Q3 2025 compliance & remediation update

Introduction

Welcome to our Turnberry compliance and remediation update for Q3 2025.  Each quarter, our C&R team will present a brief rundown of the latest news and analysis of recent compliance, regulation, and security trends. 

The goal of our newsletter is to increase awareness of the challenges, risks, and opportunities we face as we help our clients navigate their compliance and remediation journeys.  We also hope to inform our team members of the latest trends in compliance, including changes presented by AI, new regulations, and global events.

This quarter’s contents:

• Trending topic: F6
• AI governance proposals: UN and US

Trending topic: F6

The medical and pharmaceutical industries are constantly evolving.  From new medical breakthroughs to evolving technology and changing political environments, companies in these industries need to respond and adapt to changes on many fronts.

Recently, a major revision to the rules that govern electronic transactions was finalized.  Known as “F6,” the changes present industry-wide challenges to companies as they work to maintain compliance.

Background and current status:

The F6 Final Rule refers to the U.S. Department of Health and Human Services’ (HHS) adoption of updated versions of the National Council for Prescription Drug Programs (NCPDP) standards for electronic retail pharmacy transactions.  The main goal of the update is to enhance the efficiency and accuracy of electronic transactions within the healthcare system.

The F6 final rule brings many enhancements to the NCPDP standard, including:

• Improved data exchange capabilities
• Refined fields to differentiate various types of fees, including taxes, regulatory fees, and medication administration fees
• Increased dollar amount field length to accommodate high-cost drug therapies. This is a much-needed change, as several specialized drug therapies cost more than $1M per dose

In addition, the F6 changes are expected to help facilitate accurate reporting of partial fills for schedule II drugs.  Schedule II drugs are pharmaceuticals that have a high potential for abuse (for example, opioids).

The F6 final rule also finalizes the adoption of the following NCPDP guides:

• Batch Standard Implementation Guide (Version 15).  Implementing this guide will help ensure consistency across transaction types
• NCPDP Batch Standard Subrogation Implementation Guide Version 10.  This guide expands the use of subrogation transactions beyond Medicaid agencies to all health plans.  An example of subrogation is an insurance company representing an insured person to recover losses from a third party (e.g., a medical provider).  Version 10 will help improve tracking of subrogation efforts and support cost containment across all health plans

Implementation timeline:

The final rule became effective on April 14, 2025 (delayed from February 11, 2025). The effective date of the rule was delayed by 60 days, largely due to an administrative review following the presidential transition. Entities are required to comply with the new versions within 36 months after the effective date.

Current status:

As of this writing (October 2025), the implementation of the F6 final rule is progressing according to schedule. To facilitate a smooth transition, an 8-month period will begin after the 28-month period post-effective date, during which covered entities (by mutual agreement with their trading partners) may use either the old or new standards. This transition period is designed to allow entities to adapt their systems and processes before full compliance becomes mandatory.  The current start date for the 8-month transition period is August 11, 2027. Full compliance by all covered entities is required by February 11, 2028.

WIIFM (Turnberry)

The adoption of F6 presents many opportunities for Turnberry to assist our clients. 

The transition to version F6 requires significant updates to existing pharmacy management systems and claims processing software. This creates a demand for our team to help implement solutions that comply with the new standards.  Pharmaceutical companies, healthcare providers, and insurance companies will need guidance to navigate the complexities of implementing F6.  Ensuring adherence to the new standard is critical to avoid regulatory penalties.

Turnberry can offer expertise in project management, workflow analysis, and compliance strategies. Additionally, we can develop programs to educate staff on the new standards, ensuring a smooth transition and minimizing operational disruptions. 

AI governance proposals: UN and US

As discussed in our Q1 edition, the US has lagged behind both China and the European Union in implementing comprehensive AI regulation.  Since the beginning of the year, there has been no significant advancement in AI regulation in the United States.  That said, there have been efforts at the state level (see Q2 C&R newsletter), as well as the UN, to try and create an AI governance framework.

In August, the United Nations passed a resolution to set up a global scientific panel and a governance forum. The goal of the panel is to ensure AI is developed and used safely, ethically, and inclusively. It is hoped that the panel and forum will provide guidance for sustainable development, excluding military applications.

The Independent International Scientific Panel on AI will consist of 40 experts, and produce an annual evidence-based, non-prescriptive report, along with thematic briefs. It will report directly to the UNGA and provide content for the AI governance global dialogue.  The global dialogue will focus on AI safety, human rights, ethics, open-source AI, and bridging capacity gaps in developing countries. 

As of October 2025, the panel has not yet been officially constituted. However, calls for nominations to the panel have gone out. The first annual assessment is expected around July 2026.

Meanwhile, there have been federal-level proposals and some laws related to artificial intelligence in the U.S. since the beginning of 2025. Two acts have been passed at the federal level:

• TAKE IT DOWN Act – Enacted May 19, 2025. This law addresses non-consensual intimate imagery (including deepfakes) by requiring platforms to remove such content within 48 hours and criminalizes certain misuse.
• GENIUS Act – Passed July 2025. While not strictly an AI regulation bill, it governs stablecoins (a type of cryptocurrency). The act is an example of tech-adjacent regulatory activity at the federal level.

There are also a couple of acts currently under consideration. The CREATE AI Act of 2025 (H.R. 2385) would establish a National Artificial Intelligence Research Resource, and encourage development of AI by all sectors of the US. The act is still in legislative stages. Meanwhile, the SANDBOX Act seeks to create regulatory “sandboxes” for AI companies to test products under relaxed regulation, with federal oversight and accountability mechanisms.

Balancing innovation, safety, competition, and civil rights continues to be a central tension between the federal government and individual states. Proposed bills like SANDBOX and CREATE AI are an attempt to thread the needle between the two entities. However, while federal agencies continue to lean on existing laws and guidance to address AI issues (privacy, discrimination, safety), legislators at all levels believe new, AI-specific federal legislation is still needed. State‐level regulation is moving fast; many laws are being passed in states, especially around transparency, bias, harassment/deepfakes, etc. Their proliferation makes federal preemption an active subject of political debate.

WIIFM (Turnberry)

Turnberry Solutions can help U.S.-based clients navigate current and emerging AI regulations by aligning business practices with leading frameworks like the NIST AI risk management framework and federal guidance such as OMB M-24-10. We support clients in building AI governance structures, risk assessments, and compliant operating models.  Turnberry can also conduct bias audits and transparency reporting for HR and high-risk AI systems, and prepare for state-specific laws like Colorado’s AI Act. Our offerings also extend to regulatory horizon scanning, marketing and claims compliance to avoid FTC pitfalls, and readiness programs tailored for federal contractors and agencies.

Turnberry clients can leverage our powerful Cmpli.ai tool to help streamline risk reviews, automate internal policy mapping, and reduce manual compliance efforts. Cmpli.ai delivers essential capabilities, including real-time control mapping to internal policies, AI-assisted risk analysis with citations, and alignment with regulatory guidelines from agencies such as the FDA, SEC, or an organization’s internal knowledge and compliance repository. 

By combining governance design, technical testing, and regulatory strategy, Turnberry provides clients with a practical path to compliance while strengthening trust, accountability, and innovation in their AI initiatives.