required to challenge blockbuster biologics and could accelerate price erosion in high-spend categories faster than payors are currently modeling. Stelara is the frequently cited example: the arrival of biosimilars may produce faster, deeper price cuts than Medicare negotiation under the Inflation Reduction Act alone.

For innovators, the old "two big trials" moat is shrinking. Lifecycle management — formulation tweaks, device combinations, delivery innovations — matters more than ever. For payors, more biosimilar entrants mean more pricing leverage, especially in oncology and autoimmune indications. The comment period will determine the final contours, but the direction is unmistakable.

The FDA announced a streamlined approval pathway for gene therapies targeting rare diseases, creating a priority designation that can shorten review timelines by months for qualifying submissions. This is a final policy change with immediate effect.

The competitive implications are real: small biotechs with strong early biomarker data can now reach market faster, compressing the window in which larger pharma companies can acquire or out-license promising programs. But speed to approval increases the premium on robust post-market safety monitoring — conditional approvals and pharmacovigilance commitments will carry more weight, not less. Combined with this week's biosimilar guidance and the pending oral orforglipron decision from Eli Lilly, the FDA is testing whether its restructured review process can handle simultaneous acceleration across multiple therapeutic categories.

The Commerce Department published its evaluation of state AI laws. The FTC issued its Section 5 policy statement. And the Department of Justice created a new Enforcement and Affirmative Litigation Branch within the Civil Division, tasked with "filing lawsuits against states, municipalities, and private entities that interfere with or obstruct federal policies." The machinery for challenging state AI laws is now operational.

The executive order directs the FTC to explain when state laws that "require alterations to truthful outputs of AI" may be preempted under Section 5. Commerce must issue a policy notice on when states with restrictive AI laws may lose eligibility for Broadband Equity Access and Deployment (BEAD) Program funds. Other agencies must assess whether they can condition discretionary grants on states refraining from enforcing conflicting AI laws.

Here's the critical caveat: the executive order does not itself preempt any state law today. Only Congress and the courts have that power. But the DOJ's AI Litigation Task Force is reportedly in operational posture, consulting with White House AI advisors on early targets — Colorado is explicitly on the radar. Meanwhile, Colorado's own working group just reached a consensus on revising the state's AI Act, doubling down on regulating "consequential decisions" in hiring, lending, and insurance while clarifying developer duties and consumer appeal rights.

The practical advice hasn't changed: maintain compliance with applicable state laws while tracking which ones get challenged first. But the timeline for that challenge just compressed significantly.

If your product relies on gallium nitride or gallium arsenide chips — the workhorses of 5G radios, satellite communications, EV chargers, and power electronics inside AI data centers — your cost base moved this month. According to DigiTimes, prices for tungsten, tantalum, and molybdenum have roughly doubled since early 2025, while gallium has jumped 123% since early 2025, amid Middle East supply disruptions layered on top of China's existing gallium export ban to the U.S.

This isn't a new regulation — it's the downstream effect of MOFCOM export controls meeting geopolitical instability. But the practical result is the same: prices and lead times are now at levels that will shape where fabs are built and which suppliers get long-term contracts. Expect BIS and allied governments to steer industrial-policy tools — tax credits, Defense Production Act loans — into non-Chinese gallium and specialty metals. The April 13 BIS deadline for IC designer authorization adds another layer: companies that haven't filed their "approved designer" applications are about to lose their operating room, and the grace period is not extending.

FBI Director Kash Patel admitted under oath this week that the FBI purchases location data on Americans from commercial data brokers. The legal backdrop: the Supreme Court's 2018 Carpenter v. United States decision requires a warrant to obtain location data from carriers, but left open a loophole for data purchased from brokers rather than subpoenaed from telecoms.

The headline is getting framed as a civil liberties story. The compliance story is different. Senator Wyden's questioning signaled that the purchased data may be fed to AI systems for analysis, and the Pentagon has already labeled Anthropic a supply-chain risk after the company refused to let its products be used for mass domestic surveillance. If your company aggregates, licenses, or brokers location data — or sells advertising segments based on it — the government is one of your downstream customers, directly or indirectly, and that creates regulatory exposure from the FTC, state attorneys general, and constitutional litigation simultaneously.

Attorney General Letitia James threw her support behind a policy package called the "One Fair Price Package," aimed at banning what New York calls "surveillance pricing" — the practice of using personal data to set individualized prices. The proposals would make it illegal for companies to use consumer data to charge one person more than another and would ban digital shelf labels that change prices dynamically in large grocery and drug stores. California's AG announced a similar investigative sweep earlier this year.

State attorneys general are now treating algorithmic price discrimination as a classic consumer protection violation, not a novel tech issue. For any e-commerce or retail company using dynamic pricing algorithms, this creates a new enforcement axis that sits alongside privacy, antidiscrimination, and — if the FTC follows — federal unfair-practices risk.

The European Data Protection Board joined 60 other regulators worldwide in a joint statement warning about AI systems that generate realistic images and video of identifiable people without consent, calling for urgent regulatory scrutiny and better safeguards. The statement resurfaced this week as the EDPB listed it among its March 18 priorities.

This isn't a new law — but it's a strong interpretive signal that authorities see unauthorized synthetic imagery as squarely within existing privacy, consumer protection, and harassment laws. For platforms hosting user-generated content and for companies building image or video models, the bar on detection (watermarking, provenance signals), consent flows, and takedown processes just rose. The joint nature of the statement hints at coordinated enforcement rather than isolated national cases — and the enforcement hook is already there under GDPR, the Digital Services Act, and FTC deception powers.

A week in which the FTC fined an algorithm for being sexist, Commerce killed a chip export rule and replaced it with a stricter one in the same breath, and 61 regulators co-signed a letter that amounts to "we know what deepfakes are and we have laws."

Somewhere in a GSA procurement office, someone is drafting a contract clause that says the government owns your AI's thoughts — and the comment period is short.

Read the footnotes this week. They're where the deadlines live.

If someone on your team touches export controls, AI procurement, or hiring tech, forward this to them before Monday.