Regulatory Compliance

The SBA proposes consolidating nearly 1,000 industry size categories into 338 and raising many revenue and employee thresholds, potentially changing access to federal small-business preferences and subcontracting dynamics. Contractors have until November 20, 2026, to comment and should assess the proposal against their own industry classifications and contracting status.

Sens. Lisa Blunt Rochester and John Curtis urged Commerce Secretary Howard Lutnick to close perceived gaps in controls on advanced AI semiconductors, including remote access and shipments to higher-risk destinations. The proposals are not identified as current requirements, but could affect chip exporters, cloud and data-center providers, and federal technology acquisitions involving cross-border access.

Four federal financial regulators extended the comment period for proposed, nonbinding third-party risk management guidance to December 16, 2026. The proposal may shape how banks and credit unions oversee contractors and service providers, but it announces no solicitation, contract award, or mandatory contractor compliance deadline.

CREW, Public Citizen, and POGO sued the Department of Defense in the U.S. District Court for the District of Columbia, alleging Project Meridian violates the Federal Advisory Committee Act. With recommendations expected by January, the unresolved case could affect the timing and transparency of defense priorities relevant to contractors, including SpaceX and Anduril Industries.

The CFTC sued Arkansas on November 13, 2026, arguing that federal law preempts the state’s efforts to halt event-contract trading and seek civil penalties against CFTC-registered exchanges. The case follows Arkansas’s enforcement action against Kalshi and adds to similar litigation involving 10 other states, creating regulatory uncertainty for prediction-market operators and their support providers.

Australia plans to legislate safety and security requirements for frontier AI companies, overseen by a dedicated regulator working with the Australian AI Safety Institute. The proposed rules could shape compliance expectations for AI vendors and government contractors, but bill text, penalties, implementation dates, and procedures remain unpublished; no procurement opportunity has been announced.

The CFTC sued Louisiana on November 13, 2026, seeking to block state restrictions on event contracts offered by federally regulated derivatives businesses. The dispute could affect the operating environment for firms serving event-contract markets, but the announcement identifies no procurement, contract award, or funding action.

A newly certified SDVOSB freight brokerage is exploring public-sector opportunities, while a separate first-time SDVOSB prime contractor reported winning a multi-year equipment-service contract. The discussion points firms toward APEX Accelerator support and SBA SubNet, and underscores the need for brokerages to assess subcontracting limits against their carrier model before bidding.

The United States has joined U.K.- and France-led voluntary guidelines for commercial cyber intrusion capabilities, including spyware. The framework promotes compliance, due diligence, risk management, and monitoring, but creates no binding procurement terms or immediate funding opportunity; agencies and contractors should prepare for greater scrutiny of suppliers, access controls, and supply chains.

Tasmania’s final expectations require data centres above 20 MW to contribute at least $3,000 per MW of contracted firm demand annually to a local community fund. Developers must also partner with new renewable generation, fund grid connections and upgrades, report energy and water use quarterly, and consult communities—creating compliance costs and potential demand for energy, infrastructure, monitoring, and engagement services.

A June 2026 Commerce Department restriction temporarily cut off access to Anthropic’s Mythos 5 and Fable 5 models, including for foreign-national users, before controls were lifted 19 days later. The episode highlights continuity-of-access, export-control, and allied industrial-benefit considerations for government AI procurements, but identifies no specific solicitation or award.

The Marine Minerals Administration reopened comments on proposed updates to Arctic Outer Continental Shelf exploratory drilling regulations, with submissions due December 14, 2026. Offshore operators and equipment and service providers can weigh in on requirements spanning well control, containment, spill response, and operational procedures; this is a rulemaking engagement opportunity, not a contract solicitation.

A November 2026 U.S.-Japan joint statement identifies priorities for seabed mineral exploration, processing, technology protection, environmental monitoring, and regulatory coordination. It provides no funding, contract awards, or procurement mandates, but signals capability areas that may inform future initiatives and critical-mineral supply-chain planning.

A GSA Office of Inspector General audit found all 11 sampled Public Buildings Service contract files incomplete in EASi and identified inconsistent marking of controlled unclassified information. PBS agreed with four recommendations and is developing a corrective action plan, with implications for acquisition recordkeeping, CUI handling, and contractor documentation support.

A November 13 Law360 recap identified two ASBCA matters involving default terminations and a U.S. Court of Federal Claims decision on incorporation by reference. The available excerpt does not disclose rulings or reasoning, so contractors should consult the underlying decisions before drawing conclusions about performance or contract terms.

Federal agencies received about 1.7 million FOIA requests in FY2025, while the Justice Department’s backlog grew to 29,309. The workload points to modernization needs in intake, review, and disclosure, but agencies and contractors should prioritize verifiable AI tasks, human accountability, and legal, security, privacy, and records-management controls.

Haverhill, Massachusetts, is seeking to cancel its existing Flock Safety license plate reader contract while the City Council develops an ordinance governing surveillance technology. The proposed rules could require public input before future contracts and establish new use and data-safeguard requirements, creating uncertainty for suppliers pursuing city work.

ONC and CMS are inviting payers, providers, EHR developers, and intermediaries to join voluntary 10–12-week sprints testing FHIR-based electronic prior authorization workflows. Expressions of interest are due November 20, 2026; the effort is not a contract solicitation or compliance review, but its findings may inform standards and guidance before certain health plans’ January 1, 2027, API implementation deadline.

Johnson Controls, Inc. and two subsidiaries agreed to pay $5 million to resolve False Claims Act allegations over cybersecurity requirements on contracts supporting NASA, DoD, DOE, and DOJ. The alleged failures spanned January 2018 through August 2025, highlighting the importance of contract-specific security controls and records documenting remediation.

More than 550 FedRAMP-certified cloud providers must adopt risk- and exposure-based vulnerability detection and reporting by December 7, 2026, with a March 7, 2027 compliance milestone for providers using corrective action plans. Federal buyers should monitor provider authorization and remediation status as the rule may affect supplier eligibility and drive demand for cybersecurity tools and implementation support.

The Fifth Circuit affirmed dismissal of whistleblower Brook Jackson’s False Claims Act suit alleging fraud by Pfizer contractor Ventavia Research Group during a COVID-19 vaccine trial. Applying the framework in the Supreme Court’s 2023 Polansky decision, the ruling underscores DOJ’s ability to intervene and seek dismissal, but creates no new procurement requirement.

The Department of Defense has renamed CDAO as the Super Intelligence Office and GenAI.mil as SI.mil, implementing an executive order to replace “AI” with “SI” in official communications. DoD says missions, programs, solicitations, and industry partnerships remain unchanged; no new procurement or funding was announced.

AI-enabled penetration testing can increase the frequency of technical checks, but it does not replace independent review of CUI boundaries, control implementation, governance, or incident response. Defense contractors should continue aligning with DFARS 252.204-7012 and NIST SP 800-171, maintain accurate CUI and system inventories, and treat the cited testing-cost comparison as illustrative.

A White House AI task force urged regulators to consider at least 12 months of liability flexibility for organizations that voluntarily report cyber incidents in good faith, citing AI-driven threats and potentially outdated standards. The recommendation is not binding policy or a procurement announcement; contractors should track it separately from CISA’s forthcoming incident-reporting rule.

Miami-Dade County selected Aetna Life Insurance Company to administer its self-insured employee health plan after evaluations showed an estimated $45.5 million annual cost difference versus incumbent AvMed’s proposal. Florida’s Third District Court of Appeal ruled the county was not required to competitively bid this type of administrator contract under the cited state statute; the decision remains subject to any timely rehearing motion.

HUD finalized a rule requiring applicants of all ages to verify citizenship or immigration status for housing programs, with public housing authorities responsible for enforcement. The change could add more than $385 million in costs for PHAs to serve the same number of family members, creating operational and budget pressures but no identified solicitation or contract opportunity.

Optikos, LLC announced it earned CMMC Level 2 certification after an independent assessment, confirming its cybersecurity controls meet DoD requirements for protecting Controlled Unclassified Information. The credential may strengthen its eligibility for CMMC-covered work, but the announcement names no specific solicitation or contract; about 2,300 of more than 200,000 defense suppliers had achieved Level 2 certification by September 2026.

CMS will let states defer enforcement of Medicaid work requirements through June 30, 2027, while requiring them to continue assessing beneficiary compliance. States must request the flexibility in mitigation plans by December 11, 2026, creating more time to test eligibility systems, verification, notifications, and support processes.

Sen. Tom Cotton urged Commerce Secretary Howard Lutnick to place ChangXin Memory Technologies (CXMT) on the Entity List and consider prohibiting U.S. sales of its products under ICTS authorities. No new restriction or procurement action has been announced; any change could affect semiconductor sourcing, export compliance, and government supply chains.

A KPMG-presented Federal News Network panel examines how Department of Defense organizations can sustain clean audit opinions while modernizing finance systems and processes ahead of DoD’s department-wide 2028 audit-readiness goal. The discussion points to potential contractor demand for finance, systems, and process support, but announces no solicitation, award, contract value, or procurement timeline.

The FAA proposed a $170,000 civil penalty against Charles M. Schultz Sonoma County Airport over alleged gaps in aircraft rescue and firefighting coverage for two passenger flights and a missed wildlife inspection in March 2025. The airport has 30 days from receipt of the notice to respond; no contract opportunity or final finding is reported.

The FDA’s 2026 standards add definitions for “Risk Based Inspection” and “Intervention Strategy” and invite state, local, tribal, and territorial food regulatory agencies to review updated standards and enrollment procedures. Participation may provide an avenue to seek related federal funding, but the notice announces no funding amount, deadline, or procurement opportunity.

The National Supercomputing Center Jinan awarded Qiyuan Jiasu (Tianjin) Technology Co., Ltd. a RMB 148,500 procurement for an unspecified batch of Nvidia RTX 5090 graphics cards and DGX Spark systems. The completed June 2026 award is not an open opportunity, but the center’s Entity List status underscores export licensing and end-user diligence risks.

Kyndryl introduced Sovereign Step-in Readiness, a commercial service covering assessments, governance materials, runbooks, staff preparation, and optional localized tools or automation. No government customer, contract value, solicitation, or procurement timetable was identified, so the announcement signals a potential service offering rather than an active public-sector opportunity.

CISA’s Binding Operational Directive 26-04 requires covered civilian agencies to prioritize software vulnerability remediation by risk, with the highest-risk tier due within three days. Contractors are not directly covered, but agencies may impose similar timelines and evidence requirements through contracts and security programs, increasing the importance of continuous exposure tracking and auditable records.

Bipartisan lawmakers are seeking to attach three semiconductor export-control bills to the annual NDAA, potentially expanding oversight of advanced AI-chip exports, tracking requirements, and controls on manufacturing equipment bound for China. The measures remain proposals, but could affect suppliers, allied-country equipment, and cloud and data-center services; procurement teams should separate current obligations from potential changes.

Redspin says it has earned ISO/IEC 17020:2012 accreditation, becoming one of the first accredited CMMC Third Party Assessment Organizations (C3PAOs). For Defense Industrial Base contractors pursuing CMMC Level 2, the milestone adds an independently evaluated assessment option but does not create a contract opportunity or change compliance deadlines.

ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that cybersecurity controls were inadequate on federal contracts supporting the Army, Missile Defense Agency, and NASA. The settlement, including $6.5 million in restitution, highlights False Claims Act and financial exposure tied to inaccurate security assessments and third-party cloud oversight, even without a successful breach.

NIST SP 800-88 Rev. 2 warns that degaussing can disable a drive without sanitizing its data, particularly on newer, higher-coercivity magnetic media. Federal buyers and contractors should assess media compatibility, applicable NSA/CSS evaluation status, and Trade Agreements Act eligibility—and distinguish sanitization from physical destruction.

inDirectIT appointed retired Air Force veteran and former CMMC Level 2 lead assessor Alexy Johnson as Director of Compliance Services. The hire reflects continued contractor demand for CMMC readiness and NIST-aligned support, even as the Pentagon’s planned second phase is suspended and applicable self-assessment and CUI protection obligations remain in effect.

The UK Department for Transport is seeking views on proposed operating-licence conditions for Great British Railways, covering passenger experience, governance, technical standards, environmental policy, and emergency access. Responses are due 21 January 2027; the consultation is not a contract opportunity, but its outcome may shape future requirements for rail suppliers and service providers.

The House passed six nuclear-related bills covering reactor safeguards, facility construction hearings, uranium enrichment, spent-fuel recycling, DOE authorization transparency, and compensation authority. The measures are not law, and no funding, solicitation, or contract award is identified; H.R. 3978 has been received by the Senate and placed on its calendar.

Leaders of the Senate Finance and House Ways and Means Committees are asking the Commerce Department to preserve records and explain its licensing decisions for Nvidia H200 chip exports to China. The inquiry raises questions about buyer screening, reported intelligence concerns, Section 232 authority, and a reported 15% revenue-sharing arrangement, adding uncertainty for advanced-chip suppliers and government buyers.

The Department of War’s July 13 suspension of CMMC Phase 2 remains in effect, with no restart date or promised review published after the planned 60-day study period. The pause delays the planned third-party assessment pathway; it does not remove existing contract cybersecurity clauses, underlying NIST controls, or applicable self-assessment requirements.

The U.S. Court of International Trade certified an injunctive class covering qualifying importers with certain liquidated IEEPA-tariff entries who have not filed individual lawsuits. Importers should check liquidation dates and the 180-day protest deadline; appeals or further proceedings could delay any class-action refunds.

The Kansas State Board of Education adopted a policy requiring districts to develop technology-use plans addressing AI, student well-being, privacy, and security, and submit them to the Kansas State Department of Education by July 1. The policy may create demand for planning and implementation support, but no funding, solicitation, or confirmed procurement is identified.

Fortreum has made its annual-subscription VDR/VER service, powered by Kovr, generally available to help FedRAMP-certified cloud service providers evaluate, remediate, and report vulnerabilities under requirements effective December 7, 2026. The change creates a near-term need for vulnerability assessment and compliance implementation support, with a grace period ending March 7, 2027.

The Senate advanced the Bipartisan American Affordability and Jobs Act (BAAJA) on November 10, 2026, by a 73–25 vote. Its proposed changes to federal environmental review and permitting could affect project schedules and delivery assumptions in energy, infrastructure, broadband, water, and manufacturing, but the measure is not yet an immediate procurement opportunity or current requirement.

Governments are emphasizing risk-based AI governance, privacy, transparency, human accountability, and learner safeguards across public services and education. No specific solicitation or award is identified, but these policies may shape future procurements through stronger requirements for verifiable outputs, oversight, staff training, and jurisdiction-specific compliance.

TechTarget describes ways organizations can align AI governance with the NIST AI Risk Management Framework and ISO/IEC 42001, including system inventories, control-gap analysis, evidence automation, and periodic reassessment. The guidance is not a solicitation, award, or funding announcement, but it points to potential demand for contractor capabilities in AI risk management, monitoring, and audit support.