Regulatory Compliance

NHTSA proposed changes to federal safety standards for vehicles designed to operate exclusively through automated driving systems, including revisions to FMVSS No. 108 and possible exemptions for selected lighting and driver-alert requirements. The proposal is a rulemaking, not a contract opportunity; manufacturers and suppliers should assess potential design, testing, and compliance effects and consider submitting technical comments.

A discussion of a reported OPM final rule says the federal Time-in-Grade requirement may end in January, but does not confirm the effective year, scope, or agency implementation. Removing TIG would not eliminate specialized-experience or other qualifications, so hiring teams should verify vacancy announcements and agency guidance before changing workforce plans.

USDA’s Animal and Plant Health Inspection Service (APHIS) is seeking public input on proposed revisions to national chronic wasting disease controls for farmed cervids, with comments accepted beginning October 26, 2026. The proposed changes include updated trace and quarantine periods, genetics-based herd plans, revised indemnity priorities, and development of a national recordkeeping system; no procurement opportunity has been announced.

A C4ADS report cited in the article says Russia’s Rubin design bureau supplied submarine-related documentation and materials to Chinese military procurement entities and CSOC, with reported deliveries exceeding $80 million from August 2015 through April 2023. The reported scope and continuation after February 2022 create sanctions, export-control, and supply-chain diligence considerations for defense and maritime contractors; the report does not establish a violation or describe an open procurement opportunity.

NIST CMVP Certificate #5493 lists Fortinet’s FortiClient Crypto Module v1.0 as an active software module validated to FIPS 140-3 Security Level 1, with a stated sunset date of August 16, 2031. Federal buyers can use the certificate in product due diligence, but must verify that the proposed configuration falls within its scope and accounts for its caveats; no contract opportunity or pricing is identified.

The Commerce Department authorized T1 Energy to import up to 1.725 GW of solar cells, supporting its Dallas module factory while its Rockdale cell facility is under construction. The company expects domestic cell production in Q1 2027; the waiver provides a transition period ahead of Section 232 tariffs and minimum import prices scheduled for December 4, 2026.

The Defense Health Agency awarded Singapore-based iX Biopharma nearly $41 million in February 2026 to develop Wafermine, a sublingual ketamine product for battlefield pain relief. The award is not an open competition, but U.S. deployment could be delayed by pending emergency-use authorization and a Nevada pharmacy license required by proposed manufacturer Orion Specialty Labs.

HHS’s HIPAA framework allows a business associate up to 60 days after discovering a breach to notify the covered entity, but a Business Associate Agreement (BAA) may impose a shorter deadline. Federal health contractors and covered entities should document each vendor’s contractual notice period and ensure incident-response processes can meet it.

CMS proposes requiring eligibility verification before consumers receive ACA Exchange premium tax credits or income-based cost-sharing reductions, beginning with 2028 health plans. The rule could shape future Exchange verification, data-matching, and document-processing requirements, but it is a proposal—not a solicitation or contract award—and comments are open for 30 days after publication.

The Federal Trade Commission is reportedly developing an investigation involving Anthropic and OpenAI as Washington scrutinizes AI safety-incident disclosures, lobbying, and proposals to preempt state regulation. No contract action or new requirement is identified, but government AI contractors may wish to assess reporting commitments and prepare for potential federal–state policy differences.

North Carolina’s state auditor identified gaps in Fayetteville State University’s procurement- and travel-card reviews, documentation, and compliance. The university says it will replace both programs with an Emburse One-Card program, but no solicitation, contract award, value, or implementation timeline has been reported.

The **Federal Communications Commission** has restricted certain new foreign-made drones, Wi-Fi routers, and home robotic devices from entering the U.S. market without an exemption or special approval, citing cybersecurity and national security concerns. For government and other institutional buyers, model-level approval checks may be important to sourcing and replacement plans; approval delays could also limit product choice and affect acquisition timelines.

New Jersey’s Department of Labor and Workforce Development issued a stop-work order to subcontractor 3 J’s Masonry Corp. on the South Bound Brook Public Safety Building and Police Department project. Six workers were affected by wage, payroll, registration, and classification violations, creating schedule and compliance exposure for the public-works project; violations of the order may incur civil penalties of $5,000 per day.

An EU apparel and footwear manufacturer is seeking a U.S. partner to explore market entry, including potential federal and military procurement channels. Any DLA or DHS opportunity requires solicitation-specific review of domestic-sourcing rules, including potentially applicable Berry and Kissell Amendment provisions.

The U.S. Army conditionally selected REalloys for exclusive negotiations on an Enhanced Use Lease to develop privately financed heavy rare-earth processing facilities at Tooele Army Depot. The proposed project targets development as early as 2027 and initial operating capability by 2028, but remains subject to definitive agreements and environmental and regulatory reviews.

The U.S. Coast Guard’s NVIC 02-26 explains how covered maritime operators can meet cybersecurity requirements established under 33 CFR Part 101, Subpart F. Operators must designate a qualified Cybersecurity Officer, complete a risk assessment, and submit a Cybersecurity Plan by July 16, 2027; outside assistance is optional, and penetration testing is not required for initial submissions.

The SEC’s Division of Examinations announced FY 2027 priorities for examinations of more than 34,000 registrants, including cybersecurity, operational resilience, advanced technologies, private funds and credit, broker-dealer controls, and evolving market infrastructure. The announcement is a regulatory oversight signal—not a solicitation, award, or new mandate—but gives contractors serving financial firms areas to assess for service alignment.

Arnold Magnetic Technologies said it planned to establish a compliant supply chain for NdFeB and SmCo magnets by mid-2026, ahead of updated DFARS restrictions taking effect January 1, 2027. The report does not confirm the target was met or identify a contract opportunity, but defense suppliers should review affected products, sourcing, and supplier qualification before the deadline.

DigiCert for Government has entered the FedRAMP Marketplace at initial implementation status, listing three DigiCert ONE services as the company pursues FedRAMP 20x Class C certification. The listing is not an authorization or contract award; acquisition teams should verify current status and service scope before relying on the offerings for federal requirements.

The University of North Carolina at Chapel Hill reached an October 19 agreement with the U.S. Department of Justice resolving more than a dozen federal inquiries into alleged race discrimination and antisemitism. The agreement preserves UNC’s access to federal research funding while requiring campus-program and reporting changes, underscoring demand for outside legal and compliance support without presenting a current solicitation.

The Bureau of Prisons is asking a federal judge to clarify or modify an injunction requiring it to restore collective bargaining agreements with the American Federation of Government Employees Council of Prison Locals. The dispute, including a compliance report due October 28, could affect correctional staffing, schedules, and labor-related service assumptions for contractors.

The FAA released draft design standards for vertical flight facilities on October 22, 2026, covering site layout, visual aids, power and charging, airport integration, and elevated facilities. Airport and heliport owners, infrastructure developers, and advanced air mobility firms can use the proposal for early planning and provide feedback before final standards are expected in summer 2027; no solicitation or contract is announced.

A federal judge ruled that the U.S. Office of Personnel Management violated the Privacy Act by granting Department of Government Efficiency personnel broad access to systems containing personally identifiable information on millions of current, former, and prospective federal workers. Remedies remain undecided, including whether extracted data must be deleted; the ruling raises practical privacy, access-control, and data-retention concerns for contractors supporting federal personnel systems.

DoD’s October 20 guidance gives acquisition personnel templates for incorporating federal AI principles—including factuality, neutrality, and transparency—into solicitations and contracts. AI vendors and prime contractors should assess what compliance evidence they can provide and whether subcontractors or model developers can support documentation requests.

An independent audit found accessibility barriers on all 28 Illinois municipal websites reviewed, including inaccessible PDFs, keyboard-navigation issues, color-contrast problems, and chat-widget concerns. The findings point to potential demand for municipal accessibility audits and remediation ahead of DOJ ADA Title II deadlines: April 26, 2027, for municipalities serving populations over 50,000, and April 26, 2028, for smaller municipalities.

The **Department of Defense** began phasing Cybersecurity Maturity Model Certification requirements into applicable contracts in November 2025, with implementation planned over three years. Reported gaps between small manufacturers’ self-assessments and assessment results underscore the need for documented CUI scoping, early remediation, and prime-contractor oversight of subcontractors.

The U.S. Department of Justice reached a settlement with Honeywell Aerospace valued at more than $2 million over allegations that cybersecurity requirements were not met on a network handling Department of Defense information from April 2020 to December 2023. The case highlights potential liability for inaccurate cybersecurity compliance certifications even when no breach is reported, while a separate CMMC self-assessment delay announced in July 2026 has no revised effective date in the available information.

Two Marines filed a proposed class-action lawsuit alleging that a Defense Manpower Data Center file-sharing vulnerability exposed unencrypted personal records for about 3.05 million military-connected people over roughly nine months. The case raises cybersecurity, privacy, and incident-notification concerns for contractors supporting DoD systems, but no procurement action or new requirement has been announced.

Federal prosecutors allege former U.S. Army Pacific official Carlos Duque accepted $1.25 million in bribes to steer contracts and subcontracts tied to the Hawaii-Pacific Innovation Campus. The case is not an open procurement opportunity, but it highlights integrity, subcontract-cost, and oversight risks for contractors and agencies managing defense innovation programs.

Seventeen bipartisan former national security officials asked the D.C. Circuit to rehear Anthropic’s challenge to the Pentagon’s supply-chain-risk designation. The case could influence how the Defense Department applies supplier restrictions and how agencies and contractors evaluate Anthropic’s Claude models, but the filing is not a new procurement action.

USDA Secretary Brooke Rollins says the department is “full-bore ahead” with its reorganization, even as a federal stay pauses specified office closures and relocations and the Ninth Circuit leaves that order in place. The plan could reshape Forest Service and research operations, creating uncertainty for contractors’ points of contact, workforce availability, facilities support, wildfire preparedness, and service delivery.

The FAA issued BETA Technologies the first Special Airworthiness Market Survey Certificate for an eVTOL, allowing its ALIA A250 to conduct market-survey flights with operators and other participants across a broader geographic area. The authorization supports evaluation and market validation, but is not a contract award or solicitation; separate signals include eight eIPP projects spanning 28 states and $12.5 billion for air traffic control modernization.

A review tracking 49 federal privacy proposals through September 2026 spans consumer data, AI, children’s information, health and location data, employee monitoring, and data brokers; two measures have become law, though the source does not identify them or their requirements. Contractors should monitor the policy landscape and assess privacy and AI-governance readiness, while treating pending proposals as potential future requirements—not current mandates or procurement opportunities.

The SBA referred 689 firms removed from the 8(a) Business Development Program to GSA for review of federal contracts with a collective ceiling of $5.5 billion. The audit will assess potential fraud and compliance issues, including false statements, pass-through arrangements, and financial misrepresentation; the figure is not a new award or funding commitment.

New York Governor Kathy Hochul announced 75 additional Express NY regulatory reforms, bringing the initiative to more than 120 actions across over 20 agencies and authorities. The state estimates the measures will benefit more than 2.5 million people, save five million hours, and reduce costs by tens of millions of dollars; contractors should monitor implementation, but no procurement or funding opportunity was announced.

The proposed EU Cloud and AI Development Act would create four cloud-sovereignty assurance levels for public-sector procurement, with potential requirements for data location, foreign access, and service continuity. Contractors serving European and U.S. markets should assess the proposal separately from U.S. FOCI and FedRAMP obligations; the analysis also notes proposed FOCI-related provisions for certain unclassified Department of War work above $5 million.

The OCC is implementing the GENIUS Act, signed July 18, 2025, to establish a federal framework for permitted payment stablecoin issuers. It is not yet accepting applications or waiver requests; that process will begin after OMB approves the related information collection. No procurement opportunity or funding is identified.

CMS activity involving chronic-care technology pilots and reimbursement, alongside advocacy on wearable-device rules and remote-care connectivity, points to an evolving health technology market. The reported lobbying activity may influence policy, but the article identifies no solicitation, award, contract value, or defined purchasing requirement.

A **Department of Homeland Security** order directs federal civilian agencies to remove DeepSeek products and covered third-party offerings built with DeepSeek technology, and prohibits new purchases. Contractors should review covered contracts containing **FAR 52.204-30**; the notices leave the effective date and method for identifying covered implementations unspecified.

Federal agencies are scheduled to transition key systems to post-quantum cryptography in stages from December 2030 through 2035, while contractors must meet stated NIST cryptographic standards by December 2030. AI-generated mathematical results have heightened concern about encryption resilience, making cryptographic inventories, implementation reviews, and crypto-agility planning immediate compliance priorities.

Sens. Elizabeth Warren and Chuck Grassley are asking Deputy Defense Secretary Steve Feinberg how DoD would require detailed cost and pricing data on contracts below $10 million and limit negotiations with firms that refuse. The inquiry raises a potential shift in defense pricing and negotiation practices, but does not establish a current requirement or implementation timeline.

The Tennessee Valley Authority is accepting comments through November 19, 2026, on a draft programmatic environmental impact statement for transmission activities tied to generator interconnection requests. The process could shape environmental review for future projects, but it is not a solicitation or award; TVA separately cites more than $13 billion in planned power-system investments through fiscal year 2029.

Federal cybersecurity is shifting from periodic certification and manual GRC reviews to ongoing security operations built around automated controls, continuous monitoring, vulnerability remediation and current evidence. The change, reinforced by FedRAMP 20x and continuous authorization, signals sustained service and customer-coordination needs for contractors, but the sources identify no active solicitation, award or contract value.

New York is coordinating state and federal investigations involving more than 100 adult social day care providers suspected of fraud and directing a comprehensive review of Medicaid payments. Providers and supporting contractors face heightened claims scrutiny, possible suspensions, and tighter compliance requirements as state recommendations are due December 31, 2026, and a moratorium on new providers continues through January 2027.

DHS issued a FASCSA exclusion and removal order requiring roughly 430 federal civilian agencies to stop buying DeepSeek products and remove covered products from agency IT systems. The order also reaches third-party offerings developed using DeepSeek implementations, making supply-chain provenance a procurement and compliance concern; no government-wide removal deadline has been set.

Sen. Gary Peters is demanding answers about oversight of more than $260 billion in Department of Homeland Security funding, citing border-wall contracts awarded before site access was secured, $20.5 million in warehouse purchases later slated for sale, and planned aircraft acquisitions. The concerns may prompt closer scrutiny of DHS acquisition planning and spending controls, but do not announce a new solicitation or contract opportunity.

The U.S. Chemical Safety and Hazard Investigation Board says Yenkin-Majestic/OPC Polymers has not substantively responded to or implemented five recommendations following a fatal 2021 explosion at its Columbus, Ohio plant. The company’s reported September 2026 federal guilty plea and unresolved safety findings are relevant to supplier and contractor risk reviews, but the update identifies no new procurement action or requirement.

Trimble for Government is listed on the FedRAMP Marketplace at Initial Implementation status for Class C (Moderate), a milestone for agencies assessing its cloud software. Trimble is still pursuing full FedRAMP and GovRAMP authorization; the announcement includes no contract award, solicitation, or procurement commitment.

DHS’s July 24, 2026, order under the Federal Acquisition Supply Chain Security Act excludes DeepSeek, defined affiliates, and covered products—including some third-party implementations—from federal civilian procurement. The removal requirement took effect October 16; contractors should identify affected software and services, while noting the 60-day exception-request period has elapsed.

The FDA finalized recommendations for how prescription-drug companion apps should handle promotional content, FDA-required labeling, prescribing-information references, and agency submissions. The guidance may inform product reviews and vendor discussions, but it announces no funding, solicitation, contract, or mandatory procurement requirement.