FAR council releases multiple RFO proposed rules: Key contractor impacts across the FAR overhaul

Why the FAR overhaul is happening

The RFO is grounded in Executive Order 14275,¹ which directs the FAR Council to eliminate excessive acquisition regulations and produce a FAR that is simpler, clearer, and structured for speed.  According to the FAR Council, the existing FAR has evolved from its original purpose of establishing uniform procurement procedures into an “excessive and overcomplicated regulatory framework and bureaucracy.”  The stated objective is to retain only requirements that are required by statute or otherwise essential to sound procurement.

OMB Memorandum M-25-26, “Overhauling the Federal Acquisition Regulation,” launched the RFO and called for regulations aligned to statute, rewritten in plain language, and supplemented by nonregulatory governmentwide guidance.  The FAR Council describes the effort as a “paradigm shift” away from paperwork-driven compliance rules and toward streamlined regulations focused on mission outcomes, contracting officer discretion, market awareness, and risk literacy. 

The RFO has proceeded in two phases.  In phase one, during fiscal year 2025, the FAR Council issued model class deviations to replace each FAR part on an interim basis until formal rulemaking occurred.  These proposed rules are part of phase two, implementing several of the changes already seen in phase one, in which the FAR Council is seeking public comment through formal rulemaking.

What the proposed rules would change

What the Proposed Rules Would Formally Change

FAR Case 2026-001: FAR Parts 1, 2, 4, 33, 39, 40, 52, and 53

FAR Case 2026-001 proposes revisions to FAR Parts 1, 2, 4, 33, 39, 40, 52, and 53.²

FAR Parts 1 and 2 would establish the RFO’s revised operating framework, including updated guiding principles, definitions, acronyms, forms relocation, and a regulatory sunset process. Those changes help explain the structure of the overhaul, but they are not expected to have significant direct contractor impact.

FAR Part 4 would streamline the System for Award Management (SAM) by keeping entity-level representations and certifications in SAM and moving procurement-specific representations and certifications into solicitations. FAR 52.204-8, Annual Representations and Certifications, would be removed, while revised SAM-related provisions and clauses would consolidate entity-level information and maintenance obligations. The proposal also would reduce certain reporting obligations for commercial acquisitions by excluding them from several existing FAR Part 4 clauses. Much of this approach will already look familiar to contractors. During Phase 1 of the RFO, the FAR Council issued model class deviations—including for FAR Part 4—that agencies could adopt on an interim basis to begin consolidating entity-level representations and certifications in SAM and moving procurement-specific representations and certifications into individual solicitations ahead of formal rulemaking. This proposed rule therefore largely codifies the SAM streamlining that the Phase 1 deviation already set in motion, rather than introducing an entirely new SAM construct. Contractors should nonetheless confirm how these changes are reflected in their current SAM registrations and proposal workflows, as the practical rollout depends on which deviations the relevant agencies have adopted.

FAR Part 33 would add a new purpose statement for the bid protest system and enhance agency-level protests. In independent agency-level reviews, protesters could receive redacted copies of the agency’s final technical evaluation and source selection decision and raise additional protest grounds if those disclosures reveal new bases for protest. The proposed rule also would revise FAR 52.233-1, Disputes, to make clear that contractors must continue performance pending final resolution of claims, appeals, or related actions arising under or relating to the contract.

FAR Part 39 would be retitled to cover Information and Communication Technology (ICT) and would apply to acquisitions of ICT and supplies or services that use ICT. The proposal would remove certain privacy-related provisions, such as FAR 52.239-1, Privacy. that the FAR Council views as inconsistently used or unnecessary given other controls. It also would require agencies acquiring IT support or cybersecurity support services to align relevant tasks, skills, work roles, and deliverables with the National Initiative for Cybersecurity Education (NICE) Framework. For Positioning, Navigation and Timing (PNT) service-dependent products, systems, or services, contracting officers would incorporate Federal PNT Services Acquisitions Guidance as appropriate.

FAR Part 40 would consolidate information security and supply-chain security requirements into a single part. The proposal would combine multiple existing representations and clauses addressing restrictions related to Kaspersky, covered telecommunications and video surveillance equipment, ByteDance/TikTok, Federal Acquisition Supply Chain Security Act (FASCSA) orders, certain foreign purchases, and prohibited unmanned aircraft systems—see new FAR clauses 52.240-2 and 52.240-3.³ It also would harmonize the “reasonable inquiry” standard, clarify that contractors are not required to conduct internal or third-party audits or gather information outside their possession, and standardize certain reporting to 72 hours from discovery. The new FAR Part 40 would also renumber and retitle FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems to FAR 52.240-5, Covered Federal Information⁴ and FAR 52.204-2, Security Requirements to FAR 52.240-4, Classified Information.  

Contractors should distinguish between the FASCSA order framework consolidated in Part 40 and the separate proposed rule addressing FASCSA “covered procurement actions.”  The supply-chain restrictions consolidated into Part 40 (previously proposed as Phase 1 deviations at FAR 52.240-90 and 52.240-91 and now reflected in new FAR clauses 52.240-2 and 52.240-3) primarily carry forward the existing FASCSA exclusion and removal order framework, including orders issued through the Federal Acquisition Security Council process and implemented in the current FAR.  The covered-procurement-actions proposal, by contrast, implements Section 203 of FASCSA, codified at 41 U.S.C. § 4713, and would authorize individual agencies to take agency-specific procurement actions to address unacceptable supply-chain risk.  It also would add new solicitation representations and contract performance requirements designed to ensure contractors do not provide or use products or services subject to an applicable agency-level exclusion.  For contractors, the practical point is that FASCSA compliance may involve both FASCSA exclusion and removal orders and additional agency-specific covered procurement actions, requiring companies to monitor both generally applicable and agency-level supply-chain restrictions.

FAR Part 40 also refines the FAR’s implementation of the Section 889 telecommunications ban by clarifying key definitions, narrowing areas of uncertainty, and reducing compliance burdens identified by contractors and agencies following the issuance of the two interim rules implementing Sections 889(a)(1)(A) and (B) of the Fiscal Year 2019 National Defense Authorization Act. The proposed rule is intended to improve implementation by providing additional guidance on the scope of prohibited equipment, services, and exceptions. For instance, new and updated definitions for “covered telecommunications equipment or services,” “critical technology,” “system,” “telecommunications equipment,” “telecommunications services,” “video surveillance equipment,” and “video surveillance services” have been addressed in the proposed rule. Moreover, the scope of “use” has been addressed, clarifying that the following activities are not individually considered use of covered telecommunications equipment or services:  commercial sales, maintenance, testing services, warranty services, and employee’s use of personal equipment. See FAR 52.240-3(d)(1).

The same Part 40 proposal would add governmentwide Controlled Unclassified Information (CUI) requirements through a new CUI form (SF XXX, CUI Requirements) and new FAR clauses—FAR 52.240-6, Notice of Controlled Unclassified Information Requirements, and 52.240-7, Controlled Unclassified Information. This builds off of the January 2025 proposed rule to amend the FAR to implement the National Archives and Records Administration’s CUI program.⁵ The CUI clauses would apply only when CUI is involved in the contract, and contractors would be required to safeguard only the CUI identified in the contract, subject to procedures for potentially unmarked or mismarked CUI. Among other requirements, contractors operating non-federal information systems with CUI would need to comply with NIST SP 800-171 Revision 3 (versus NIST SP 800-17 Revision 2, which is relevant for DFARS compliance purposes) and, for certain critical programs or high-value assets, NIST SP 800-172. In an effort to align incident reporting requirements with other Federal cybersecurity regulations, CUI incidents would generally be reportable within 72 hours, with different reporting channels for DoD and non-DoD contracts. 

FAR Part 53 would be removed and reserved, with forms-related content relocated to new FAR Subpart 1.6, making this primarily a structural change rather than a new contractor compliance obligation.

FAR Case 2026-002: FAR Parts 6, 7, 10, 18, 26, 37, 41, and 52

FAR Case 2026-002 proposes revisions to FAR Parts 6, 7, 10, 18, 26, 37, 41, and 52.⁶

FAR Part 6 would be simplified without substantively changing competition policy or procedures. Consistent with the Phase 1 RFO efforts—which included a model class deviation revising FAR Part 6—the proposal would remove redundant text, focus on core statutory authorities for other than full and open competition, and update justification and approval (J&A) thresholds. For contractors, these changes may improve clarity around competition requirements, justifications, and the post-award availability of justifications.

FAR Part 7 would be formally reorganized around tailored acquisition planning, with market research moved from FAR Part 10 into FAR Subpart 7.2 and industry-engagement requirements relocated from FAR 15.201. The proposal emphasizes commercial products and services, full and open competition, use of existing vehicles, and earlier consideration of modified requirements or commercial solutions. It also would standardize consolidation, bundling, and substantial bundling procedures, including small-business coordination and written determinations. FAR Parts 10 and 18 would be removed and reserved, with emergency acquisition content moved to FAR Part 26 and supported by a dynamic emergency procurement web resource. 

FAR Part 37 would be reorganized to simplify service contracting. The proposal would consolidate performance-based acquisition policy, move inherently governmental functions coverage from FAR Part 7 to FAR Part 37, and create a more logical structure for service-specific requirements. FAR Part 41 would be revised to more directly route most civilian agencies to General Services Administration (GSA) for utility procurements and to update utility clauses in plain language.

FAR Case 2026-005: FAR Parts 5, 24, 29, and 52

FAR Case 2026-005 proposes revisions to FAR Parts 5, 24, 29, and 52.⁷

FAR Part 5 would be reorganized into lifecycle-based subparts for presolicitation, solicitation, and award. Posting requirements would be presented in standardized tables showing notice content and minimum timeframes, and obsolete or duplicative publicizing coverage would be removed.

FAR Part 24 would retain core Privacy Act and Freedom of Information Act (FOIA) requirements while removing duplicative and outdated text. The proposal would clarify the scope of agency civil liability when contractors handle systems of records and reserve the prior standalone Privacy Training section because the training requirement is addressed in FAR 52.224-3. 

FAR Part 29 would streamline taxes coverage by removing obsolete text, refining excise tax references, relocating certain definitions, and clarifying that a Government Purchase or Fleet Card can support a state or local tax exemption claim. The proposal also would remove Afghanistan tax clauses tied to an expired Status of Forces Agreement. 

FAR Case 2026-007: FAR Parts 3, 49, and 52

FAR Case 2026-007 proposes revisions to FAR Parts 3, 49, and 52.⁸

FAR Part 3 would retain statutory ethics, procurement integrity, gratuities, anti-kickback, contingent-fee, whistleblower, contractor-code-of-conduct, and personal-conflict-of-interest requirements while removing obsolete or duplicative material. One contractor-relevant change is the proposed clarification of procedures for reviewing markings on contractor bid or proposal information and source selection information.

Under the proposed marking procedure, if a contracting officer believes proprietary information or contractor bid or proposal information has been improperly marked, the contracting officer must notify the offeror or contractor and provide an opportunity to submit written justification. If the contractor substantiates the markings, the government must notify the contractor; if the government determines the markings are unauthorized, it must obtain higher-level concurrence and provide a written determination before canceling or ignoring the markings. The proposal also states that proposals remain exempt from disclosure under 41 U.S.C. § 4702 regardless of marking disputes.

FAR Part 49 would revise termination procedures. Most notably, the proposal would replace mandatory audits of termination settlement proposals with a permissive, risk-based approach under which the termination contracting officer decides whether audit support is appropriate. The proposal also would remove the certified cost or pricing data threshold as an audit trigger, which the FAR Council says would preserve oversight while reducing unnecessary administrative burden.

The proposal also would shorten key termination timelines. Inventory schedules would be due within 60 days rather than 120 days after termination, and termination settlement proposals would be due within 90 days rather than one year. Extension requests would also be due earlier, though contractors could still request additional time when warranted by the complexity of the settlement. FAR Part 49 also would clarify default termination procedures, including use of cure notices and show-cause notices.

Key contractor takeaways

Contractors should treat the July 23, 2026 comment deadline as a meaningful opportunity to address the operational impacts of the RFO across procurement planning, opportunity tracking, representations and certifications, protests, technology compliance, supply chain and information security, terminations, and clause management. Although several of the proposed changes are framed as plain-language revisions, reorganizations, or burden-reduction measures that align with changes already recommended by Phase 1 of the RFO, the practical effects could be significant for contractors that need to update internal compliance processes, proposal systems, clause libraries, subcontract flowdown tools, and business-development workflows to match the new FAR structure once formally adopted.

The highest-priority contractor-facing changes are likely in FAR Parts 4, 5, 7, 33, 39, 40, and 49 because those parts affect how contractors identify opportunities, prepare proposals, certify compliance, protect information, and manage performance after award.  

FAR Parts 4, 5, and 7 sit at the front end of the procurement lifecycle, so the practical work is not limited to revising clause libraries.  Contractors may need to update SAM-profile maintenance procedures and proposal-intake checklists for the shift of procurement-specific representations into solicitations; retrain business-development and capture teams to track the reorganized FAR Part 5 posting tables, notice content, and minimum timeframes; and re-tool market-research, industry-engagement, commercial-product, consolidation, and bundling response strategies to fit the new FAR Part 7 acquisition-planning framework.  FAR Part 33 could change protest strategy by making agency-level protests a more useful early forum in some procurements: if protesters may obtain redacted technical-evaluation and source-selection materials and raise new grounds based on those disclosures, contractors should reassess when an agency-level protest may preserve optionality, develop the record, or support a later GAO protest.  

FAR Parts 39 and 40 warrant close compliance review because the proposed ICT, cybersecurity, CUI, and supply-chain provisions could require updates to cybersecurity policies, incident-response playbooks, subcontractor questionnaires, supply-chain due diligence processes, and flowdown controls, particularly given the standardized 72-hour reporting window, NIST SP 800-171 Revision 3 for CUI on non-federal systems, the harmonized “reasonable inquiry” standard, and the consolidated restrictions addressing covered telecommunications, FASCSA orders, ByteDance/TikTok, Kaspersky, foreign purchases, and unmanned aircraft systems.  Lack of attention to these items would likely be detrimental because noncompliance can affect both eligibility for award and post-award performance, including the ability to make accurate representations, respond quickly to incidents, manage subcontractor risk, and avoid providing or using restricted products or services.

FAR Part 49 also should not be overlooked: the shorter 60-day inventory-schedule deadline and 90-day settlement-proposal deadline may require contractors to identify potentially terminable work earlier, maintain more current inventory and cost data, and coordinate legal, finance, subcontract-management, and program teams more quickly after a termination notice. The main takeaway is that the RFO is not just a cleanup exercise: even where the FAR Council intends to streamline the regulation, contractors may need to adjust how they find opportunities, certify compliance, evaluate risk, flow down obligations, and manage performance after award in line with FAR changes that will be implemented across the Federal government.

Authored by Mitchell Dolman, Stacy Hadeka, Bill Ferreria, Mike Mason, Joy Sturm, Mike Scheimer, and Allison Pugsley.