Government Contracts October 22, 2026

Federal Court Declines to Block DEI Contractor Executive Order: What Higher Education Institutions Need to Know

By Edwin O. Childs, Brandi G. Howard, Michael J. Podberesky, Farnaz Farkish Thompson, Jack White, Sarah Wake, Maricris Prendingue and John Sullivan

On Oct. 14, 2026, the U.S. District Court for the District of Maryland denied a request by a coalition of higher education and contractor associations to preliminarily enjoin Executive Order 14398, “Addressing DEI Discrimination by Federal Contractors” (the FAR DEI Order), and to stay the Federal Acquisition Regulatory (FAR) Council’s April 17, 2026, implementing memorandum, “Agency Implementation of Executive Order 14398, Addressing DEI Discrimination by Federal Contractors.”

As a result, the mandatory contract clause at the center of the FAR DEI Order remains in force: All federal contractors and subcontractors, including colleges and universities that hold federal contracts or subcontracts, will be required to accept a clause barring “racially discriminatory DEI activities,” backed by reporting and records-access obligations and termination and debarment remedies, as well as the risk of potential False Claims Act liability. At the same time, the court gave the clause a meaningfully narrow reading that contractors and subcontractors can rely on: The operative phrase, “disparate treatment based on race or ethnicity,” carries its settled legal meaning of intentional discrimination already prohibited by federal law.

Read on to learn more about the decision and what it means for higher education institutions.

Compliance, Government Contracts October 22, 2026

DoW’s ‘Fostering One Strong Industrial Base’ Memorandum Moves Contractors From CAS to GAAP

By Edwin O. Childs, Jack White, Abram J. Pafford, Jason M. Vespoli, Léa Dickinson, John Sullivan, Sophie Marsh, Colin F. Brady and Joshua Davis

On September 14, 2026, Deputy Secretary of War Steve Feinberg signed a memorandum titled “Fostering One Strong Industrial Base” (the Memorandum), which directs the Department of War (DoW) to move from government-unique Cost Accounting Standards (CAS) to Generally Accepted Accounting Principles (GAAP) as its accounting baseline, confine CAS coverage to a narrow set of sole-source, cost-based work, and restructure how DoW audits and reviews contractor business systems.

Enforcement and Prosecution Policy and Trends, Fraud, Deception and False Claims, Government Contracts October 5, 2026

DOJ Revises Justice Manual to Streamline False Claims Act Enforcement and Clarify Limits on Use of Agency Guidance

By Michael J. Podberesky, Edwin O. Childs, Brett Barnett, David Pivnick, John Adams, Michael F. Easley, Jr., Ryan Buchanan, Eric Olshan, Daniel Bubar, Michael Scoville, John S. Moran, Jack White and Elissa Baur

On September 18, 2026, the Department of Justice (DOJ or the Department) announced two significant revisions to the Justice Manual that aim to reshape False Claims Act (FCA) enforcement. The first revision reinstates and expands the Department’s 2017 policy limiting the use of sub-regulatory guidance documents in enforcement actions by restricting the government’s ability to treat agency guidance as binding legal authority. The second revision strengthens the Department’s approach to dismissing qui tam actions filed by private relators, directing attorneys to assess whether dismissal is warranted in every declined case. Together, these changes signal a more disciplined enforcement posture, suggesting that the Department intends to pursue fraud cases grounded in clear legal obligations while more actively culling meritless whistleblower suits.

Associate Attorney General Stanley E. Woodward, Jr. framed the revisions in terms of regulatory restraint: “The Department of Justice should enforce the law, not make law through enforcement. These updates reflect the Department’s commitment to fair notice, transparent enforcement, and the rule of law.”

Compliance, Fraud, Deception and False Claims, Government Contracts September 29, 2026

DOJ Continues Increased Cybersecurity Enforcement: Honeywell Aerospace Agrees to $2M FCA Settlement for Cybersecurity Noncompliance on DoW Contracts

By Edwin O. Childs, Michael J. Podberesky, Brett Barnett, Abram J. Pafford, Jack White, John S. Moran, Sophie Marsh, Jason M. Vespoli, Léa Dickinson, John Sullivan and Joshua Davis

On September 1, 2026, the U.S. Department of Justice (“DOJ”) announced a $2,042,518 False Claims Act (“FCA”) settlement with Honeywell Aerospace Inc. (“Honeywell Aerospace” or “Honeywell” or “the company”), resolving allegations that the company failed to comply with certain cybersecurity requirements in a contract with the U.S. Department of War (“DoW”). This settlement is the latest in a growing line of enforcement actions under DOJ’s Civil Cyber-Fraud Initiative and underscores the government’s continued willingness to use the FCA to hold defense contractors accountable for apparent failures to comply with cybersecurity-related requirements.

Compliance September 14, 2026

Could Using Cheaper Chinese AI Lead to Costly Congressional Scrutiny?

By David Hirsch, Garen S. Marshall, Casey Erin Lucier, John S. Moran, Emily Erb Kelley and Lauren Devendorf

U.S. companies using AI models developed by companies based in the People’s Republic of China, including DeepSeek, Moonshot AI or MiniMax, should be aware of potential congressional scrutiny in this Congress and the next. Two House committees are conducting a joint investigation into the national security, cybersecurity and economic security implications of U.S. companies’ adoption of PRC-developed AI models, including low-cost, open-weight models and models accessible through application programming interfaces. The House panels have already expressed interest in investigating actions at Anysphere, Airbnb and DoorDash.

Read on to learn more about expected congressional interest in corporate use of PRC-developed AI models.

Anti-Bribery and Corruption September 3, 2026

Talk to Your Customers: Five Agencies Clarify What SAR Confidentiality Actually Prohibits

By Lauren Mann, Katherine Richardson, Jeffrey M. Hanna, Garen S. Marshall and Justin Givens

On September 2, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”), the Board of Governors of the Federal Reserve System (“Federal Reserve”), the Federal Deposit Insurance Corporation (“FDIC”), the National Credit Union Administration (“NCUA”), and the Office of the Comptroller of the Currency (“OCC”) issued a joint statement on a question that has long vexed financial institutions: how much can a bank tell a customer once the customer is the subject of a Suspicious Activity Report (“SAR”)? The answer: likely more than some institutions have considered permissible.

Compliance, Enforcement and Prosecution Policy and Trends August 18, 2026

Department of War Launches Research Security Audits: Key Compliance Steps for Higher Education Institutions

By Chelsea Smith Press, Alex J. Brackett, Patrick Rowan and Sarah Wake

Background

On August 17, 2026, the Department of War issued formal notifications to 30 domestic academic institutions directing them to initiate immediate and comprehensive reviews of their academic, financial, and research collaborations with foreign entities of concern. The notifications were executed by the Office of the Under Secretary of War for Research and Engineering and announced in a press release from the Department.

The action targets active institutional ties and collaborations with foreign entities identified under Section 1286 of the FY19 National Defense Authorization Act, as well as organizations associated with rebranded Confucius Institutes. Confucius Institutes, funded by the Chinese government, were established on campuses nationwide ostensibly as cultural exchange programs. The Department’s focus on “rebranded” institutes suggests concern that some programs may have continued operating under different names.

The Department’s list of problematic entities reportedly includes 130 organizations from China, Russia, and Iran, ranging from electronic measurement laboratories to scientific research centers.

Anti-Bribery and Corruption August 13, 2026

FinCEN Kills Beneficial Ownership Reporting for U.S. Companies, but Foreign Filers Should Beware

By Jeffrey M. Hanna and Lauren Mann

The long saga of the Corporate Transparency Act’s (“CTA”) beneficial ownership reporting requirements has reached its final chapter — at least for domestic businesses. On August 11, 2026, the Financial Crimes Enforcement Network (“FinCEN”) issued a final rule permanently exempting all U.S. companies and U.S. persons from reporting beneficial ownership information (“BOI”), which was the primary purpose of the CTA. The rule is effective immediately. FinCEN will also delete previously reported data for U.S. entities. But the CTA is not dead for everyone. Foreign entities registered to do business in the United States remain squarely in scope.

Compliance August 7, 2026

New Frontiers in Spoliation: Preserving AI Records in Litigation

By Garen S. Marshall, Ashley B. Matthews, Davis M. Walsh, Alice Moscicki and Louis O.C. Rogers

The explosion of generative AI in the workplace has created a new and largely unaddressed category of litigation risk. In May 2025, a federal court in the Southern District of New York ordered OpenAI to preserve and segregate all ChatGPT output log data that would otherwise be destroyed under its default 30-day deletion policy, marking one of the first judicial orders to treat AI-generated content as electronically stored information subject to legal holds (i.e., the obligation to preserve potentially relevant evidence once litigation is reasonably anticipated). The order, issued over OpenAI’s objections grounded in user privacy and regulatory compliance, signals that courts will expect litigants to preserve AI artifacts with the same rigor applied to email, documents, and structured data.

Read on for an analysis of how existing discovery rules already reach AI-generated content, the sanctions companies may face for failing to preserve it, and the practical steps clients should take now to close the gap.

Enforcement and Prosecution Policy and Trends, Government Contracts July 14, 2026

DoW Suspends CMMC Phase II Requirements – Launches 60-Day Review

By Edwin O. Childs, Andrew Konia, Abram J. Pafford, Jack White, Jason M. Vespoli, Léa Dickinson, Sophie Marsh and John Sullivan

Overview

On July 13, 2026, the Department of War (DoW) announced the immediate suspension of all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had originally been scheduled to take effect November 10, 2026, including the transition to mandatory third-party assessments by CMMC Third-Party Assessment Organizations (C3PAOs) for contractors handling Controlled Unclassified Information (CUI). The DoW simultaneously established a CMMC Reform Task Force charged with delivering a comprehensive report within 60 days recommending “realistic, scalable security measures” for the Defense Industrial Base (DIB).

The suspension, announced by DoW Chief Information Officer Kirsten A. Davies, aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.

Subject to Inquiry

THE LATEST ON GOVERNMENT INQUIRIES AND ENFORCEMENT ACTIONS