When innovation outruns governance

A child receives a one-time gene therapy that could deliver benefits for decades. A clinician uses AI to support a diagnosis. A patient with a chronic condition shares health data continuously through a connected device at home.

Each scenario would have seemed extraordinary only a few years ago. Today, they are edging closer to everyday healthcare.

Life sciences is entering one of the most innovative periods in its history. Artificial intelligence is accelerating discovery, precision medicine is tailoring treatments to smaller patient groups, and cell and gene therapies are changing what may be possible from a single intervention. Yet the systems surrounding these innovations are not advancing at the same speed.

According to Zurich’s Beyond 2030: The Future of Life Sciences report, many of the sector’s greatest challenges are now emerging after discovery, in the evidence, infrastructure, institutions and economic models needed to turn scientific advances into safe, scalable and insurable outcomes.

“The pace of innovation is extraordinary,” says Asha Patel, International Head of Life Sciences at Zurich Insurance. “But innovation rarely happens in isolation. Every breakthrough sits within a broader ecosystem of patients, regulators, healthcare providers, technology platforms and manufacturers. The challenge is ensuring those systems evolve as quickly as the science.”

New technology, new accountability questions

Historically, responsibility in healthcare was relatively clear. A treatment was developed, approved, prescribed and administered. Regulatory frameworks, professional responsibilities and insurance solutions grew around those established pathways.

Today’s healthcare landscape is harder to divide into distinct roles. Digital health platforms, connected medical devices, AI-assisted decision-making tools and personalised therapies are creating new relationships between patients, clinicians, technology providers and life sciences companies. By the end of 2025, the U.S. FDA's public list contained more than 1,450 AI-enabled medical devices, up from fewer than 1,000 little more than a year earlier. As software becomes embedded in diagnosis, monitoring and treatment, traditional definitions of accountability are becoming harder to apply.1If an AI-powered system contributes to a clinical decision, responsibility may extend beyond the clinician who used it. The model’s developer, the organisation that supplied its training data, the healthcare institution that deployed it and the company responsible for monitoring its performance may all form part of the chain.

Questions also arise after treatment. A one-time therapy may require patients to be monitored for years, but responsibility for that follow-up may become unclear if a patient changes provider, a manufacturer withdraws from a market or monitoring depends on a third-party digital platform.

These are not simply questions about whether a product works as intended. They concern who owns the data, who monitors changes in performance, who acts when warning signs appear and who bears the consequences if part of the system fails. Liability may no longer follow a single product or decision. It may sit across a sequence of decisions made by different organisations.

For risk managers, the practical task is to identify those handovers. Where does one organisation’s responsibility end and another’s begin? Who is required to retain evidence, monitor outcomes or respond to an incident? If those questions remain unanswered, a technically successful innovation can still produce an unmanaged liability.

When healthcare inherits technology risk

This dispersal of responsibility reflects a wider change. Healthcare is becoming dependent on technologies and infrastructure that sit outside its traditional boundaries.

Artificial intelligence, cloud computing, connected devices and digital platforms are becoming integral to diagnosis, treatment and patient monitoring. Large datasets may support research and clinical decisions. Cloud services may hold critical information. Software updates may alter how a medical device performs after it has entered use.

As a result, it is becoming harder to separate clinical risk from technology risk. The exposure is not theoretical. Healthcare was the most targeted critical infrastructure sector in the U.S. in 2025, experiencing 460 ransomware attacks and 182 data breaches.²

A cyber incident may suspend access to patient information or interrupt clinical operations. A software defect could affect a device or influence a treatment decision. An outage at a cloud provider might prevent clinicians from accessing data when it is needed. A compromised data pipeline could undermine both patient care and the evidence used to demonstrate a product’s safety or effectiveness.

The same event can therefore create several forms of loss. A technology failure may lead to operational disruption, regulatory scrutiny, financial loss and potential patient harm. It may also raise difficult questions about which organisation was responsible for preventing the failure and which insurance policy should respond.

“The risks that organisations face are becoming more interconnected,” says Patel. “Clinical, digital, operational and liability exposures can no longer be managed in isolation. A decision made in one part of the value chain can have consequences across several others.”

The risk is amplified by concentration. Several companies may rely on the same cloud provider, contract manufacturer, data source or specialised technology platform. A failure at one supplier can then affect multiple products, trials or healthcare providers at once.

For insurers and risk managers, the important question is not only whether a supplier can be replaced. It is how long replacement would take, whether data and systems are portable, whether regulatory approval would be affected and how widely losses could accumulate before operations resumed.

Move risk decisions closer to discovery

These changes have an important consequence: Risk management cannot begin only when a product is approaching launch.

Many of the conditions that determine whether an innovation can reach patients are established much earlier. The selection of data sources, cloud providers, manufacturing partners and technology platforms can create dependencies that are expensive or impractical to reverse. Decisions about product design can also determine what evidence must be collected, how patients are monitored and where future liability may arise.

The report argues that constraints such as data governance, evidence requirements, trade policy, pricing and reimbursement need to be considered earlier in development. AI may accelerate target identification and early research, but evidence generation, clinical development, manufacturing, reimbursement and adoption remain difficult, costly and time-consuming. It still takes around a decade and can cost well over USD 1 billion to bring a new medicine to market, while fewer than one in ten drugs entering human trials ultimately receive approval.3

Governments are adding another layer of uncertainty. Manufacturing capacity, clinical research, health data and specialised technologies are increasingly being treated as issues of resilience and national security. Policies designed to secure supply chains, strengthen domestic production or protect strategic assets may influence where companies can conduct research, which partners they can use and how data moves between markets.

Looking ahead

For insurers and risk managers, the task is to understand the connections between clinical, operational, cyber, regulatory and supply-chain exposures, model how disruption might spread and determine whether existing controls and insurance arrangements still reflect an organisation’s changing exposure.

When innovation moves faster than governance, those connections are where the most consequential gaps are likely to appear.

The aim is to avoid discovering too late that a breakthrough depends on a capability the organisation cannot access, replace or adequately insure.