Rules
All articles →-
Rules
Expanded counterfeit-parts rule: 60-day GIDEP reporting, supply-chain flowdown, FCA exposure
A final rule effective November 22 dramatically expanded mandatory GIDEP reporting for counterfeit or suspect-counterfeit parts. 60-day reporting window, supply-chain flowdown to all tiers, False Claims Act exposure for non-compliance.
-
Rules
Davis-Bacon's $217B federal construction world — first major overhaul in 40 years, penalties now $13,508
The Department of Labor finalized the first major Davis-Bacon regulatory overhaul in nearly 40 years. Updated WH-347 certified payroll form (January 2025), civil penalties increased to $13,508 per violation. $217B in annual federal construction and 12,000+ active projects now subject to the tightened framework.
-
Rules
CISA retires 10 emergency directives — and what it signals about federal cyber norm-setting
On January 8, 2026, CISA announced the retirement of 10 emergency directives issued between 2019-2024. The retirement signals a shift toward targeted, threat-specific guidance over sweeping standing directives — with implications for how contractors respond to future cybersecurity requirements.
-
Rules
OMB M-25-22 reshapes federal AI procurement — effective for solicitations after September 30, 2025
The Trump administration's OMB memorandum on federal AI procurement applies to any AI solicitation issued after September 30, 2025. Three big themes: a competitive American AI marketplace, taxpayer-dollar safeguards via AI performance tracking, and cross-functional procurement engagement.
-
Rules
WOSB and EDWOSB self-certification ended February 1 — what uncertified firms lose now
As of February 1, 2026, firms that haven't completed formal SBA certification through MySBA are effectively out of the WOSB and EDWOSB programs. Self-cert is dead; third-party-cert via WBENC and others continues but with new requirements. Plus: a one-year extension lifeline for some firms.
-
Rules
FedRAMP 20x Phase 2 ends in March — wide-scale rollout coming Q3-Q4 2026
FedRAMP's 20x program — the cloud authorization rebuild — exits Phase 2 pilot March 31. Phase 3 opens authorization to all Low and Moderate cloud providers in Q3-Q4. Authorization timelines drop from 18+ months to ~3 months for compliant providers.
-
Rules
NIST 800-171 Revision 3 + GSA's January 2026 CUI mandate — what changed for non-DoD contractors
GSA introduced new CUI requirements for non-federal entities on January 5, 2026, building on NIST 800-171 Rev 3 (final May 2024). Three new control families, 49 organization-defined parameters, and meaningful supply-chain risk-management additions. Non-DoD contractors should not assume the rules don't apply to them.
-
Rules
Buy America hits full enforcement: October 2026 deadlines tighten domestic content rules
Federal agencies are transitioning from waivers and transitional periods to full enforcement of Buy American Act and Build America, Buy America Act provisions. October 1, 2026: FHWA projects must meet 55% U.S.-component-cost threshold. False Claims Act exposure for misrepresentation.
-
Rules
GSA Refresh 31 hits Schedule contracts — TDR mandatory, AI clauses, Price Reductions Clause dies
GSA's Refresh 31 imposes mandatory Transactional Data Reporting on 112 previously-exempt SINs, adds AI-training restrictions on government data, and ends the Price Reductions Clause. Schedule holders have 90 days to accept the mass mod.
-
Rules
HUBZone clock: redesignated areas expire July 1 — many firms don't realize it
When SBA updated the HUBZone map in 2023 reflecting 2020 census data, many areas that lost qualified status got a 3-year grace period as 'Redesignated Areas.' That grace period ends July 1, 2026. Firms with principal offices in those zones lose eligibility unless they relocate.
-
Rules
DoD issued 31 DFARS class deviations in December — and 6 more in January. What's actually changing
On December 19, 2025, the Department of War issued 31 class deviations to the DFARS — covering nearly every section. A second batch of 6 followed January 24, 2026. Both took effect February 1, 2026. The largest DFARS shake-up in over a decade.
-
Rules
FY26 NDAA raises CAS coverage threshold to $100M — what mid-sized firms gain
The Cost Accounting Standards full-coverage threshold doubled from $50M to $100M under the FY26 NDAA. Plus: certified cost or pricing data threshold quadrupled to $10M for contracts after June 30. The compliance savings are real; the audit risk shifts up-market.
Page 1 of 2