life sciences

Article Allison Korn

What life sciences organizations deploying AI need to know about governance, risk, and regulatory accountability – before an incident forces the conversation.

Artificial intelligence is no longer a future consideration for life sciences. It’s already embedded in how your organization operates – accelerating drug discovery, streamlining clinical documentation, powering regulatory submissions, and optimizing manufacturing quality control. The efficiency gains are real. So are the risks.

The challenge isn’t whether to deploy AI. The challenge is whether your governance structure can keep pace with the deployment. For most life sciences organizations, the honest answer is: not yet.

The Regulatory Environment Didn’t Wait for You

Life sciences operate under some of the most demanding compliance frameworks in existence – FDA 21 CFR Part 11, GxP, HIPAA, and increasingly, the EU AI Act’s high-risk AI provisions that directly implicate clinical decision support, diagnostic tools, and automated manufacturing processes. These frameworks were designed for a world where humans made decisions and systems recorded them. AI flips that model. Systems now make – or heavily influence – decisions, and humans ratify them.

Regulators are already asking questions your organization may not be ready to answer:

  • Who is accountable when an AI-assisted clinical decision leads to an adverse event?
  • How do you demonstrate model integrity and data lineage during an FDA audit?
  • What controls prevent your AI agents from taking autonomous actions on validated systems?
  • Has your AI vendor been evaluated for privacy controls and model training data practices?

These are not hypothetical. FDA’s emerging guidance on AI/ML-based Software as a Medical Device (SaMD) explicitly anticipates continuous learning models that change behavior post-deployment. The EU AI Act classifies several life sciences AI applications as high-risk, with mandatory conformity assessments. And plaintiffs’ attorneys are building AI liability theories faster than most compliance teams are building AI policies.

The Incident That Should Be on Every CIO’s Radar

In April 2026, an AI coding agent destroyed an automotive SaaS company’s entire production database – including 90 days of backups – in nine seconds. No cyberattack. No malicious insider. Just an AI agent with unconstrained permissions, no guardrails, and no one who had formally defined what it was and wasn’t allowed to do.

Now apply that scenario to a life sciences context. Your AI agent has access to your LIMS. Or your validated manufacturing execution system. Or your clinical trial data repository. What are its permission boundaries? Who defined them? Where is that documented?

What Governance-First Looks Like in Life Sciences

AI governance in life sciences isn’t a checkbox exercise. It’s a structured program that connects executive accountability, documented controls, and technical assurance — and maps cleanly to the regulatory and audit expectations already governing your environment.

Ownership and Decision Rights. Someone in your organization needs to own AI risk. Not informally. Formally – with defined authority, an escalation path to the Board, and a Security Steering Committee that includes clinical, legal, IT, and compliance representation. AI incidents are leadership failures when no one owns the outcome.

Acceptable Use That Actually Covers AI. Most Acceptable Use Policies were written before generative AI existed. They don’t address which AI tools employees may use with patient data, how IP and proprietary research data are protected when entered into commercial LLMs, or what happens when a staff member uses a shadow AI tool to summarize a clinical report. That policy needs to be updated – specifically, not generically.

Vendor Risk for AI Vendors. Your standard vendor risk assessment wasn’t designed to evaluate whether a vendor’s model is trained on customer inputs, whether a productivity AI retains PHI, or whether an AI-powered CRO tool meets your data residency requirements. Third-party AI vendors need an assessment framework built for how AI actually works – covering model training data, privacy controls, security posture, and contractual data use restrictions.

AI Risk Assessment Against a Recognized Framework. The NIST AI Risk Management Framework provides a structured approach to evaluating AI risk across governance, data, model, and operational domains. For life sciences organizations, this maps well to existing quality and risk management culture — and produces the kind of documented, auditable output that regulators and auditors can evaluate.

Adversarial Testing of Your LLMs. If your organization has deployed or integrated large language models – for clinical summarization, regulatory writing assistance, or internal knowledge retrieval — those models need to be tested the way your other systems are tested: adversarially. Prompt injection, data leakage, model abuse, and evasion techniques aligned to MITRE ATLAS give you visibility into how those models behave under attack before an adversary discovers it first.

Infrastructure Controls for Agentic AI. This is the category that’s moving fastest and has the least governance attention. AI agents – workflows that autonomously take actions in your environment – require a specific set of controls: least-privilege permissions, confirmation guardrails for consequential actions, audit logging, backup architecture, and environment segmentation. In a validated GxP environment, agentic AI without these controls is a compliance and patient safety risk.

The Questions Leadership Should Be Asking Now

Before your next Board meeting, executive team discussion, or audit cycle, consider whether your organization can answer these confidently:

  1. Who is our AI Risk Owner, and what is their authority?
  2. Does our Acceptable Use Policy explicitly govern AI tools and data handling?
  3. Have we assessed our AI vendors for model training data practices and privacy controls?
  4. Have we performed adversarial testing on any LLMs in our environment?
  5. Do our AI agents operate within defined permission boundaries with documented guardrails?
  6. Can we produce evidence of AI governance structure for an FDA auditor or a Board inquiry?

If any of these surfaces uncertainty, that’s the right place to start.

What a Structured Engagement Looks Like

Dean Dorton’s AI Security Governance program is a 12–16 week engagement that takes organizations from governance gap to defensible program. It covers all six components – AI Governance, Acceptable Use Policy, Vendor Risk Management, AI Risk Assessment (NIST AI-RMF), LLM Penetration Testing (MITRE ATLAS), and Infrastructure & Controls Assessment – in a phased approach tailored to your regulatory environment and operational readiness.

For life sciences clients, we integrate directly with your existing compliance and quality management infrastructure, align deliverables to audit and regulatory expectations, and ensure that governance outputs are Board-ready, not just IT-ready.

The Cost of Waiting

The organizations that will navigate the next wave of AI-related regulatory scrutiny, litigation, and incidents with confidence are building governance structures now – before they’re compelled to. In life sciences, where the stakes include patient safety, validated systems, and federal regulatory relationships, the cost of a reactive posture is simply too high.

The question isn’t whether your organization needs AI governance. It’s whether you build it on your terms or someone else’s.

Gui Cozzi is Director of Cybersecurity Risk & Compliance at Dean Dorton, a Top 100 professional services firm. He leads the firm’s cybersecurity practice, including AI Security Governance, Fractional CISO services, and compliance advisory across healthcare, life sciences, financial services, and higher education.

Ready to put governance around your AI program? Schedule a consultation.

Article Dean Dorton

The life sciences industry depends on long-term capital, high-risk innovation, and patient investment. The One Big Beautiful Bill Act (OBBBA), enacted July 4, 2025, significantly enhances Section 1202 of the Internal Revenue Code — the provision governing Qualified Small Business Stock (QSBS). These changes make investing in and building life sciences companies more attractive by expanding tax benefits for founders and early investors.

For biotechnology, pharmaceutical, and medical technology companies that require substantial upfront investment and extended development timelines, the revised Section 1202 rules create meaningful new opportunities for capital formation and exit planning.

Section 1202 Pre-OBBBA

Congress created Section 1202 in 1993 to encourage investment in small, growth-oriented businesses. Under Section 1202, noncorporate taxpayers – including individuals, trusts, and estates – may exclude from income capital gains from the sale of QSBS if they satisfy certain conditions.

To qualify for the benefits of Section 1202, the stock must be issued by a domestic C corporation and acquired by the taxpayer at its original issue (either directly or through an underwriter). Before the OBBBA, Section 1202 required that the C corporation issuing the stock have aggregate gross assets of no more than $50 million both before and immediately after the stock issuance. At least 80% of the corporation’s assets must be used in the active conduct of a qualified trade or business.

Certain service-oriented types of businesses are excluded from qualification. Importantly, companies focused on research, product development, and manufacturing — the core activities of most life sciences startups — generally fall within qualifying trades or businesses.

Pre-OBBBA, shareholders were required to hold QSBS for more than five years to exclude any gain from income upon its sale. If this holding period was satisfied, the following percentages of gain could be excluded from the shareholder’s income upon sale of the QSBS:

Date of Stock IssuanceMaximum Exclusion Percentage
8/11/1993 – 2/17/200950%
2/18/2009 – 9/27/201075%
9/28/2010 – 7/4/2025100%

The maximum gain eligible for exclusion was the greater of $10 million or ten times the taxpayer’s basis in the stock.

Enhanced Tax Benefits under the OBBBA

Many of the Section 1202 rules remain unchanged following the OBBBA’s enactment. However, the OBBBA expands the tax benefits available under Section 1202 in three primary ways.

Tiered Holding Period

Under the OBBBA, taxpayers are no longer required to hold QSBS for more than five years to benefit from gain exclusion. Instead, taxpayers that hold QSBS for at least three years are eligible to exclude 50% of the gain from the sale of the stock from income. If a taxpayer holds QSBS for at least four years, 75% of the gain may be excluded. For QSBS held for five or more years, 100% of the gain may be excluded. This new, tiered holding period applies to QSBS acquired after July 4, 2025.

Life science companies often progress through defined development stages – early research, clinical trials, regulatory approval, and commercialization.  This new tiered holding period gives investors greater flexibility to align exit timing with these milestones.

Increased Cap on Maximum Gain Exclusion

The OBBBA raises the cap on the maximum amount of gain a taxpayer may exclude from income upon the sale of QSBS from $10 million to $15 million. Thus, for stock acquired after July 4, 2025, a taxpayer may exclude the greater of $15 million or ten times the taxpayer’s basis of the stock sold. Beginning in 2027, the $15 million amount is adjusted annually for inflation.

A higher exclusion cap allows founders and early investors to retain more of their gains after tax.  For venture-back startups with rapid valuation growth, the expanded exclusion can materially affect after-tax economics, making early equity ownership more attractive and strengthening incentives for long-term commitment.

Higher Asset Threshold to Qualify as a Small Business

Prior to the OBBBA, the C corporation issuing the stock was required to have aggregate gross assets of no more than $50 million both before and immediately after the stock issuance. The OBBBA increases the aggregate gross asset limit to $75 million, indexed for inflation beginning in 2027. The higher limit applies to stock issued after July 4, 2025.

Life sciences companies are capital-intensive. Research infrastructure, laboratory equipment, intellectual property development, and clinical trials can quickly increase asset levels. The higher threshold better reflects the realities of scaling a science-driven business.

Conclusion

The OBBBA’s changes to Section 1202 strengthen an already powerful incentive for investing in innovative small businesses. For life sciences startups — where capital intensity, long development horizons, and high growth potential intersect — these enhancements are especially meaningful.

The new tiered holding period provides earlier access to tax benefits. The increased exclusion cap boosts after-tax returns. And the higher asset threshold expands eligibility for growing companies. Together, these changes support capital formation and reinforce the economic foundation needed to advance scientific innovation.

Life sciences companies face unique tax and financing considerations. Understanding how Section 1202 planning fits into your overall growth strategy can materially impact founder and investor outcomes.  If you’re interested in learning more about how the expanded opportunities under the OBBBA could benefit you, contact Dean Dorton.

Article Danielle Camara

The Financial Accounting Standards Board’s ASU 2025-10 introduces authoritative guidance for accounting for government grants received by business entities—a first for U.S. GAAP. Historically, companies relied on analogies to IAS 20 or not-for-profit models, creating diversity in practice. This update aligns U.S. GAAP with international standards, enhancing transparency and comparability.

Under ASU 2025-10, a grant is recognized only when it is probable that the entity will (1) comply with the grant’s conditions and (2) receive the funds. For income-related grants, amounts may be presented as other income or as a reduction of the related expense.

Effective Date:

  • Public business entities: Annual periods beginning after December 15, 2028 (including interim periods).
  • All other entities: One year later, after December 15, 2029.
  • Early adoption permitted

For additional details on ASU 2025-10 or questions about your grants, please reach out to the Dean Dorton Life Science Team.

Article Sam Stephenson

For companies in the life sciences sector, choosing the right legal structure for your business is a critical step with lasting tax, fundraising, and strategic implications. Whether you’re launching a biotech startup, developing a new medical device, or scaling an established pharmaceutical company, your entity choice can impact everything from how you raise capital to how your company is taxed and what liability protections you receive.

Below, we outline the key entity types commonly used in the life sciences industry, along with their tax advantages, limitations, and strategic considerations.

Single-Member LLC

A single-member LLC is a simple, flexible structure for businesses with one owner. It is typically treated as a disregarded entity for federal tax purposes, meaning the business’s income and expenses flow directly through to the owner’s personal tax return.

Tax Considerations

  • No separate federal income tax return is required (unless the business has employees or excise tax obligations).
  • An Employer Identification Number (EIN) may still be required.
  • SMLLCs may qualify for the federal research credit, which supports companies conducting qualified R&D in fields like biotechnology, engineering, and physical sciences.

Fundraising & Liability

  • Funded through personal assets, loans, or grants.
  • Provides liability protection for the owner.

This structure is often used in the early stages of a company’s development before additional investors or owners come on board.

Partnership

A partnership involves two or more owners who agree to carry on a business for profit. Like a single-member LLC, partnerships are pass-through entities for tax purposes.

Tax Considerations

  • The partnership files an informational return, but the income is taxed at the partner level.
  • Partnerships can allocate income, deductions, and credits to maximize tax efficiency across partners.
  • Partners’ tax basis (i.e., their investment in the partnership) changes with liabilities and contributions, which can affect how distributions or losses are treated.
  • The research credit is passed through to partners in proportion to their ownership.

Fundraising & Liability

  • Can be funded similarly to single-member LLCs with personal assets, loans, or grants, in addition to equity and admission of new partners.
  • General partnerships may expose partners to liability; limited partnerships and LLPs offer more protection.

S Corporation

An S Corporation is a tax election made by a qualifying domestic corporation that allows income and losses to pass through to shareholders for federal tax purposes, but offers some aspects of a C-Corporation structure.

Tax Considerations

  • Avoids corporate-level taxation.
  • Potential savings on self-employment taxes for shareholders.
  • Shareholders must receive a reasonable salary for their work within the S-Corporation.
  • Shareholders are taxed on their share of income relative to their ownership percentage regardless of whether distributions are made.
  • The research credit is passed through to shareholders in proportion to their ownership.

Limitations

  • Only U.S. citizens or residents can be shareholders.
  • Cannot exceed 100 shareholders or issue more than one class of stock.
  • Venture capital and foreign investment are generally not permitted.

Fundraising & Liability

  • Limited in fundraising flexibility due to shareholder restrictions.
  • Offers limited liability protection, important for companies exposed to regulatory or product-related risks.

C Corporation

The C Corporation is the most common structure for high-growth life science companies, particularly those seeking venture capital or preparing for IPOs.

Tax Considerations

  • Pays a flat 21% federal income tax rate.
  • Subject to double taxation: profits are taxed at the corporate level and again when distributed as dividends.
  • Eligible for a range of deductions and credits, including the research credit and the general business credit.
  • Required to make quarterly estimated tax payments if tax liability exceeds $500.

Key Advantage – Section 1202 Stock

C Corps can issue Qualified Small Business Stock under Section 1202, which allows eligible shareholders to exclude up to 100% of capital gains from the sale of stock held for at least five years. This is a significant tax incentive for investors and founders in the life science industry.

Fundraising & Scalability

  • No restrictions on number or type of shareholders.
  • Can issue multiple classes of stock and offer equity-based compensation to employees.
  • Preferred structure for raising venture capital and issuing stock under SEC regulations.

Governance

  • Must maintain a formal structure with a board of directors and corporate officers.

Final Thoughts

For life sciences entrepreneurs, choosing the right entity structure is about more than just legal formalities – it can shape your company’s funding options, risk exposure, tax liability, and long-term growth.

Before making a decision, consult with tax and legal advisors who understand the unique needs of life sciences businesses. The right structure today can lay the foundation for tomorrow’s breakthroughs.

Article Autumn Hines

In today’s rapidly evolving digital landscape, life sciences companies are on the cutting edge of innovation—developing breakthrough drugs, advanced medical devices, and sustainable agricultural solutions. However, with innovation comes risk: As cyber threats are rapidly evolving, life sciences organizations are uniquely targeted due to the sensitive nature of their data and intellectual property. 

The Digital Transformation and Its Risks

Digital transformation has revolutionized research, clinical trials, and operational efficiency in the life sciences industry. While this shift offers significant advantages, it also opens the door to sophisticated cyber threats that can disrupt research, compromise patient data, and lead to costly intellectual property breaches. 

Key Emerging Cyber Threats

  1. Ransomware Attacks – Ransomware continues to be a major concern. Cybercriminals are targeting sensitive research data and proprietary information with ransomware, demanding hefty ransoms that can stall critical projects. According to the Cybersecurity and Infrastructure Security Agency (CISA), ransomware incidents have surged—with healthcare and research sectors among the top targets. 
  2. Supply Chain Attacks – Life sciences companies increasingly rely on a global network of suppliers and partners. This interconnectivity exposes them to supply chain attacks, where hackers infiltrate trusted vendor systems to gain access to sensitive data. The FBI has noted a rise in such attacks, emphasizing the need for robust third-party risk management. 
  3. Cyber Espionage and Intellectual Property Theft – The race for breakthrough discoveries makes life sciences organizations prime targets for cyber espionage. State-sponsored and sophisticated threat actors aim to steal research data and intellectual property, potentially compromising competitive advantage and national security. IBM X-Force threat intelligence reports have highlighted a significant uptick in espionage activities targeting high-value industries. 
  4. Vulnerabilities in the Internet of Things (IoT) and Medical Devices – With the advent of connected medical devices and IoT applications in research laboratories, vulnerabilities in these systems pose substantial risks. Exploited vulnerabilities can lead to unauthorized access, manipulation of device functions, or even interference with patient care. The National Institute of Standards and Technology (NIST) emphasizes the critical need to secure IoT devices in sensitive environments. 
  5. Advanced Persistent Threats (APTs) – APTs represent a long-term, stealthy attack method where intruders gain and maintain access to a network. In the life sciences sector, APTs are particularly dangerous as they allow attackers to quietly siphon off valuable research data over extended periods. These threats are becoming more sophisticated and targeted. 

How We Can Help 

At Dean Dorton, we understand that each threat in the life sciences arena demands a tailored, strategic response. Our Information Security services are designed to address these challenges head-on: 

  • Cybersecurity Risk Assessments & Regulatory Audits: We conduct comprehensive evaluations to identify vulnerabilities unique to your research and operational systems, ensuring compliance with HIPAA, GDPR, FDA regulations, and more. 
  • Advanced Threat Monitoring & Incident Response: Leveraging AI-driven tools, we offer real-time monitoring and rapid incident response, minimizing disruption and safeguarding critical data. 
  • Supply Chain and IoT Security: Our solutions extend beyond internal networks, assessing and fortifying the entire ecosystem—from suppliers to connected medical devices—to ensure robust protection. 
  • Employee Training & Awareness Programs: We empower your teams with tailored training to recognize phishing and other social engineering tactics, reducing the risk of human error. 

Stay One Step Ahead

The life sciences industry thrives on innovation—and protecting that innovation is crucial. By understanding and proactively addressing emerging cyber threats, your organization can continue to lead with confidence. Partner with Dean Dorton to build a resilient cybersecurity posture that supports your groundbreaking work while shielding it from evolving digital risks. 

Contact us today to learn how our specialized Cybersecurity and IT Compliance solutions can secure your future and keep your innovations safe. 

Article Dean Dorton

When it comes to Biotech business systems, it’s complicated. All of it. Tracking profitability is complicated. Reporting for regulatory compliance – also complicated. When you also consider the rapid growth your company is going through, your team’s research and development, reporting and business decisions aren’t going to get any easier any time soon.

We understand.

Our accounting experts recognize the unique management complexities that Biotech companies face. These companies have issues unlike any other industry, and those issues demand a unique approach to managing workflows and financials.  

Biotech companies need systems that can flex with new changes but can still provide a strong foundation that will scale with the company in the future.

To help Biotech companies navigate these hurdles for the long haul, we have created a free ebook on the 5 Essential Financial Management Practices of Biotech Companies Poised for Growth.

In our eBook, you will discover how to keep your financials accurate, and your workflow systems streamlined, now and going forward.  You’ll learn:

  • How to efficiently track project accounting costs using systems that will flex with your teams’ changing needs.
  • Habits in lot tracking and batch automation for precision, accuracy, and traceability.
  • Ways to unify your systems for flexible reporting that will scale with your company’s expansion.
  • More effective processes for streamlining workflows.
  • How best to grow with cloud technology to support your company’s unique complexities.

Success isn’t going to stop and wait for lagging internal processes, and productivity bottlenecks to catch up when the business is going strong.

Your business needs strong, timely solutions right now. Your company needs a best-in-class cloud solution like Sage Intacct to adapt quickly and to maintain the pace. It needs scalable business practices that deliver streamlined reporting efficiency, and real-time visibility into metrics stakeholders and decision-makers need.

Your teams need all the right integrations to keep research and development going, as systems and processes change to handle new growth, even when your company is at the height of production.

Do all you can to ensure your company’s unique needs are being met, in the areas they need the most help.