Federal Compliance
Updates

Federal contractors must implement diversity, equity, and inclusion programs despite ongoing legal challenges in Maryland federal court. Active enforcement is occurring while litigation proceeds. Contractors cannot delay compliance planning pending court resolution. Specific DEI plan development and implementation requirements are being enforced immediately for applicable federal contracts.

The Department of Justice and HHS have established a formal DOJ-HHS False Claims Act Working Group to coordinate FCA enforcement actions across healthcare, life sciences, and medtech federal contractors. The working group signals a new era of inter-agency coordination — contractors billing the federal government for healthcare services, equipment, or technology now face coordinated scrutiny from both DOJ Civil Division and HHS OIG simultaneously. Five major federal FCA cases in 2026 are poised to set new precedent on regulatory risk, reimbursement liability, and innovation pathways for healthcare GCs.

The Whistleblower Law Collaborative has broadened its leadership focus into cybersecurity-related False Claims Act cases, actively recruiting qui tam plaintiffs targeting defense contractors with cybersecurity compliance gaps. Combined with the DOJ FOCUS Initiative’s AI-driven data mining and the Civil Cyber-Fraud Initiative, defense contractors with CMMC, NIST 800-171, or DFARS 252.204-7012 gaps now face organized, professional whistleblower representation — not just government auditors. Any self-certified cybersecurity posture that cannot be substantiated is now a direct FCA liability target.

DoD published a landmark proposed DFARS rule (Case 2021-D011) that would extend Foreign Ownership, Control, or Influence (FOCI) disclosure and mitigation requirements to unclassified DoD contracts over $5M — for the first time beyond classified contracts. An estimated 37,740 contractors (57% small businesses) would be impacted. Covered contractors must register in DCSA’s NISS system, submit SF-328 beneficial ownership forms, and achieve FOCI “eligible” status before contract award. Identified FOCI risks must be mitigated within 90 days. Comment deadline: July 6, 2026.

Holland & Knight reports that the Buy American Act domestic content threshold is on a regulatory escalation path reaching 75% domestic content by 2029, up from the current 60% threshold. Contractors who certified compliance at the 60% threshold must audit their supply chains now — products that qualify today may not qualify in 2027 or 2029 as the threshold rises. False Buy American certifications carry False Claims Act liability regardless of when the certification was made.

The Small Business Administration began demanding repayment of grant funds from over 600 businesses that received COVID-era Shuttered Venue Operators Grant Program funds. Recipients facing repayment demands should review their grant agreements and consider legal counsel, as improper handling could trigger False Claims Act exposure for contractors with federal business.

A coalition of academic and contractor organizations filed suit seeking to enjoin Executive Order 14398 restricting DEI programs. The lawsuit creates legal uncertainty around enforcement timing and contractor compliance obligations. Federal contractors should monitor litigation progress as preliminary injunction could delay implementation requirements.

President issued Executive Order targeting Diversity, Equity, and Inclusion (DEI) programs at federal contractors and subcontractors. The order directs federal agencies to review and potentially modify contractor requirements related to DEI initiatives. Immediate compliance review recommended for contractors with existing DEI commitments or certifications in their federal contracts.

On April 30, 2026, the President issued an Executive Order establishing Administration policy promoting efficiency, accountability, and performance in federal contracting, with specific focus on fixed-price contracts with performance requirements. This EO will drive new FAR implementing regulations affecting contract structure and performance metrics for government contractors.

A cure notice is a formal government warning that contract performance or compliance is deficient — and the clock starts immediately. Contractors have as little as 10 days to cure or face termination for default, which can trigger False Claims Act liability if certifications were made. Key steps include immediately notifying legal counsel, preserving all communications, documenting remediation actions, and formally responding to the contracting officer in writing.

HHS OCR has issued new enforcement actions under HIPAA cybersecurity requirements. DOJ continues expanding its Civil Cyber-Fraud Initiative targeting contractors who misrepresent cybersecurity compliance. CISA is issuing binding operational directives affecting contractors operating federal systems. Contractors with gaps in FISMA, Zero Trust, or DFARS 252.204-7012 compliance face elevated enforcement risk.

New federal whistleblower reward rules represent a fundamental shift in enforcement strategy — moving from protecting reporters to actively paying for enforcement tips. Combined with the DOJ FOCUS Initiative’s data-mining operations already targeting SAM.gov award data, federal contractors now face enforcement pressure from multiple paid, external sources operating simultaneously.

By June 1, 2026, the Secretary of Defense is required under NDAA FY2026 to standardize cybersecurity requirements across the defense industrial base. Defense contractors subject to varying agency-specific cybersecurity requirements should monitor for updated DFARS clauses and unified guidance expected to follow this deadline.

Despite the rescission of Executive Order 11246, OFCCP has confirmed that Section 503 and VEVRAA obligations remain fully in force as independent statutory requirements. Federal contractors with contracts of $20,000 or more (Section 503) and $200,000 or more (VEVRAA) must maintain written affirmative action programs and comply with recordkeeping requirements.

The U.S. Supreme Court refused to hear Eli Lilly’s challenge to the whistleblower provisions of the federal False Claims Act, leaving the qui tam framework fully intact. Combined with the DOJ FOCUS Initiative and record FCA enforcement pace in 2026, this ruling signals no near-term judicial relief from FCA whistleblower risk for contractors.

Executive Order 14402, issued April 30, 2026, requires federal agencies to prioritize fixed-price contracts over cost-reimbursement arrangements wherever feasible. This represents a significant shift in federal procurement policy. Contractors should expect agencies to justify cost-reimbursement contracts more rigorously and prepare for increased fixed-price proposal requirements.

NIST has published the final version of Special Publication 800-63 Revision 4, Digital Identity Guidelines. This foundational standard governs digital identity, authentication, and identity proofing for federal systems. Government contractors whose systems interface with federal networks or handle identity verification should review updated technical requirements for alignment with CMMC compliance obligations.

On April 7, 2026, the Army issued a memorandum directing contracting activities to use competitive procedures as the preference in the SBA 8(a) program. RFO FAR Part 19 now gives contracting officers authority to release follow-on 8(a) contracts without SBA approval. All new contract awards and option exercises above $20 million are subject to senior-level review.

The House Small Business Committee unanimously approved H.R. 2804 (Protecting Small Business Competitions Act of 2025) at its May 20, 2026 Full Committee Markup. The bill codifies the Rule of Two into statute, protecting small business set-aside requirements from elimination under the Revolutionary FAR Overhaul. Key amendment: the approved version limits scope — the Rule of Two will not apply to task orders and delivery orders. The bill now moves to the full House for a floor vote. Passage is not guaranteed — continued industry advocacy is essential.

On May 13, 2026, NIST finalized SP 800-172 Revision 3 — enhanced security requirements for protecting CUI on nonfederal systems. Key additions include expanded requirements for access controls, network segmentation, asset management, and supply chain security. These controls do not immediately apply to CMMC — DoD must engage in further rulemaking before incorporating Rev 3 into CMMC Level 3.

On April 29, 2026, CISA, DoD, DOE, FBI, and State jointly published “Adapting Zero Trust Principles to Operational Technology” — the first comprehensive federal guidance applying ZT to OT environments. The guidance establishes 105 ZT activities covering ICS/SCADA, building automation, facility management, and weapons-adjacent infrastructure. Target deadline: FY2030. Advanced: FY2033.

Semiconductor export controls in 2026 are creating significant dual-use risk and re-export compliance obligations. ITAR brokering in foreign defense transactions now requires DS-4294 approval from DDTC. Re-export controls are expanding — companies transferring defense technology through third countries need additional authorization.

Morgan Lewis GovCon Update warns federal contractors to review the accuracy of both Buy American Act AND Trade Agreements Act (TAA) certifications. Inaccurate TAA certifications carry False Claims Act liability — the same risk as fraudulent Buy American certifications. DOJ enforcement is actively targeting certification accuracy.

A new Senate Bill introduced May 13, 2026 would eliminate the 8(a) and Women-Owned Small Business (WOSB) federal set-aside programs. If passed, contractors currently benefiting from 8(a) or WOSB preferred status would lose those advantages. Monitor closely — this is a proposed bill, not yet law.

NDAA FY2026 Section 1532 prohibits contractors from using certain AI systems in defense contracting without explicit authorization and human oversight documentation. Contractors using AI-assisted proposal generation, contract deliverables, or compliance certifications must maintain oversight records.

President Trump signed EO 14392 directing additional review of federal contractors for fake Buy American compliance. DOJ False Claims Act enforcement is expanding to cover fraudulent Buy American certifications. Contractors must ensure domestic content documentation is accurate and substantiated.

DoD is seeking public comments on a proposed DFARS rule requiring contractors to disclose beneficial ownership and FOCI information to DCSA. Contractors would need to update disclosures throughout contract performance and mitigate identified risks within 90 days. Rule applies to contracts above $5 million. Comments due July 6, 2026.

FedRAMP is proposing significant changes to security incident definitions, notification timing, and reporting procedures. Public feedback closes end of June 2026. Cloud service providers and federal contractors with FedRAMP-related obligations should review current incident reporting clauses and prepare for updated requirements.

The FAR Council issued a Model Deviation FAR Clause implementing the Fixed-Price Contracting EO signed April 30, 2026. Federal agencies can now begin requiring firm fixed-price contracts immediately. Non-exempt cost-reimbursement and T&M contracts require written justification to agency head. Agencies must review top 10 non-fixed-price contracts by July 29, 2026.

FedRAMP is finalizing new rules that will spell out clear timelines and requirements for updating existing Rev 5 authorizations. FedRAMP PMO launched a hiring push signaling imminent rule publication. Datadog achieved FedRAMP High certification. Axonius Federal Systems initiated FedRAMP Class D (High) certification process.

Federal Acquisition Circular 2026-01 (FAR Case 2025-007) effective March 13, 2026 updated multiple FAR thresholds and clause dates. Key changes: FAR 52.212-5 and 52.213-4 clause dates updated to MAR 2026 (was JAN 2025). Buy American threshold now $6,683,000. Walsh-Healey threshold now $105,767.