Compliance Stuff

What: The Federal Acquisition Regulatory Council (FAR Council) issued the first four proposed rules to implement Executive Order (EO) 14275, Restoring Common Sense to Federal Procurement, covering 20 parts of the Federal Acquisition Regulation (FAR), including the related clauses and forms in Parts 52 and 53. (The proposed rules can be found here , here , here , and here .) The FAR Council intends to issue a total of 12 proposed rules that collectively will revise the entire FAR. This formal notice-and-comment rulemaking represents Phase Two of the “ Revolutionary FAR Overhaul ” (RFO) process that began in 2025, when the FAR Council issued a series of model class deviations to the FAR that virtually all federal agencies have adopted. The proposed rules incorporate and build on general changes from the RFO class deviations, such as reorganizing the FAR Parts to follow the phases of the acquisition process, revising text to use plain language, and relocating examples of best practices a...

WHAT: The Office of Management and Budget (OMB) issued a proposed rule that would revise the government-wide regulations for the management of federal grants, cooperative agreements, and other forms of federal financial assistance under 2 CFR, subtitle A. According to OMB, the proposed revisions are intended to improve transparency, accountability, and oversight for awards across the federal government, while also reducing the burden on recipients. Notable key provisions include: Rebranding the existing “Uniform Guidance” at 2 CFR Part 200 as the “Uniform Grants Regulation” (UGR) and clarifying that the regulatory text of 2 CFR, subtitle A is “an OMB regulation” that carries “regulatory effect in [its] own right”; Elimination of fixed-amount awards and fixed-amount subawards, which OMB found “can limit transparency and hinder effective oversight”; New prohibitions on using federal awards to “fund, promote, encourage, subsidize, or facilitate” DEI policies; A new prohibition on “disc...

Agentic artificial intelligence (AI) is the next frontier for companies and organizations that are using AI. Agentic AI can select and carry out actions on a user’s behalf based on instructions, context, and the permissions it has been configured to use . As organizations integrate these systems and capabilities, they face an additional layer of legal risks and governance concerns. As companies begin to use agentic AI, they should consider key risk management practices to ensure responsible adoption . This includes aligning with emerging best practices and standards being studied and promoted by the National Institute for Standards and Technology (NIST) around agentic AI, including the Center for AI Standards and Innovation (CAISI) AI Agent Standards Initiative and the National Cybersecurity Center of Excellence Project addressing Software and AI Agency Identify and Authorization . For example, organizations utilizing agentic AI should look more closely at how the authority of AI age...

Reports that new, advanced AI models are capable of finding unknown and potentially dangerous software vulnerabilities at record speeds have been a focus for cybersecurity professionals over the past several weeks. The gravity and novelty of the potential threat have now drawn attention from across industry and the U.S. government. The White House Office of the National Cyber Director, for example, is reportedly convening industry roundtables, and technical experts have begun to offer initial recommendations. AI-driven vulnerability discovery capabilities, if used by malicious actors, could make it dramatically easier and faster for even low-skill criminals (let alone nation-state hackers) to find and take advantage of vulnerabilities. So what should companies be doing now? The capabilities described would appear to give the advantage to malicious cyber actors, because significant and previously unknown “zero day” vulnerabilities can be found and exploited in a matter of hours. T...

The 8(a) Business Development Program has garnered intense scrutiny from the Trump Administration over the past few months.  See  here ,  here  and  here . This focus continues with three significant developments in 2026: Secretary Pete Hegseth’s January 16 announcement on X of a Department of War audit of 8(a) sole-source contracts, the Small Business Administration’s (SBA) January 22 guidance restructuring how the 8(a) program is administered, and SBA’s issuance of Notices of Suspension to some 8(a) firms that failed to fully respond to SBA’s   by the January 19 deadline. Together these developments reflect growing skepticism toward the 8(a) program and signal increased scrutiny for contractors that have long treated 8(a) status as a relatively predictable procurement vehicle. Department of War Audit On January 16, 2026, Secretary of War Pete Hegseth announced via X (formerly Twitter) that the Department would be “taking a sledgehammer” to the 8(a) progra...

Recent enforcement activities in California and Connecticut highlight that states are ready and willing to actively enforce their comprehensive privacy laws . These recent actions – which continue the trend of  states ramping up privacy enforcement activity  – make clear that regulators are taking compliance with state comprehensive privacy laws seriously. Below we highlight two recent enforcement actions and flag key takeaways for companies, including the importance of (i) building a compliance strategy that emphasizes clear communication with consumers; (ii) being responsive to regulatory inquiries; and (iii) providing clear and operative opt-out mechanisms. California On July 1, the California Attorney General (AG)  announced  a settlement with website publisher Healthline Media LLC. The settlement is based on the California Department of Justice’s allegations related to the use of sensitive data for targeted advertising purposes; specifically, the AG alleged that...