How Trump’s AI orders could throw states for a loop

The White House AI Action Plan's directive to remove diversity, equity, and inclusion references from NIST's AI framework is poised to complicate state-level healthcare AI regulations, potentially undermining efforts to prevent algorithmic discrimination in areas like insurance across numerous states. Concurrently, European healthcare systems face escalating and costly cyberattacks, predominantly ransomware, underscoring critical underinvestment in cybersecurity despite recent EU initiatives to bolster resilience, posing significant operational and financial risks.

Analysis

The US healthcare and insurance sectors face significant regulatory uncertainty following a White House directive for the National Institute of Standards and Technology (NIST) to remove diversity, equity, and inclusion (DEI) references from its AI guidance. This policy shift directly conflicts with regulations in at least 24 states that utilize the NIST framework to prevent algorithmic discrimination, creating a complex compliance environment and heightening legal risks for companies deploying AI in areas like insurance claims. The move also introduces ambiguity for enforcing specific state laws in places like Colorado and California and creates a potential conflict for multinational corporations navigating stricter EU AI regulations. Concurrently, the European healthcare sector is confronting a critical and costly cybersecurity crisis, marked by 309 incidents in 2023, with ransomware attacks being the dominant threat. The financial impact is substantial, with incidents costing an average of €300,000 and posing direct threats to patient safety. This vulnerability is exacerbated by systemic underinvestment, as only 27% of EU healthcare organizations have a dedicated ransomware defense program and 40% lack basic security training for non-IT staff. While the EU has proposed an action plan, its perceived lack of clear targets and funding suggests that near-term risks will remain elevated.

Key Decisions for Investors

• Investors should intensify due diligence on US health insurance and healthcare technology firms utilizing AI, as the removal of DEI guidance from the NIST framework introduces significant regulatory and legal risks across the 24 states relying on its standards.
• The critical underinvestment in cybersecurity within the European healthcare sector, where only 27% of organizations have ransomware defense programs, presents a clear growth opportunity for cybersecurity firms specializing in ransomware protection and compliance solutions for highly regulated industries.
• It is prudent to assess the operational resilience of healthcare portfolio holdings, favoring organizations with transparent, robust cybersecurity investment and independent AI ethics frameworks to mitigate exposure to costly service disruptions and regulatory penalties.
• Monitor the strategic responses of multinational technology and healthcare companies to the diverging US and EU AI regulatory landscapes, as their ability to manage this compliance friction will be a key performance differentiator impacting legal costs and market access.