Compliance Stuff

On June 10, 2026, nineteen states and the District of Columbia filed suit in the District of Maryland seeking to halt implementation of Executive Order 14398, which was issued on March 26, 2026. The order requires federal agencies to insert a mandatory contract clause into all contracts, subcontracts, and “contract-like instruments” prohibiting contractors from engaging in “racially discriminatory DEI activities.” Compliance with the new clause is an express condition of eligibility to contract with the federal government, and consequences for noncompliance specifically include contract cancellation, exclusion from future federal contracts, suspension, and False Claims Act (FCA) liability . Filed as Maryland v. Hegseth , the complaint comes just two months after the administration announced its first False Claims Act resolution under the Civil Rights Fraud Initiative, a $17 million settlement with IBM. The IBM Settlement In April, IBM agreed to pay $17,077,043 to resolve allegations t...

New York lawmakers ended the 2026 legislative session by passing a wide range of workplace bills that could affect severance agreements, employment contracts, job postings, personnel files, wage-and-hour practices, arbitration, artificial intelligence, and workers’ compensation. While none of these measures are law yet, many are expected to be sent to Governor Hochul for consideration later this year. Some of the proposals would take effect immediately if signed, leaving employers little time to update policies, agreements, and compliance practices. Here are the top bills employers should know about and begin preparing for. Note: Even if Governor Hochul signs a bill, she may do so with an agreement that lawmakers will add chapter amendments when they return next session. Employers should confirm final action before treating any proposal as effective. Severance Agreements and Employment Contracts The No Severance Ultimatums Act ( S372A ) Employers offering covered severance agreements w...

The Trump administration has continued its efforts to step back from enforcing “unintentional” workplace bias liability and is focused on intentional discrimination instead. The EEOC announced earlier this month that it would continue to only prioritize enforcement in intentional discrimination cases (known as disparate treatment liability ), with a focus on bias in DEI programs. The agency will not focus on workplace discrimination stemming from a policy or practice that unintentionally discriminates against a population of employees (which is known as disparate impact liability ). Notably, the Department of Justice (DOJ) backed that position in a June 9 memo giving its opinion that the disparate impact theory of liability is likely unconstitutional. According to the DOJ, the government has been holding employers to an unfairly high standard when it comes to defending everyday workplace practices like background checks, skills tests, and education requirements . The DOJ’s position h...

Data breaches and website tracking technologies may seem like distinct privacy risks, but the California Supreme Court’s recent decision in J.M. v. Illuminate Education could affect litigation involving both. Businesses that collect sensitive information should review how they characterize, protect, and share that information, as plaintiffs will likely rely on the decision to challenge both cybersecurity practices and disclosures involving website tracking technologies. The case arose from a cyberattack on a K-12 education software provider that stored student health-related information. A student filed a putative class action alleging violations of California’s Confidentiality of Medical Information Act (CMIA) and Customer Records Act (CRA) . Although the California Supreme Court ultimately held that Illuminate was neither a covered health care provider under the CMIA nor subject to liability under the CRA because the plaintiff was not a “customer,” it adopted a broader standard for ...

What: The Federal Acquisition Regulatory Council (FAR Council) issued the first four proposed rules to implement Executive Order (EO) 14275, Restoring Common Sense to Federal Procurement, covering 20 parts of the Federal Acquisition Regulation (FAR), including the related clauses and forms in Parts 52 and 53. (The proposed rules can be found here , here , here , and here .) The FAR Council intends to issue a total of 12 proposed rules that collectively will revise the entire FAR. This formal notice-and-comment rulemaking represents Phase Two of the “ Revolutionary FAR Overhaul ” (RFO) process that began in 2025, when the FAR Council issued a series of model class deviations to the FAR that virtually all federal agencies have adopted. The proposed rules incorporate and build on general changes from the RFO class deviations, such as reorganizing the FAR Parts to follow the phases of the acquisition process, revising text to use plain language, and relocating examples of best practices a...

The federal government has issued a sweeping proposed rule that could significantly reshape cybersecurity and compliance obligations for federal contractors that handle Controlled Unclassified Information (CUI). If finalized, the new Federal Acquisition Regulation (FAR) provisions would establish a governmentwide framework governing how contractors identify, safeguard, report, and manage CUI across civilian and defense contracts, while imposing substantial new compliance responsibilities that extend far beyond existing requirements such as the Department of Defense’s current cybersecurity rules. For contractors that do business with the federal government, the proposed rule signals an important shift toward more uniform and significantly more demanding CUI compliance obligations. A Governmentwide CUI Framework Is Taking Shape Historically, cybersecurity and information protection requirements related to sensitive government information have varied significantly across agencies. While...