Insights

The Rule of Two is a vital mechanism for ensuring that contracting officers satisfy the federal government’s statutory requirement that 23% of U.S. prime contracts be issued to small businesses. FAR 19.502-2(b) (19.104-1(a) of the RFO) requires that agencies set aside procurements for small businesses when there is a reasonable expectation that at least two responsible small businesses will submit offers at fair market prices.  

Guidehouse served as the prime contractor responsible for technology services used in administering New York’s Emergency Rental Assistance Program (“ERAP”). Under Guidehouse’s contract with the State of New York, the online ERAP portal was to undergo cybersecurity testing in its pre-production environment before it was launched to the public, and Guidehouse was required to certify that the system met the contract’s requirements. Within hours of going live, the ERAP portal exposed certain applicants’ personally identifiable information and was shut down.

On September 9, 2026, the European Commission proposed a new Public Procurement Act that would fundamentally change the way that public procurement is regulated across the EU. In this alert we look at what changes have been proposed, and discuss how those changes would affect companies – whether EU-based or not — that wish to participate in European public procurement.  

On October 1, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Assistant Attorney General Colin M. McDonald’s October directive follows his August 2026 memorandum setting the Division’s enforcement priorities. The directive signals — in the DOJ’s words — “an aggressive, all-tools” enforcement posture across the Division’s health care, government contracting, tax, and trade fraud priorities, while simultaneously supporting the incentives designed to promote transparency, reward cooperation, and encourage voluntary disclosure of misconduct. 

On September 28, 2026, the General Services Administration (GSA) issued a new clause for incorporation into government contracts of artificial intelligence systems, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems, as a GSA Regulation Deviation (the Final Clause). The Final Clause will become effective on October 19, 2026.

When an agency conducts a multiple-award indefinite delivery, indefinite quantity (IDIQ) competition, successful awardees often wonder whether they can protest the agency’s award to other companies at the U.S. Court of Federal Claims. For over a decade, the answer has been a murky “maybe” with various Court of Federal Claims decisions divided over the issue. But in a precedential September 16, 2026, decision, the U.S. Court of Appeals for the Federal Circuit in Island Creek Associates, LLC v. United States resolved this split, holding that IDIQ contract awardees lack standing to challenge the IDIQ awards to fellow competitors.

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in U.S. ex rel. Zafirov v. Florida Medical Associates LLC, holding that the qui tam provisions of the False Claims Act are constitutional because relators are not officers of the United States who occupy continuing positions established by law. The decision overturned the 2024 district court ruling that sparked a wave of constitutional challenges to qui tam suits and aligns the Eleventh Circuit with the Fifth, Sixth, Ninth, and Tenth Circuits on the issue. The constitutional debate is far from over, however, as the decision is limited to the constitutionality under the Appointments Clause. The court remanded the case for further evaluation of the parties’ Take Care and Vesting Clause arguments. At the same time, similar constitutional arguments are pending in the Third Circuit, related to the largest-ever FCA judgment in a non-intervened case, and multiple Supreme Court justices have already signaled potential willingness to weigh in on the qui tam provisions’ constitutionality. Crowell's FCA attorneys explain these developments and what's next in a “Feature Comment” published in The Government Contractor.

On September 21, 2026, the Small Business Administration announced an extension of the comment period for two previously proposed rules that, as currently constructed, would significantly expand the pool of entities eligible to qualify for small business set-aside procurements. The extension is slated to be formally published on September 24, 2026.  While the comment period was originally to close on September 21, in response to requests for additional time, SBA has extended the comment period for an additional 60 days with comments now due by November 20, 2026.

In recent years, the U.S. federal government has taken significant interest in the cybersecurity compliance of its contractor base. In 2025 alone, the U.S. Department of Justice’s (DOJ) Civil Cyber-Fraud Initiative recovered more than $50 million across nine False Claims Act (FCA) cybersecurity fraud settlements, and it has secured almost 20 settlements since its launch in October 2021. Because most defendants facing FCA liability for alleged cybersecurity noncompliance enter into pre-litigation settlements, the last court decision in a cybersecurity FCA case was in 2022. However, earlier this month, on September 2, 2026, in  United States ex rel. Pannek v. Archer Daniels Midland Co., No. 23-cv-15145, 2026 WL 2593317 (N.D. Ill. Sept. 2, 2026), Judge Sunil R. Harjani of the U.S. District Court for the Northern District of Illinois granted a motion to dismiss on materiality grounds and offered additional guidance on what a plaintiff must allege to adequately state an FCA cybersecurity claim.

The General Services Administration (GSA) has begun sending out email notifications of a “known glitch” affecting certain System for Award Management (SAM) registrations as far back as spring 2026.  

The U.S. Government Accountability Office’s (GAO) recent decision in Viderity Inc.—Costs, B-424422.5, Sept. 1, 2026, offers useful insight into what constitutes a legally sufficient conflict of interest investigation. The decision arose in an unusual procedural posture: Viderity initially protested, alleging that an agency evaluator had a personal conflict of interest. After the agency took corrective action, Viderity filed a cost entitlement claim requesting that GAO direct the agency to reimburse Viderity’s protest costs. In evaluating that claim, GAO assessed whether Viderity’s underlying protest ground was “clearly meritorious.”

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

On August 20, 2026, the Small Business Administration (SBA) proposed to materially amend the way it establishes size standards for purposes of federal procurement. SBA simultaneously issued two rulemakings. First, SBA published the 2026 Revised Size Standards Methodology white paper (2026 White Paper), which explains the proposed changes to SBA’s methodology for establishing size standards. Second, SBA published

 

On Tuesday, August 25, 2026, the U.S. Department of Justice (DOJ) announced that Deloitte LLP and several of its subsidiaries agreed to pay, collectively, $21.5 million to resolve allegations that Deloitte violated the False Claims Act (FCA) by failing to comply with new anti-discrimination requirements incorporated into its federal contracts, by discriminating against employees and applicants on the basis of race and sex, and by allocating and seeking reimbursement for costs related to those practices under its federal government contracts. This resolution is the second of its kind under DOJ’s recently launched Civil Rights Fraud Initiative, following a similar settlement by IBM in April 2026.

Enbrel (etanercept) is one of the best-selling biologic drugs in the United States, approved to treat rheumatoid arthritis and other serious inflammatory conditions. Etanercept was launched as Enbrel in 1998 as a treatment for moderate to severe rheumatoid arthritis, and was later approved to treat additional inflammatory diseases including plaque psoriasis, psoriatic arthritis, ankylosing spondylitis, and polyarticular juvenile idiopathic arthritis.  

On September 1, 2026, the Eleventh Circuit issued its long-anticipated decision in United States v. Florida Medical Associates, LLC, – F.4th –, 2026 WL 2581886 (11th Cir. Sept. 1, 2026) (the “Zafirov appeal”) overturning the district court and holding that the qui tam provisions of the False Claims Act (“FCA”) do not violate the Appointments Clause of Article II of the United States Constitution because relators are not officers of the United States that occupy “continuing positions.” The Eleventh Circuit did not reach other arguments made by the parties and remanded the case to the District Court for the Middle District of Florida to address two other constitutional arguments challenging the FCA’s qui tam provisions based on Article II’s Vesting and Take Care Clauses. 

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.

A recent U.S. Court of Federal Claims (COFC) decision serves as an important reminder that when the Government Accountability Office (GAO) denies a protest, this is not necessarily the end of the road. Often, contractors retain the right to file a new protest at the COFC, which conducts its own de novo review of the procurement record. This so-called “second bite at the apple” protest is a powerful tool as the COFC’s recent decision in Chugach Logistics & Facility Services JV, LLC v. USA makes clear.

In Appeal of Bahadir (a C&M case), the Armed Services Board of Contract Appeals denied the government’s motion to dismiss in its entirety, ruling in favor of the contractor on both key issues raised by the government. The case arises from a contract for construction work at Al Udeid Air Base in Qatar, under which Appellant alleged government-caused delay and filed certified prolongation claims using a “windows analysis” methodology. The government moved to dismiss, arguing that Appellant failed to state a sum certain for each of what the government characterized as 38 distinct claims, and separately that four claims had not been properly presented to the Contracting Officer.