Regulatory & Statutory Developments

On April 29, 2024, the Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) released guidance to federal contractors regarding the use of artificial intelligence (AI) in their employment practices. See https://www.dol.gov/agencies/ofccp/ai/ai-eeo-guide. The guidance reminds federal contractors of their existing legal obligations, the potentially harmful effects of AI on employment decisions if used improperly, and best practices. Arriving early, the guidance puts contractors on notice of their responsibilities when using AI in their employment decisions.

Continue Reading Department of Labor Issues New Guidance on the Use of Artificial Intelligence and Employment Decision-Making

After a series of preliminary, narrowly decided, and conflicting court decisions concerning requests for preliminary injunctions (see August 20, 2024 Alert), a federal district court in Texas has now entirely set aside the Federal Trade Commission (FTC) rule that would have invalidated tens of millions of non-compete agreements in the United States (see judge’s …

On August 7, 2024 the Federal Communications Commission (FCC) adopted a new Notice of Proposed Rule Making (NPRM) proposing regulations that prohibit the use of AI in automated dialing or artificial or pre-recorded voice calls absent the prior written consent of the call recipient, unless otherwise exempted by the FCC. The action was taken under…

The third revision of NIST Special Publication 800-171 brings substantial changes across several key areas: the structure of control families has been expanded to better address new threats, individual security controls have been updated to enhance overall system security, and the criteria for tailoring these controls to specific organizational needs have been clarified, all in…

In Percipient.ai v. United States, the US Court of Appeals for the Federal Circuit may have triggered a legal “Big Bang” moment in government procurement law. The case centered on whether the Federal Acquisition Streamlining Act’s (FASA) “task order bar” could suppress claims alleging violations of 10 U.S.C. § 3453, which mandates a preference for commercial products. The Panel’s interpretation of the Tucker Act’s definition of “interested party” expanded the universe of standing, allowing prospective subcontractors to exert gravitational influence in legal challenges regardless of their role as indirect offerors. At the risk of offending real physicists, from a legal perspective, the Percipient.ai v. United States decision looks to expand a universe of legal scrutiny. Like the cosmic forces that shape galaxies, the Percipient.ai decision may shape the parameters of government contracting jurisdiction and procedural fairness in the procurement process.

Continue Reading Big Bang?: The Federal Circuit, Percipient.ai, and Expanding Jurisdiction

DOD released a final rule which updates the DFARS to address requirements outlined in Executive Order 14005, “Ensuring the Future is Made in All of America by All of America’s Workers.” Marcos Gonzalez explains the changes and what contractors should be aware of while making adjustments to their supply chains in order to continue supplying…

On May 16, 2024, the Securities and Exchange Commission (SEC) adopted amendments to Regulation S-P to “modernize and enhance the rules that govern the treatment of consumers’ nonpublic personal information by certain financial institutions.”  Affected financial institutions have 18-24 months (depending on their size) to comply, and should begin preparing now.

Continue Reading SEC Adopts Rule Amendments to Regulation S-P to Safeguard Customer Information and Enhance Cybersecurity Procedures at Financial Institutions

Cyber incidents involving critical infrastructure pose a serious risk to the US. In March 2024, the Environmental Protection Agency and the National Security Advisor warned state governors about potential attacks on drinking water and wastewater facilities by specific Iran- and China-aligned hackers. The following month (on April 4, 2024), in an attempt to prepare for such attacks and otherwise improve the federal government’s ability to collect and analyze data related to cyber incidents on critical infrastructure, the Cybersecurity and Infrastructure Security Agency (CISA) issued a proposed rule to implement cyber incident reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). Enacted in an omnibus appropriation, CIRCIA directed CISA to issue rulemaking requiring the reporting of cyber incidents or the payment of ransoms in response to cyberattacks affecting critical infrastructure.  

Continue Reading CISA’s CIRCIA Proposed Rule: Another Player Enters the Reporting Regime

“Arm me with harmony.” – Treach, Naughty By Nature[1]

On May 14, 2024, the National Institute of Standards and Technology (NIST) dropped the third remix…er, revision…of its Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” It even came with a critical sidekick in the form of the companion assessment guide, “NIST SP 800-171A, Revision 3,” which gives organizations the necessary lowdown on “assessment procedures and methodologies” to check if they’re playing by NIST SP 800-171’s rules. Over a year in the making after previous releases in May and November of 2023, NIST’s finalized revision takes inspiration from industry by laying down the cybersecurity rules that contractors should expect to follow when handling Controlled Unclassified Information (CUI) for the US Department of Defense (DoD). While DoD isn’t requiring contractors who handle CUI to roll with Rev. 3 just yet, contractors can expect that DoD will eventually bring Rev. 3 into the mix for DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (DFARS 7012), and will be harmonizing it with the upcoming Cyber Maturity Model Certification (CMMC) program at some point soon.

Continue Reading NIST SP 800-171 Revision 3 Goes Final: Who’s Down with ODP?

If you happen to be a government contractor and are contemplating additions to your Summer reading list, consider adding the FAR Council’s May 3, 2024 advanced notice of proposed rulemaking (“ANPR”) to the mix. The ANPR, which was issued in furtherance of implementing Section 5949 of the FY 2023 National Defense Authorization Act (“NDAA”), contemplates various forthcoming changes to the FAR, all of which focus on banning agencies from purchasing certain products or services that contain or otherwise utilize semiconductors that are produced, designed, or provided by three Chinese entities and their subsidiaries, affiliates, or successors: Semiconductor Manufacturing International Corporation (“SMIC”), ChangXin Memory Technologies (“CXMT”), and Yangtze Memory Technologies Corp. (“YMTC”). In addition, the FAR will likely be amended to prohibit the acquisition of semiconductor products or services from any entity that is owned, controlled by, or otherwise connected to China, North Korea, Iran, Russia and any other “foreign country of concern” – a designation to be determined by the Secretary of Defense or the Secretary of Commerce, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation.

Continue Reading Supply Chain Checkup: FAR Council Announces New Rulemaking Focused on Prohibiting Certain Semiconductor Acquisitions