Defense Federal Acquisition Regulation Supplement
Technology and AI companies with Department of Defense contracts are navigating an accelerating series of DFARS rule changes that directly affect software supply chain security, AI system procurement, and data handling obligations. The Office of the Under Secretary of Defense for Acquisition and Sustainment, the Defense Contract Audit Agency, and the Defense Advanced Research Projects Agency each hold enforcement and contracting authority that touches how tech vendors price, disclose, and secure AI-enabled products sold to the federal government. Compliance teams are currently mapping DFARS 252.204-7012 cybersecurity clauses and the Cybersecurity Maturity Model Certification interim rule against their existing vendor and subcontractor agreements.
Watch
- DFARS 252.204-7012 flowdown requirements for AI-integrated subcontractors
- CMMC 2.0 final rule: Level 2 self-assessment deadlines for tech prime contractors
- Defense Contract Audit Agency scrutiny of IR&D cost claims tied to AI R&D
- Proposed DFARS rule on software bill of materials disclosure for DoD-facing SaaS products
- Foreign ownership, control, or influence reviews affecting AI firm DoD eligibility
Recent material activity in Technology, AI & Competition
A selection of recent published briefs; this is not a complete archive.
CISA adds Adobe Commerce and Magento authorization flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27 2026
CISA added CVE-2026-71362, an incorrect authorization vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability allows unauthenticated privilege …
Read a full sample brief →CISA adds WSO2 path traversal vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27, 2026
CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability is a path traversal flaw affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gate…
Read a full sample brief →FTC amends Rules of Practice to align with the FTC Act and formalize the American Competition Enforcement Division
The FTC approved amendments to its Rules of Practice on September 24, 2026, by a 2-0 vote. The amendments align procedural rules with the FTC Act, embed the newly created American Competition Enforcement Division by name…
Read a full sample brief →FTC opens rulemaking inquiry into platform ad-optimization tools that amplify impersonation scams
The FTC published an Advance Notice of Proposed Rulemaking on September 24, 2026, seeking public comment on whether to amend its Rule on Impersonation of Government and Businesses. The inquiry targets social media platfo…
Read a full sample brief →FTC opens rulemaking inquiry into platform ad-optimization tools that amplify impersonation scams
The FTC published an Advance Notice of Proposed Rulemaking on September 24, 2026, seeking comment on whether to amend its Impersonation of Government and Businesses Rule or issue a new rule. The ANPRM targets social medi…
Read a full sample brief →Canada Competition Bureau secures consent agreement with Kalibrate over retail fuel data-sharing competition concerns
The Competition Bureau of Canada reached a consent agreement with Kalibrate on September 24, 2026, restricting how the company may collect, aggregate, and distribute competitor-sensitive pricing and operational data from…
Read a full sample brief →CMA opens Phase 1 merger inquiry into Vivisol's acquisition of Air Liquide's UK home oxygen services business
The CMA announced on September 24, 2026 that it is investigating the anticipated acquisition by Dolby Medical Home Respiratory Care Limited, trading as Vivisol, of Air Liquide Healthcare Limited's home oxygen services bu…
Read a full sample brief →CMA issues first-ever civil penalties against individuals for concealing evidence during a competition inspection
The CMA fined construction firm M&J Group and two of its staff members a combined £50,000 on September 24, 2026 for concealing a mobile phone and documents during a warranted inspection. These are the first civil penalti…
Read a full sample brief →CMA opens Chapter I investigation into suspected anti-competitive arrangements in roofing and construction services
The Competition and Markets Authority (CMA) opened an investigation on September 24, 2026 into suspected anti-competitive arrangements in the supply of roofing and other construction services. The investigation concerns …
Read a full sample brief →CNIL closes May 2025 injunction against Solocal Marketing Services after consent-verification measures accepted
The CNIL's enforcement chamber closed its injunction against Solocal Marketing Services on September 17, 2026. The original injunction, issued May 15, 2025, required the company to verify the validity of consent collecte…
Read a full sample brief →