Managing Risk in Life Sciences Innovation

(DESCRIPTION)
Logo: Travelers. Text: The Convergence Conundrum: Managing Risk at the Crossroads of Life Sciences Innovation, May 15, 2026. In an image on the left, bright white and blue light rays beam outward from a glowing source on a circuit board.

(SPEECH)
JAMES STANDISH: Welcome, and thank you for joining us today. I'm James Standish. I lead the technology and life sciences practice at Travelers. Today's discussion is titled The Convergence Conundrum, Managing Risk at the Crossroads of Life Sciences Innovation.

Life sciences organizations are changing at an extraordinary pace. Artificial intelligence is accelerating discovery. Precision medicine is expanding what's possible, and digital technologies are reshaping care delivery. But innovation doesn't happen in isolation.

As we look across 2026, risks that were once managed separately are increasingly intersecting across AI, cyber, supply chains and M&A. A single disruption, whether it's a cyber event, system failure, a vendor issue, can cascade across operations, delay approvals and affect both patients and financial performance.

For executive teams, the challenge is no longer managing risks and silos, it's understanding how those risks connect across the organization and whether the right structures are in place to manage them effectively. And when we talk about governance today, we're really talking about how organizations make decisions, manage risk and maintain visibility across increasingly complex systems.

(DESCRIPTION)
Text: Moderator: James Standish, VP, Technology and Life Sciences, National Practice Leader, Travelers. On the right, James smiles in a photo.

(SPEECH)
So today, we'll explore what that means in practice, where organizations are exposed and how stronger oversight, coordination and risk management frameworks can help support resilience and protect long-term enterprise value.

(DESCRIPTION)
Three panelists smile in photos. Text: Panelists, Lloyd B. Minor, M.D., Dean of the School of Medicine, Vice President for Medical Affairs, Stanford University. Jennifer Ampulski, AVP, Life Sciences Segment Lead, Travelers. Andrea Tasik, AVP, Professional and Cyber Practice Lead, Technology and Life Sciences and Public Sector, Travelers.

(SPEECH)
So joining me today, we have three experts, who bring clinical risk and cyber perspectives -- Dr. Lloyd Minor, Dean of the Stanford University School of Medicine, focused on clinical innovation and precision health and responsible AI, Jennifer Ampulski, AVP and Life Sciences Segment Lead at Travelers, specializing in risk strategy claims and litigation trends, as well as Andrea Tasik, AVP and Technology Underwriting Officer here at Travelers, focused on cyber risk technology and emerging exposures.

So thank you for being here. Please take a quick moment to review the disclaimer on your screen.

(DESCRIPTION)
Important Note: This material does not amend, or otherwise affect, the provisions or coverages of any insurance policy or bond issued by Travelers. It is not a representation that coverage does or does not exist for any particular claim or loss under any such policy or bond. Coverage depends on the facts and circumstances involved in the claim or loss, all applicable policy or bond provisions, and any applicable law. Availability of coverage referenced in this material can depend on underwriting qualifications and state regulations. The information provided in this material is intended as informational and is not intended as, nor does it constitute, legal or professional advice or an endorsement or testimonial by Travelers for a particular product, service or company. Travelers does not warrant that adherence to, or compliance with, any recommendations, best practices or guidelines will result in a particular outcome. In no event will Travelers, or any of its subsidiaries or affiliates, be liable in tort or in contract to anyone who has access to or uses this information. Unless otherwise specified, no sponsorship, affiliation or endorsement relationship exists between Travelers and any entities referenced in this presentation. Copyright 2026 The Travelers Indemnity Company. Travelers and The Travelers Umbrella are registered trademarks of The Travelers Indemnity Company in the U.S. and other countries. All rights reserved.

Poll Question: Which area presents the greatest concern for your organization in 2026? A, Cyber and data security, B, Supply chain and vendor oversight, C, AI and digital integration, D, M&A and private equity integration. Blue circles contain icons that represent options A through D: an Update Manager shield, organizational chart, brain and building.

(SPEECH)
So we're going to start off with a poll. And our first poll question is, Which area presents the greatest concern for your organization as you navigate 2026? Cyber and data security, supply chain and vendor oversight, AI and digital integration, or M&A and private equity integration?

Oh, wow. Look at that. We have a tie for first between cyber and data security as well as AI and digital integration. Well, looks like we've got some great content lined up. We'll come back to both of those as we move through the discussion.

(DESCRIPTION)
Text: Q1: What defines this moment in life sciences, particularly as innovation accelerates in precision health and rare disease therapies? On the right, a globe and stethoscope glow.

(SPEECH)
So question 1, before we get into the specific risk categories, I just want to do a little bit of a level set here. We're seeing some rapid progress across science as we noted before, technology and data. At the same time, many organizations are still working to align their internal processes, control and decision-making with that pace of change.

So, Dr. Minor, let's start with you. What do you think defines this moment in life sciences as innovation accelerates in areas like precision health and rare disease therapies? What do you feel is most different compared to even say, five years ago.

LLOYD B. MINOR: Well, thank you, James. It's great to be with you today. I think this is an incredibly exciting time in life sciences.

(DESCRIPTION)
A blue circle contains a DNA helix icon. Text: The Convergence of Biology, Technology and AI -- biology, tech and information science are intersecting. Advances are moving discoveries more efficiently into clinical use. -- Precision health is shifting care toward earlier detection and prevention. On the right, a medical professional wearing a protective gown, gloves, mask, goggles and scrub cap holds two vials and interacts with a monitor.

(SPEECH)
We're seeing a convergence of three distinct but related fields, that is biology, technology as applied to studying biology and studying living systems, and information science.

And this convergence of biology, technology and information science is driving innovation at an unprecedented pace. And of course, all aspects of this virtual triangle among biology, technology, information science are being dramatically accelerated by the application of artificial intelligence.

So innovation cycles are becoming compressed. We're seeing innovation progress at a never heard of pace before. And I think it'll continue to progress very rapidly. And with that, of course, occurs great opportunities but also some challenges that I think we'll be discussing in the course of this webinar today.

JAMES STANDISH: Thank you for that, Dr. Minor. I think that really helps us to frame out and explain why this moment feels a little bit different with the science moving so quickly. And the ecosystem around that really has to keep up. So I want to put it over to Jennifer. Jennifer, what stands out to you right now as far as the pace and how it continues to accelerate?

JENNIFER AMPULSKI: As Dr. Minor said, it's that compression of the pace and innovation cycles. And Dr. Minor describes some of the really incredible scientific advances that we're seeing.

(DESCRIPTION)
A blue circle contains a microchip icon. Text: Innovation cycles are compressing rapidly. Regulatory processes are evolving to incorporate AI and shorten timelines. All while AI, devices, supply chains and data become more interconnected.

(SPEECH)
I say what feels most different from a risk management perspective is that the infrastructure designed to support the innovation can't keep pace with how fast it's moving.

So five years ago, regulatory pathways were fairly predictable, but today regulatory frameworks are evolving, including the use of AI, which is shortening timelines compared to traditional approaches. But companies are navigating rules that are still being written.

So what's really changed is how connected everything's become. You've got precision therapies developed using AI, manufactured in complex global supply chains, delivered through connected devices, and all of it is generating massive amounts of data. And those connections increase exposure.

A supply chain disruption can impact data integrity in clinical trials that adapt based on realtime data, and a cybersecurity breach can compromise AI models, for example, drug discovery. And many organizations are advancing faster than their governance and risk management infrastructure can mature.

They're making critical decisions in real time, often without the process that traditional life sciences companies had built over decades. So innovation is outpacing that infrastructure designed to manage its risks. And then on top of it, the risks aren't siloed anymore. They're compounding.

JAMES STANDISH: So that connection between speed and governance is something that we keep coming back to. Andrea, I wanted to put it over to you. From a cyber and data standpoint, how does that same acceleration expand the exposure from your perspective?

ANDREA TASIK: Great question. Thank you, James. And I just want to build on what Dr. Minor and Jen have already mentioned. 

(DESCRIPTION)
A blue circle contains a padlock icon. Text: Interdependency is the defining cyber reality. Data, clinical, genomic and device, is both a valuable asset and a target. Traditional frameworks may not fully address the scale and speed of these environments.

(SPEECH)
The use of AI has become more prevalent than it was five years ago. And frankly, I'm amazed at how quickly it's evolved in its capabilities over the last year and even within the last month. So as AI adoption rates increase and it becomes more embedded across research, clinical, operational and manufacturing systems, you're now working in an environment that has an increased interdependence between those systems, including your digital connections with vendors and suppliers. All of that, in turn, expands the cybersecurity, privacy and security risk landscape within that connected environment. And at its simplest, AI tools are being used to manage, harvest and to classify data just at its simplest. But of course, AI has quickly evolved to do so much more. Traditional AI models have been used as great tools to predict outcomes or to form conclusions off of clinical, genomic or device data. But now we see the widespread use of more advanced AI tools like agentic AI, and those are designed to work autonomously. So these tools take actions on your behalf based on what you want it to do with that data. So data has always been a critical and valuable asset for life sciences firms. But think about it. Because of that, it's always been a critical and valuable target for threat actors.

Use of AI to work with data just now adds complexity and criticality to how you track, protect and secure that data because it can create new points of cyber risk vulnerability depending on how the AI tools are being used.

And finally, from a cyber risk management standpoint, and we'll talk about this a little bit more, but as use of AI has evolved, so too must traditional cybersecurity frameworks evolve. If you're using AI tools within your organization and if they are used across your digital ecosystem, including vendors and customers, you should be adapting your cybersecurity and data governance frameworks to encompass how you're using those tools.

JAMES STANDISH: I think that's a great pivot to our next topic, where I think we want to talk a little bit about the combination of innovation and oversight.

(DESCRIPTION)
Q2: As AI becomes embedded in diagnostics, devices and R&D, where is oversight struggling to keep pace? On the right, a glowing web appears above a tablet, composed of interconnected nodes and icons that represent people. A doctor taps the tablet screen.

(SPEECH)
So, Dr. Minor, as innovation continues to accelerate, particularly as you all three hit on in your first response with AI embedded within the diagnostics, the devices and the research, where do you see oversight struggling to keep pace with that innovation?

LLOYD B. MINOR: In several different ways. I think there's always a balance in oversight.

(DESCRIPTION)
Text: The Oversight Gap. A blue circle contains a balance scale icon. Text: The evaluation gap in health AI is significant. Only a small fraction of AI studies use real patient data, and even fewer assess for bias or fairness, revealing where oversight most needs to catch up. On the left, six people stand beside a bar chart painted on the ground. The fourth bar, shaded pink, exceeds the remaining five, shaded green.

(SPEECH)
That is the technology is evolving, and the applications of AI are evolving very quickly. And we're already seeing the impact of that in terms of improved efficiency, improved access to information.

And yet also we know that there's still the possibility of hallucinations from the application of these large language models. Unlike previous applications of technology, information technology and machine learning, to biology and bio-medicine, these large language models are not strictly deterministic.

So it's not possible to go into the model and actually understand how it's coming up with the response it's coming up with. Unlike, for example, an algorithm that might be used to adjust the dosage of a medication based upon a person's kidney function or liver function, there we know exactly the steps, the mathematical steps that are used in the algorithm, and we can check them for accuracy and validity.

Even though AI models are being based upon and developed based upon principles, in many cases they're being developed not on curated data sets, but on broader data sets. And it's hard to know even though the model may be quote "accurate" based upon the data that's being used to train it, it's hard to know if there is bias or other selection criteria that have in some ways skewed the results of the model because of the data on which it was trained.

So all these are complexities that today we have to keep in mind, just as we see the opportunities for having AI further transform all aspects of life sciences and healthcare delivery from fundamental discovery all the way up through how we run our healthcare delivery systems.

JAMES STANDISH: So, Jen, I wanted to pivot to you. And that balance between the speed, safety and trust is obviously where a lot of exposure can emerge. So where does this acceleration create that, an increased exposure?

JENNIFER AMPULSKI: I mean, from a risk management perspective, the gap exists everywhere between what's technically possible and what's actually governed.

(DESCRIPTION)
A blue circle contains a heartbeat icon. Text: The balance is delicate. Increased oversight may slow innovation; limited oversight may increase harm. The objective: support innovation while maintaining patient safety and trust.

(SPEECH)
So here's the technology evolution. A traditional medical device doesn't change once they're approved.

A pacemaker is a pacemaker, but some AI-enabled products, as Dr. Minor was talking about, they'll learn. They're adapting.

(DESCRIPTION)
A blue circle contains a report icon. Text: Compliance decisions are being made on developing guidance. AI-enabled products change over time, making responsibility harder to determine, creating exposure around regulatory action, product performance and litigation.

(SPEECH)
The diagnostic tool that you validated last year isn't necessarily the same tool six months from now because it's learning from real-world data.

And the FDA gets this. They finalize new guidance that lets companies plan for these changes upfront. So they don't have to file new submissions every time the algorithm updates. And that's a fundamental shift. But only a small number of companies are actually using this approach right now.

And I can get why. There are companies -- those companies, they're scaling fast. They're often on tight budgets navigating multiple regulatory frameworks. And building the infrastructure to manage continuous product changes takes time, resources, and those are things that many organizations are still developing.

So here's the tension. Companies are deploying AI-enabled diagnostics, adaptive clinical trials, drug discovery tools, all learning and evolving in real time, but many haven't built the systems to track and validate those changes as they happen. And that creates exposure.

When something goes wrong with a product that's been continuously learning, determining responsibility gets complicated. And if you haven't built monitoring into your product from the beginning, you're retrofitting. And that's expensive. It's slow. It creates compliance risk. Plus, it's not just the FDA.

The EU has new requirements coming out in August of 2026 for high-risk AI products. So companies selling globally are navigating two frameworks simultaneously. So if you hear nothing else today, hear this. AI-enabled products, when they change over time, creates exposure, especially when companies are moving faster than they're building the governance to manage it.

JAMES STANDISH: Jennifer, thank you for laying out the legal and risk management landscape. I want to take the same issue into the operating environment and pivot over to where cyber risk can become business interruption very quickly. So for that, we're going to ask Andrea.

(DESCRIPTION)
Q3: When digital systems become infrastructure for clinical and manufacturing environments, how does that expand the cyber risk conversation? On the right, a server room technician types on a keyboard terminal.

(SPEECH)
When these digital systems become core infrastructure for clinical and manufacturing environments, how does that expand the cyber risk conversation?

ANDREA TASIK: That's a great question, James. And it's so hard to conceive of any environment these days that isn't tied to or fueled by a digital infrastructure, either as individuals within society or as members of a workforce. We're becoming increasingly more digitized and connected and therefore more automated in what we do and how we do it.

(DESCRIPTION)
Text: Cyber Risk is Now Operational Risk. A blue circle contains an Update Manager shield icon. Text: Incidents affect patient safety, not just data. Ransomware can interrupt production or clinical trials. Recovery often requires validation and regulatory review before operations can resume. On the right, a blue grid-like array features blocks with binary 1's and 0's, blue secure padlocks, and orange open padlocks.

(SPEECH)
So cyber risk or the risk around cyber is not just about data protection anymore. It's now closely tied to operational performance. Organizations of all types are under pressure to improve efficiencies around operational performance. And that's led to organizations adopting and integrating different types of AI tools into their work environment.

And use of AI can really drive improved performance of increasingly complex and interconnected digital systems. And the type of AI tools and digital systems a firm uses can have a huge impact on delivering those efficiencies and desired outcomes.

For example, think about the use of agentic AI tools. They can be used to automate procurement of research or manufacturing materials, and agentic AI can also be used to automate grant funding, bidding on contracts, actual contract negotiation and funds transfer to enable sourcing of supplies and materials necessary to your research or manufacturing operations.

The majority of AI tools are built to function across interconnected systems, both within an organization or outside of it. So now that can create multiple points of vulnerability across cloud, IoT and third-party ecosystems. If the use of AI software at any one of these points within a connected system is vulnerable to attack or even to unintentional release of information or data, it can have a cascading negative effect within these systems, impacting and disrupting multiple parties and operations, and even eventually impacting the ability to receive funding.

A network or system breach incident or a release of private data can affect patient safety as well. It can affect product integrity and manufacturing continuity to your point on business interruption. It can invite regulatory scrutiny and potentially result in reputational harm and loss of like a relied upon revenue or funding stream.

And then think about a ransomware event. And a ransomware event at its most basic disruptive level can interrupt production or clinical trials if it locks you out of systems or holds key data or information captive. So recovery often requires validation and regulatory review before operations can resume.

So it's critical to have a cybersecurity framework that contemplates use of these AI tools and how you operate digitally. And it needs to allow you to trace your assets and your data. A framework should also contemplate like your employees' use of AI tools within the work environment.

How is use of AI by employees monitored and governed? What are acceptable use policies? Does your cybersecurity framework include a data loss prevention program that expands to employee use of AI? Finally, just some thoughts here.

It's not enough for your cybersecurity framework to be proactive in mitigating or trying to prevent incidents. It really should contemplate what happens next if we have a breach or an incident, and how do we minimize disruption as much as possible?

Resiliency in response to an incident has to be measured, has to be modeled and practiced across the entire enterprise, across the digital ecosystem and in consideration of vendors and suppliers outside your organization.

JAMES STANDISH: So clearly this shifts the conversation beyond just IT and Andrea, as you put it, beyond data to operational performance or even patient safety. So, Jennifer, when this kind of operational disruption occurs, how quickly can that become regulatory or civil exposure?

JENNIFER AMPULSKI: Quickly.

(DESCRIPTION)
A blue circle contains a gavel icon. Text: Disruption escalates quickly to regulatory and civil exposure. Issues spread across vendors and partners. If data integrity is affected, organizations may face recalls -- regulatory action or litigation on compressed timelines.

(SPEECH)
When a cyber incident hits a regulated environment, it's like a clinical trial site or a manufacturing facility. That clock starts ticking immediately. And if data integrity or quality systems are affected, you're looking at potential recalls, regulatory action, litigation, and the timeline has shortened dramatically.

We're talking days or weeks, not quarters. So what makes this more complex is that these issues don't stay contained. A ransomware attack doesn't just shut down your systems. It disrupts your contract, research, organization, relationships, your manufacturing partners, your clinical trial timelines. And that creates broader contractual liability and operational impact.

And here's the critical piece that Andrea mentioned. I mean, you can't just restart operations once IT says the systems are back online. The FDA can issue warning letters or halt manufacturing if quality systems aren't properly validated post incident. So if product quality is compromised, you're looking at recalls, consent decrees, manufacturing shutdowns, and litigation can shortly follow.

So what's becoming clear is that these events can highlight real gaps in insurance coverage even. Traditional product or GL policies weren't designed for a world where a cyber event can trigger FDA enforcement action or halt clinical trials. So it's worth reviewing whether your coverage actually protects you for these operational cyber risks.

The bottom line is cyber risk is the enterprise risk. It's not just an IT problem because once it becomes operational, the regulatory and the legal exposure follows fast.

JAMES STANDISH: So Dr. Minor, from your perspective in a clinical perspective, how does that same question affect the continuity of care and patient confidence?

(DESCRIPTION)
A blue circle contains a healthcare worker icon wearing a stethoscope. -- Text: Clinical continuity and patient confidence are at stake. As reliance on digital systems increases, disruptions have a more direct impact on clinical outcomes and the trust patients place in the system.

(SPEECH)
LLOYD B. MINOR: Well, I think in ways that Andrea and Jennifer just described, and that is that if these events actually reached the delivery of care to patients, the active awareness of patients because either their data has been breached, their privacy has been breached, or their care has been interrupted because of a cybersecurity event.

It, of course, has the immediate effect of the disruption in the care, but it has a much longerterm effect on trust and confidence in the system. And of course, we've seen that in many cybersecurity breach situations.

So there's both the immediate need if it's disrupting care delivery systems to restore those systems as quickly as possible. And then there's the much -- the longer-term need and oftentimes the more difficult task of rebuilding trust and confidence, which is the bedrock for everything we do.

JAMES STANDISH: So I think the broad takeaway there is the importance of resilience across all of your comments. I appreciate all of that from all three of you. So let's take a look now, a bit of a step out and think about the vendor and supply chain ecosystem.

So Jennifer, I'm going to start with you.

(DESCRIPTION)
Q4: With heightened federal scrutiny and global supply chain pressure, how should life sciences companies rethink supplier oversight? On the right, glowing lines connect cities across the globe.

(SPEECH)
With the increased federal scrutiny -- and you mentioned the FDA in some of your prior responses -- and the pressure across the global supply chains, how should companies think about their supply or oversight?

JENNIFER AMPULSKI: Well, the traditional approach to supplier oversight was really transactional.

(DESCRIPTION)
Text: Rethinking Supplier Oversight. A blue circle contains an organizational chart icon. Text: Supplier oversight requires continuous visibility, not one-time diligence. Many organizations lack visibility beyond Tier 1 suppliers. Geopolitical pressure and regulatory scrutiny are forcing a rethink of sourcing and domestic manufacturing strategies. On the left, glowing white lines link icons that include email, search, users, data and sharing features. The web of icons floats above a city skyline with highways and factories in the foreground.

(SPEECH)
It was vet the vendor. Sign the contract. Move on. And that doesn't really work anymore. Federal scrutiny now demands visibility three or four tiers down your supply chain.

For example, can you trace your active pharmaceutical ingredient, known as an API, all the way back to the source? Many companies can't. And when a supplier three tiers down gets flagged for quality issues, geopolitical concerns or regulatory violations, your entire production could halt.

And we're also seeing a renewed federal emphasis on domestic manufacturing. In pharma, only 28% of API facilities are in the U.S. And COVID exposed how vulnerable we are when foreign suppliers shut down. And in fact, right now, Middle Eastern conflicts are blocking supplies through the Strait of Hormuz.

Helium for MRI machines is a perfect example. We can't get it through. So that's why companies need backup suppliers already in place. So rethinking supplier oversight really means three things. One is dynamic contracts. Require approval for any supplier process changes, switching suppliers or updating protocols.

Second, redundancy. Multiple suppliers for critical materials aren't optional anymore. If your sole API supplier experiences political turmoil or disaster, you need proven alternatives already in place. Third, independent verification. You need your own impurity testing at multiple points in the supply chain.

So quality control really has to extend beyond your four walls. And then legal review really matters here. You need expertise in international contract law, audit rights, and change control requirements that are already built in, not just indemnification clauses, so that supplier oversight needs that continuous visibility and control, especially as we navigate this transition towards more domestic U.S. manufacturing while still heavily relying on global supply chains.

JAMES STANDISH: So the supplier oversight is clearly becoming a visibility issue for the entire enterprise. So, Andrea, what do you see as risks that are emerging across vendor ecosystems and digital integrations?

ANDREA TASIK: That's such a great question. And I would also say that Jennifer makes excellent points here regarding the need for ongoing review and due diligence of global vendors and suppliers. But I just kind of want to call out, remember, we're not just talking about vendors or suppliers of hard goods.

Your vendor ecosystem includes IT companies supplying platforms or software tools to your organization that you rely on to perform within your organization. I think from the lens of cyber risk, vendor ecosystems create that invisible digital risk web, where cyber exposure exists across APIs, platforms and integrated systems.

(DESCRIPTION)
A blue circle contains a network with three nodes. Text: Vendor ecosystems create an invisible digital risk web. Exposure exists across APIs, platforms and integrated systems, including unmonitored data flows, shared credentials and limited visibility into vendor security practices.

(SPEECH)
And security risks within that web really include unmonitored data flows. Remember, where is the data going? It includes: What is the security risk among -- if you're sharing credentials? And it also poses some security concern if there's limited visibility into the vendor's own security practices.

So vendors also use AI, and they're supplying AI services to a firm. And that can also introduce additional exposures around data integrity bias as Dr. Minor had mentioned, privacy violations and intellectual property infringement.

So I would just say organizations really need to understand where their data resides, how it moves, how it's sourced and secured, and who has access to it across the vendor environment, and what they're doing with it, how they're securing it.

JAMES STANDISH: Great advice. Dr. Minor, how are the supply chain issues showing up in the clinical environments?

LLOYD B. MINOR:
(DESCRIPTION)
A blue circle contains an icon of a person with a bandaged head and arm in a sling. Text: Supply chain instability directly affects patients. Delays and variability in supply can directly affect clinical timelines and patient access to treatment, making this a patient safety issue, not just an operational one.

(SPEECH)
One way they're showing up is that prior to COVID, most healthcare organizations had used just-in-time strategy for ordering supplies, because there was a free flow of supplies and vendors that had a huge amount of expertise at delivering things and fulfilling orders very accurately and in a timely fashion.

Then, of course, as has been mentioned, supply chains got interrupted during COVID. And now the dilemma is, and there's still these concerns that Jennifer and Andrea covered about supply chain. So how much inventory does a delivery system maintain itself in its own warehouses with the complexity of expiration dates and other things?

And how much does the delivery system depend upon, say, a modified just-in-time approach? That's an active consideration and dilemma right now for most delivery systems.

JAMES STANDISH: That's all a very good segue into our next poll question. So if we could pull that up, please.

(DESCRIPTION)
Poll Question: Where do you see the greatest convergence of risk today? A, Digital systems and regulatory oversight, B, Supply chain and geopolitical exposure, C, AI-enabled products and liability risk, D, Growth, M&A and integration complexity. Blue circles contain icons that represent options A through D: networked nodes, a globe, a robot's head and line graph.

(SPEECH)
So the question is, where do you see the greatest convergence of risk today? Digital systems and regulatory oversight, supply chain and geopolitical exposure, AI-enabled products and liability risk, or growth M&A and integration complexity? Give it a moment.

Not surprisingly, it looks like AI-enabled products and liability risk is on a lot of folks minds. So why don't we go to our next question, which is around the timeline compression and the risk that cascades from that.

(DESCRIPTION)
Text: Q5: When a disruption occurs today, how quickly does it move from an operational issue to a broader business and financial exposure? On the right, colleagues meet with laptops, maps and snacks.

(SPEECH)
So Jennifer, when we have disruption today, how quickly does it move from operational to another broader business and financial exposure?

JENNIFER AMPULSKI: Well, I think the most significant change we're really seeing is how quickly issues can escalate and how they escalate differently than they used to.

(DESCRIPTION)
Text: How Fast Disruption Escalates. A blue circle contains a lightning bolt. Text: A single disruption can cascade simultaneously. Regulatory review, legal exposure and operational impact can occur at the same time, affecting financial performance, insurance and access to capital. On the right, a blue domino wobbles in a line of wooden dominoes. 

(SPEECH)
So again, five years ago, disruptions happened sequentially. You'd have the operational issue, then maybe the regulatory questions, then potential litigation. And you can address them one at a time. But today, single disruption triggers regulatory review, legal exposure and operational impact simultaneously. There's no sequence anymore. It's all happening at once. And here's what makes this particularly dangerous. These connections amplify everything. So, for example, the change healthcare ransomware attack is a perfect example. It didn't just affect one company. It cascaded across the entire healthcare ecosystem, disrupting claims, processing patient care and operations for providers nationwide. So one failure, systemic impact. And for life sciences companies, this creates a unique vulnerability because many are operating on grants, loans and investments with tight cash flow sometimes week to week, and they don't have the financial cushion to absorb extended downtime. It's not just the ransom or immediate costs. Any downtime is a financial loss that directly impacts their ability to operate. So companies are often forced to ask, how long can we afford to be down? Where do we invest our limited cash to diminish downtime? And what's our plan for maintaining operations when systems fail?

So that's where the governance becomes critical. Organizations need to adjust their decisionmaking processes to respond effectively. You can't wait for quarterly board meetings to address a crisis that's unfolding in real time. But what we're seeing, especially in M&A scenarios, is that compressed timelines often lead to gaps in governance.

And companies that are integrating systems, protocols and compliance frameworks too quickly create blind spots precisely when they're the most vulnerable. And these events don't just affect operations. They also affect financial performance, insurance renewability and access to capital.

So investors, regulators and insurers are watching how companies respond. And a poorly managed disruption can close doors to future funding. So the reality is what used to be a recoverable operational issue can now become a business-threatening event before leadership even understands the full scope. And that's the new trend line we're operating in.

JAMES STANDISH: So Andrea, Jennifer talked a little bit about those, that timeline compression, but also the nature of things happening simultaneously. And so how do you see cyber events amplifying across different systems given what she described?

(DESCRIPTION)
A blue circle contains an exclamation point icon. Text: Cyber events trigger multidimensional impact. Digital supply chains amplify disruption scale. Distributed work environments introduce additional exposure. Public perception can shift quickly, accelerating reputational risk.

(SPEECH)
ANDREA TASIK: Thanks, James. We've highlighted and discussed how cyber incidents can trigger that operational, regulatory and reputational impact on the organization all at the same time. It's that convergence of risk.

And when I think of digital supply chains, those increase the scale of the potential disruption, as Jen was pointing out. If those supply chains aren't operating securely, that exposes your organization potentially as part of being you're part of their downstream.

And so you become vulnerable to their cyber-related disruption, and that could end up being a disruption on your end. So when I think about distributed work environments and, again, the use of AI tools within those environments, if AI is being used without being monitored or checked for accuracy and security on either end, that may introduce additional exposure to loss of data and increased system security or vulnerabilities.

Use and access to AI tools by employees or contractors working on your behalf could also expose an organization to vulnerabilities within your own network if they're not checked for flaws or insecure or corrupt or poison code before being used and integrated into your digital ecosystem.

And so I think the presence and proliferation of these potential vulnerabilities could lead to significant disruption in your production or research. And then that can also shift public perception pretty quickly and could impact your organization's reputation and ability to get funding.

So I think these are all points we need to think about because of the convergence and the global scale of how we're all interconnected.

JAMES STANDISH: So Dr. Minor, what does this all mean for patient access and clinical timelines?

(DESCRIPTION)
A circle contains a network of connected nodes. Text: Instability in one part of the system affects outcomes in another. Disruptions affect patient access to care and treatment timelines. Overreliance on AI can also erode human judgment that must remain central to clinical decision-making, a risk that compounds when systems fail.

(SPEECH)
LLOYD B. MINOR: Well, one theme that emerges is that overreliance on any one single system is a mistake in this environment. And that applies also to AI, which again, as we've been saying, is transformative. And we're still at the very early stages of the applications of AI in various aspects of health and healthcare delivery.

But AI is fallible, and so we also don't want to lose the human skills and the background systems that we had and that we've relied upon before AI. We don't want to abandon those or set those aside too quickly, even as we lean into understanding the appropriate uses and opportunities that AI brings to us.

JAMES STANDISH: So from here, I think what we're going to do is we're going to move over to one of the most visible areas of convergence, which is where AI and product performance and liability intersect.

So, Jennifer, as AI becomes more embedded in the devices and workflows, how does our product liability exposure evolve?

(DESCRIPTION)
Q6: As AI becomes embedded in devices and clinical workflows, how does product liability exposure evolve? On the right, a gloved medical professional interacts with a digital display.

(SPEECH)
JENNIFER AMPULSKI: I was really fascinated to see that the poll question response really was focusing on AI and product.

(DESCRIPTION)
Text: AI and the Evolving Liability Landscape. A blue circle contains a robot icon. Text: Devices are no longer static, and neither is liability. AI-enabled products change post-deployment. Biased training data, corrupted data or unintended algorithm behavior can create liability where causation is hard to establish. On the right, a medical professional works with a robotic surgical system.

(SPEECH)
And as a former product liability lawyer, I love thinking about this. So AI fundamentally changes what we mean by product in product liability.

So traditionally, a medical device is a physical thing. It's a pacemaker or an implant. And product liability law is really built around that. Was there a design defect, a manufacturer's defect or a failure to warn? And for years, courts treated software as information, not a product.

That meant negligence, not strict liability. But that's shifting. When software is embedded in hardware or controls physical devices, like an automated dosing pump or a diagnostic tool, U.S. courts are increasingly willing to treat it as a product.

And the EU's 2024 product liability directive explicitly classifies software, including AI, as a product subject to strict liability. So with AI, the product can be an algorithm that learns and changes over time. It's not static, and that creates liability questions that everybody's still trying to figure out. If an AI diagnostic tool makes an error, where's the defect?

Is it in the algorithm's design or the training data? Is it because the algorithm learned from realworld data that introduced unexpected bias? Traditional product liability doctrines really struggle with that, because the defect might not have existed when the product was sold. It emerged later.

And then there's causation. An AI tool provides diagnostic data, and the patient has a bad outcome. Was it the AI? Was it the physician's judgment? Was it something else entirely? Proving causation in AI cases is going to be significantly harder than in traditional product liability cases.

So if courts and legislatures conclude that AI is a product like they have been doing with software, then traditional product liability law could apply, or we could see creative plaintiff's lawyers respond with entirely new theories of liability, like algorithmic negligence or failure to monitor.

So the question really isn't whether AI creates product liability risk because it absolutely does. The question really is whether companies are building the governance infrastructure to manage that risk before litigation hits.

JAMES STANDISH: So with the evolution of software and how the accountability can become harder to isolate, Andrea, I'm interested in how AI blurs the line between product and professional.

ANDREA TASIK: It's such a fascinating topic and question. (DESCRIPTION) A blue circle contains a stack icon. Text: AI blurs the line between product and professional liability. Systems functioning as decision support tools create hybrid exposures. Risk depends on autonomy, human oversight and the ability to explain system outputs. (SPEECH) I think Jen did a great job to give us some thoughts here. And I also heard Dr. Minor talk about how use of AI tools may function as both a product and a decision support tool, creating that hybrid exposure. And pulling on that thread a little bit more, and I think agentic AI tools illustrate that hybrid exposure really well. So agentic AI functions as an agent that acts on behalf of the user. Think about that. So what happens if it lacks appropriate or intentional guardrails designed to keep it and to stick within the boundaries of what it should or shouldn't do on your behalf? If the outcome isn't as expected and there are ensuing liabilities, damages or injuries to others as a result, to Jen's point, is it the software tool? Is the software tool responsible, or is the user responsible for the outcome? And as we've already discussed, the laws on who has the liability are still evolving on this question. And just from a cybersecurity standpoint, the level of risk can also depend on how autonomous your software tools are. So again, what are its guardrails, and how are you checking that it sticks to those guardrails? Where is the human oversight of that AI tool? Is there a human in the loop to check that it's not exfiltrating or processing data or money in a way you don't intend for it to do? Is it connecting to systems you authorized it to talk to and connect to?

I think we all need to remember or just think about we need to ensure that there's an ongoing way to check for that and to look for rogue or unintentional behavior. Having human eyes on the behavior of the software tool is important. And there are also additional software programs that can be used to help in conjunction with that.

Some of those may even be AI-enabled, but they can invalidate that monitoring as well. And I think a primary concern is that we're looking at how the tool is executing on your behalf and that you're also checking for vulnerabilities or security flaws that might alter its logic and resulting execution.

So further, if something goes wrong and impacts patient safety or security, is there a way to explain the system outputs. Like who's in charge of how it's acting? What are your contractual protections in using that AI software?

So just coming back to the blur between product and professional liability, I would agree. Traditional coverage models, they may not fully address these blended exposures, and it may not be enough to just purchase product liability insurance. If your product or service doesn't work as intended or as outlined in your contract with customers, is there a financial impact to those customers or users?

Could they suffer downtime, increased expenses or financial loss as a result of a defect or a security flaw in the products or services you are providing to them? Product liability alone may not address these expenses or financial losses. Errors and omissions insurance should be considered as a risk management vehicle for these scenarios and may help address allegations focused on your failure to perform as contracted or intended.

And then finally, you've got, I would say, cyber and media liability may help respond to privacy, security or intellectual property claims connected to products, services or systems.

JAMES STANDISH: So, Andrea, you mentioned the explainability there in your very good description. Dr. Minor, how important is that explainability for clinical adoption?

LLOYD B. MINOR: I think it's important.

(DESCRIPTION)
A blue circle contains a healthcare worker icon wearing a stethoscope. -- Text: Clinical adoption depends on trust, which requires transparency. Proper testing validation and explainability are essential to maintaining confidence among providers and patients as AI becomes embedded in care delivery.

(SPEECH)
Of equal importance is making sure that we have the processes and the right people convened. And by right people, I mean people representing a variety of different areas of expertise and also the public who are either using these AI tools or who are receiving healthcare that's being powered by these AI tools.

There's a need to convene experts with the public to really understand what the opportunities are, what the limitations are and how these models are trained, how they function, how much we understand about their function and how much we don't understand because of the complex statistical nature of the way in which the models work.

But we've had situations, perhaps not directly akin to the one we're in now, because AI really is, I think in so many respects, unique, but situations before where we've had new technologies that offer great opportunities for benefit but also clear risks.

And we work together as experts with the public, with policymakers to understand the responsible development and deployment of those technologies. And we need to be doing the same here.

JAMES STANDISH: So the theme that I'm picking up here is really that the governance has to evolve with the technology. So thank you all for your thoughtful responses. We're going to move into another area where the timelines can compress the M&A and private equity activity.

(DESCRIPTION)
Q7: Where do accelerated M&A and private equity integration timelines create governance and risk management blind spots? On the right, two professionals with briefcases shake hands near windows. (SPEECH) So Jennifer, with regard to M&A and private equity activity, where do these accelerated integrations create gaps and oversights or coordination or even enhanced risk or risk visibility?

JENNIFER AMPULSKI: So I have an example of where this goes wrong. (DESCRIPTION)

Text: M&A: Speed versus Governance. A blue circle contains a building icon. Text: Compressed timelines create immediate compliance exposure. Misalignment across regulatory and quality systems during integration can introduce exposure from day one. Vendor risk and cybersecurity posture are often not fully evaluated pre-close. On the right, a circuit board features circuit traces that connect microchips. (SPEECH) So if a PE-backed pharma company acquires, say, for example, a smaller R&D firm and the deal closes on a Friday, by Monday, they're often integrating IT systems to realize synergies, and within two weeks, they discover that the acquired company's quality control protocols don't align with FDA requirements for the parent company's existing product lines. But they've already merged manufacturing data systems. And so now you've got this governance nightmare whose SOPs are going to apply, whose quality standards. And if there's a product issue, can you even trace it back to the source? That's the blind spot. Speed kills due diligence. Now, private equity wants to show growth and operational efficiency quickly. That means consolidating vendors, merging manufacturing operations, integrating compliance systems, but in life sciences, you can't just flip a switch. You've got FDA-approved processes, validated manufacturing protocols.

You've got contractual relationships with contract manufacturing organizations and CROs that have specific quality requirements built in. And when you compress those timelines, here's what breaks down. First, usually it's regulatory compliance gaps. You're combining two different quality control frameworks, two different post-market surveillance systems.

And if you don't harmonize those before you integrate operations, you're creating that compliance exposure. And FDA doesn't care if you just closed an acquisition. Then there's the contractual and the vendor risk. Do the acquired companies supplier agreements allow for a change of control, and do their vendors meet your cybersecurity standards?

And here's another real example. If a company in mid-acquisition consolidates its CRO relationships to cut costs, but if you switch CROs mid-trial without proper transition planning, you risk compromising data integrity. And that's not just a delay. That's potential regulatory action that could derail your entire product pipeline.

(DESCRIPTION)
A blue circle contains an exclamation point icon. Text: Loss of institutional knowledge creates blind spots. Consolidation can disrupt compliance memory and operational continuity. Contractual obligations may be overlooked during rapid system integration.

(SPEECH)
And you've got institutional knowledge loss. When you are consolidating roles quickly, you lose the people who know which workflows are works in progress, which supplier relationships are already fragile and which regulatory submissions are pending.

So if that knowledge walks out the door and you're left with blind spots you didn't know existed, and the irony is that PE firms are trying to de-risk the investment by moving quickly. But in life sciences, moving too fast creates more risk than it eliminates.

JAMES STANDISH: So speed can create some hidden gaps, clearly. Dr. Minor, how do these pressures affect the clinical and operational environment?

LLOYD B. MINOR: I think clinical environments are particularly vulnerable to the risks that Jennifer just discussed.

(DESCRIPTION)
A blue circle contains a lab flask icon. Text: Clinical and care delivery systems are particularly vulnerable. Rapid integration can disrupt validated processes, affecting patient safety, trial integrity and care delivery. Cultural and operational differences compound the challenge.

(SPEECH)
Quality of care, quality of clinical care, is inextricably linked to alignment among various different aspects of a healthcare delivery organization.

That means physicians, nurses, people who are running the supply chain, everything has to be aligned, and there has to be good communication across all levels of that ecosystem in order for it to run safely, efficiently and effectively.

And if there are changes in leadership that affect large components of a delivery system, such that those lines of communication, the transparency, the relationships that have been relied upon to establish alignment, if those are changed rapidly and without a thought as to what the endpoint will be and how people will work together in a new ecosystem, then that frequently leads to disruptions and interruptions in quality and access to care and the efficiency and effectiveness of care.

JAMES STANDISH: This has been just a fascinating conversation. I can't believe we're 50 minutes in. I'm going to call a little bit of an audible. And we had a question about the manufacturing and physical exposure. But I'm going to go right to the leadership question, because I think it's just a really insightful one.

(SPEECH)
So in taking this to the leadership level, if risks are converging and compounding, what should executive teams think about to ensure that their risk management and oversight and decisionmaking keep pace with innovation.

(DESCRIPTION)
Text: Q9: If risks are converging and compounding, what should life sciences executive leadership focus on to ensure governance keeps pace with innovation? On the right, glowing financial graphs encircle a transparent globe.

(SPEECH)
So in other words, how do we build an organization that can move quickly while maintaining control, visibility and accountability. So, Dr. Minor, I'll put that one to you first.

LLOYD B. MINOR: Sure. I think we've covered several elements of what's really important in managing compounding risks.

(DESCRIPTION)
Text: Building Governance That Scales with Innovation. A blue circle contains chess piece icons. Text: Address risk at the enterprise level, not in silos. Visibility into interconnected systems and partners is essential. Scenario planning helps prepare for cascading events before they occur. On the right, mirror fragments reflect high-rise buildings and clouds.

(SPEECH)
One is to address the risk at the enterprise level. Healthcare organizations are big. They're complex. And certainly each of us has our area of responsibility within the organization.

But we can't lead organizations. We can't think of ourselves as being in silos. We have to think of ourselves as being a part of an ecosystem that's interdependent and that relies upon alignment and good communication across all different aspects of that ecosystem.

So I think that's the first thing to be kept in mind that these organizations have to work as one enterprise with a lot of interconnected elements and good coordination among those elements.

JAMES STANDISH: Jennifer, how about you?

(DESCRIPTION)
A blue circle contains a handshake icon. Text: M&A is a key inflection point for governance gaps. Systems and data integration during M&A is a leading disruption trigger. Technology connectivity and user adoption must both be planned for early, not retrofitted after close.

(SPEECH)
JENNIFER AMPULSKI: Well, I'm probably not going to be any surprise based on my prior responses that M&A is where I see governance breaking down the fastest, especially around systems and data integration.

And the mistake companies make is treating integration as a technical project. But it's not. It's a people problem. You're merging different data architectures, different workflows, different cultures. And if the users can't adopt the new systems or they don't trust the data, your integration fails regardless of how good the technology is.

So my advice is to plan early. Before the deal closes, map out your integration gaps, not just the systems, but the workflows and the culture, and run pilot programs to test integration approaches before you go live across the organization. And make sure you're not just connecting systems. You're connecting people to those systems in a way that actually works. Because the fastest way to create risk is to move fast without bringing your people along.

JAMES STANDISH: Andrea, how about you?

ANDREA TASIK: I understand the full digital ecosystem -- how data, people, operational processes, technology tools and who you're partnering with outside your organization are connected.

(DESCRIPTION)
A blue circle contains an Update Manager shield icon. Text: Focus on resilience, not just prevention. Digital systems are now core operational infrastructure. Resilience means response, recovery and continuity planning, not just security protocols.

(SPEECH)
And then prioritize data security, data integrity and compliance.

And if you're reliant on AI tools to help speed innovation and improve those operational efficiencies, ensure you have a way to check to make sure that it's working the way it should and the way you want it to. Maintain your visibility into how AI is connecting to other systems, particularly with third parties and how your employees are using it.

And then I just have to say, make sure any cybersecurity framework is inclusive, not only of security tools to prevent or mitigate a security breach, but also includes a playbook for how to respond to a privacy or security event post-incident and how your organization is going to respond and recover in a resilient manner so it's less disruptive down the line and less disruptive to others that you may work with.

JAMES STANDISH: Great responses. And just to wrap us up, before we get to our final takeaway thoughts, what really stands out here is that this transcends just managing individual risks. This is about how organizations can connect the dots across systems and teams and across decisions.

And that really goes to clear accountability, strong visibility, strong into the operations and the ability to respond quickly when something changes. And I think it's also about reinforcing the strong controls and ensuring that the right information, people and processes are aligned across the enterprise.

So I really appreciate all of your thoughtful responses. And so in closing and in wrapping up, we'd like to ask just of each of you, what's the single most important takeaway you would have for this audience from our talk here today?

(DESCRIPTION)
Q10: As we wind down: What is the single most important takeaway you want our audience to remember? On the right, one red block stands out among wooden blocks.

(SPEECH)
Dr. Minor, we'll start with you.

(DESCRIPTION)
Text: Key Takeaways. 1, Dr. Minor: The U.S. life sciences ecosystem depends on sustained collaboration across academia, government and the private sector. Maintaining trust, transparency and clinical integrity is essential as innovation accelerates.

(SPEECH)
LLOYD B. MINOR: Well, the single most important takeaway, this is a very exciting time with a lot of opportunities. The life sciences ecosystem in the United States is particularly effective and impactful because of the interaction and convergence of what goes on across academia, government and the private sector.

And that convergence has led to many, many advances in human health and will continue to do so. But it requires nurturing, and particularly that nurturing is even more important now because of this rapid acceleration in the pace of innovation that's been brought about by AI and I think will continue to have profound accelerating effects in the months and years to come.

I think this is the most exciting and impactful time in biomedicine since the introduction of antibiotics, and we should all work together to make sure that AI and related technologies, as well as our focus on delivering the best care we can to every patient and to increasingly move into the area of preventing disease in addition to treating disease once it occurs.

Those are the areas where we need to establish our focus and remain really dedicated to making sure that we do the very best in order to provide the very best care for the people that depend upon us to do so.

JAMES STANDISH: Jennifer, your takeaways for risk leaders.

(DESCRIPTION)
2, Jenn Ampulski: Risks are no longer isolated, they are interconnected and can escalate quickly. Organizations that navigate this well are those that align innovation with governance, documentation and risk management early.

(SPEECH)
JENNIFER AMPULSKI: Well, I kind of like Dr. Minor's. So I want to say ditto. But from a life sciences risk management perspective, I guess really what I'd like everybody to remember is that life sciences companies that manage risk aren't the best ones or aren't the -- if they're managing their risk the best, they're not the ones necessarily with the most coverage. They're the ones who are treating their insurance and risk partners as strategic advisors, not just policy vendors, because those risks are cascading faster than ever, and your growth can outpace your governance infrastructure. So traditional insurance products weren't built for the exposures that you're facing right now. So I advise you. Ask the hard questions. Stress test your assumptions. Build the partnerships before you need them. Align the innovation with governance early, not after something goes wrong, because the goal isn't to slow innovation, it's to build the infrastructure that lets it scale responsibly.

JAMES STANDISH: Practical advice indeed. Andrea, what should the audience members think about from a cyber and technology standpoint?

ANDREA TASIK: Digital systems and AI are the engines of operational infrastructure now, and they should be managed with that level of importance. 

(DESCRIPTION)
3, Andrea Tasik: Digital systems are core operational infrastructure. Resilience, not just prevention, including response, recovery and continuity planning, must be a leadership priority. 

(SPEECH)
Visibility into systems, vendors and data flows is essential to understanding exposure and where you might be vulnerable within that digital ecosystem. And organizations really need to focus on prevention but really on resilience. It's not just about prevention including response. It really needs to be prevention, response and recovery, including that continuity planning.

JAMES STANDISH: Well said. Well, in closing, just a couple of closing themes. Obviously innovation is advancing, and interdependency is increasing. And that has made risk more interconnected. 

(DESCRIPTION)
As we close: Innovation is advancing and interdependency is increasing. Risk is becoming more interconnected across systems, stakeholders and outcomes. Strong governance supports sustained resilience and long-term enterprise value. Insurance, legal and risk partners should be treated as strategic advisors. Blue circles contain icons for each point: a rocket ship, a network with three nodes, an Update Manager shield and a handshake. 

(SPEECH)
And for life sciences organizations, the focus is shifting from managing isolated risks to building the alignment and visibility and internal discipline that we need to navigate this complexity. So those are the complexities that can help -- capabilities that can help organizations remain resilient while continuing to innovate. So with that, I want to thank our panelists for their time and expertise today, and I want to thank everybody on the line for joining us. I hope you have a wonderful rest of the day, and thanks for being with us.

(DESCRIPTION) 
A globe and stethoscope glow. Text: Thank You. The Convergence Conundrum: Managing Risk at the Crossroads of Life Sciences Innovation. Copyright 2026 The Travelers Indemnity Company. All rights reserved. This presentation is for informational purposes only.

Logo: Travelers. Text: Learn more at travelers dot com slash life sciences. Copyright 2026 The Travelers Indemnity Company. All rights reserved. Travelers and the Travelers umbrella logo are registered trademarks of The Travelers Indemnity Company in the U.S. and other countries.