A new study of neurotechnology firms found a striking disconnect: while companies developing brain-reading devices regularly interact with medical device regulators, almost none engage with data protection authorities. The Organisation for Economic Cooperation and Development released the findings in a recent paper examining governance strategies for the rapidly expanding field of neurotechnology, which uses AI-powered tools to interpret human brain signals. The report draws on research from two policy groups — one comprising officials from national data protection agencies and privacy experts, the other made up primarily of neurotechnology specialists.
The paper includes a study that surveyed 16 companies building neurotechnology products across six OECD countries. Those firms generally sort their data into four main buckets: non-physiological information, physiological readings, "inferred data" generated when AI models analyze brain activity to draw conclusions about someone's emotions or mental state, and ancillary information like medical device metadata. The participating companies reported that brain data "serves very different functions" depending on the application — scientific researchers use distinct types of neurotechnology tools compared to those deployed in clinical settings, producing different categories of brain data and creating a wider spectrum of privacy risks.
According to Jared Genser, managing director of Perseus Strategies and outside general counsel to the Neuro Rights Foundation, "dozens" of commercial entities are now developing consumer neurotechnology products that rely on various forms of brain data. "What I found most interesting was the mismatched regulatory engagement," Genser said, highlighting the gap between medical device oversight and data protection authority involvement. The report finds that because brain data "is collected, processed and monetized in such different ways, a one-size-fits-all approach isn't likely to be effective," and that governance frameworks need to account for the specific context, purpose, and risk profile of different neurotechnology applications.
The OECD attributes the governance challenge partly to how AI has "started to become very central to neurotechnology" while legal frameworks governing medical devices and data privacy remain in flux. The report notes that ongoing uncertainty around brain data classification and the interplay between medical device rules, AI regulations, and privacy frameworks creates confusion that most companies flagged as an area needing greater clarity. Technological advances are outpacing regulatory guidance, the paper explains, and adaptive AI systems face mounting regulatory and legal uncertainties as the industry expands and integrates with artificial intelligence and other technologies.
The report offers five broad policy recommendations, including introducing regulations that clarify controller and processor responsibilities for brain data, provide certainty on how to classify neurodata, strengthen data infrastructure through common standards and secure sharing mechanisms, and improve international cooperation. The U.K.'s Information Commissioner's Office is already acting on these concerns — the agency is targeting early 2027 to release neurodata privacy guidance for public consultation, aiming to provide "regulatory certainty" before consumer neurotechnology devices become widely available. The report concludes that effective governance should be risk-based, context-specific, innovation-friendly, and privacy-protective — a rare opportunity to set safeguards while the sector is still taking shape.