Insights

On July 2, 2026, the Department of War (DoW) issued an Advance Notice of Proposed Rulemaking (ANPR) setting out a framework to implement the prohibition on acquisition of covered printed circuit boards (PCBs) from “covered nations”—North Korea, China, Russia, and Iran—enacted under sections 841 and 851 of the National Defense Authorization Acts (NDAAs) for Fiscal Years 2021 and 2022, respectively, and codified at 10 U.S.C. § 4873.  DoW invites industry to respond to specific questions and provide comments on the ANPR by August 31, 2026.

As schools, athletes, and other entities continue to navigate the boundaries of the House Settlement (In Re College Athlete NIL Litigation, No. 4:20-cv-03919-CW), at least one recent decision made clear a court’s position on what qualifies as an Associated Entity under the settlement. As noted previously, the College Sports Commission (CSC) sent out a rules reminder in January regarding Associated Entities. Under the House Settlement, these entities include those

On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy "Rev5" authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028. 

On June 22, 2026, House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) announced a bipartisan agreement on a revised version of the KIDS Act (H.R. 7757), marking the most significant congressional advance on children's online safety legislation in years. The House passed H.R. 7757, as amended, on June 29, 2026, setting up a potential showdown with the Senate. The revised KIDS Act consolidates elements of 14 pending legislative proposals — including KOSA and COPPA 2.0, both of which have previously passed the Senate and cleared the House Energy and Commerce Committee — into a single, comprehensive framework. The announcement, however, was met immediately with objections from Senate sponsors and civil liberties groups, underscoring the difficult legislative road ahead.

The week of June 29 brought a flurry of regulatory activity from the Department of Transportation (DOT), the Federal Aviation Administration (FAA), and the Transportation Security Administration (TSA) impacting companies across sectors including airlines, supersonic aircraft manufacturers, drone operators, and owners/operators of critical infrastructure facilities.  A summary of the key developments is below.

On June 18, 2026, the U.S. Department of Justice (DOJ) announced that LOGZONE Inc., a defense contractor based in Huntsville, Alabama, agreed to pay $507,144 to resolve allegations that it violated the False Claims Act (FCA) by knowingly failing to satisfy cybersecurity requirements in its contracts with the U.S. Department of the Navy. The resolution is the latest action under DOJ’s Civil Cyber-Fraud Initiative and the first publicly reported settlement this fiscal year. It underscores a continued enforcement posture in which noncompliance with contractual cybersecurity obligations serves as the basis for potential FCA liability. Notably, this settlement did not arise from a whistleblower complaint but from a government-initiated assessment, signaling to contractors that proactive government assessments can pose enforcement consequences.

On June 26, 2026, the National Highway Traffic Safety Administration (NHTSA) took two major actions related to autonomous vehicles. First, NHTSA issued a Notice of Proposed Rulemaking (NPRM) proposing significant updates to Federal Motor Vehicle Safety Standard (FMVSS) No. 135, which has governed light vehicle brake systems in passenger cars and light trucks since 1995.[1]  Second, NHTSA formally withdrew its January 15, 2026 NPRM, which had proposed the Automated Driving System-Equipped Vehicle Safety, Transparency, and Evaluation Program (AV STEP), a voluntary program for vehicle manufacturers, fleet operators, and system integrators of autonomous vehicles and automated driving systems.

On June 4, 2026, Rep. Scott Fitzgerald (R-WI-5) introduced a bill that would limit the ability of people and entities seen as threats to U.S. national security to obtain and enforce patents. If enacted, the Prohibiting Adversarial Patents Act of 2026 (H.R. 9142) would leverage use of patent law as a national security tool, with consequences for companies operating in technology-intensive sectors, including drones, telecommunications, semiconductors, artificial intelligence, and advanced manufacturing. The proposed legislation, currently under review by the U.S. House Judiciary Committee, is particularly focused on persons and entities with connections to the People’s Republic of China.

If a court finds that a patent applicant intentionally misrepresented or withheld material information from the USPTO with the intent to deceive, the consequences are severe, leading to unenforceability of the entire patent (and likely any later patents claiming priority to the unenforceable patent).

Qatar has enacted Law No. 9 of 2026, amending the Labour Law issued by Law No. 14 of 2004. The amendments cover the scope of the application of the Labour Law, vocational certification, noncompete clauses, the right to strike, joint committees, dismissal grounds, and enforcement powers. Employers should review their employment practices and documentation to ensure compliance.

RICO was built for the mob. But Congress gave trade secret victims access to it in 2016, and a recent U.S. Court of Appeals for the Fifth Circuit decision shows that access is real.

In June 2026, federal regulators and lawmakers continued their efforts to improve drug affordability through targeted reforms. These recent developments will primarily impact pharmaceutical manufacturers, managed care organizations, and pharmacy benefit managers (PBM) serving Medicare Part D program members. PBMs, Medicare Advantage organizations, and Part D sponsors should monitor these changes in the interest of maintaining compliance and providing input on regulatory proposals that may influence their business operations or compensation structures in the future.

On June 25, 2026, the U.S. Supreme Court issued its landmark decision in Monsanto Co. v. Durnell, No. 24-1068, resolving a circuit split over whether the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) preempts state law failure-to-warn claims challenging EPA-approved pesticide labels. In a 7-2 opinion, the Court held that FIFRA expressly preempts state tort claims that would require a manufacturer to add or modify warnings on a pesticide label, at least where the U.S. Environmental Protection Agency (EPA) has evaluated the relevant risk and approved the label, whether with warnings reflecting the agency’s assessment or without a corresponding warning.

On June 22, 2026, President Trump signed two executive orders, “Securing the Nation Against Advanced Cryptographic Attacks” (Quantum Security EO) and “Ushering in the Next Frontier of Quantum Innovation” (Quantum Innovation EO), marking the most significant federal action on quantum technology since the Quantum Computing Cybersecurity Preparedness Act of 2022, which directed agencies to harden their information systems against quantum-enabled hacking. The orders seek to speed the development of quantum computers, which are advanced processors that can calculate multiple possibilities simultaneously and thus solve problems exponentially faster than traditional computers. At the same time, the orders look to protect against the danger that quantum technology can “break” traditional encryption by easily decoding it. Of particular note for government contractors, the Quantum Security EO directs agencies to update federal acquisition regulations to require contractors by 2031 to adopt information processing standards that resist quantum-enabled codebreaking.

On June 17, 2026, the U.S. Department of Justice’s (DOJ( National Security Division (NSD) announced that it had issued a declination for Robert Bosch GmbH (Bosch) relating to potential violations of the Export Control Reform Act, 50 U.S.C. § 4819 (ECRA). Specifically, the DOJ declined to criminally prosecute Bosch’s violations of the Export Administration Regulations’ (EAR) Foreign Direct Product Rule (FDPR), which apparently resulted from two Bosch subsidiaries’ export of products and software manufactured with equipment that was the direct product of U.S. software or technology to Huawei Technologies Co., Ltd. and its “Entity List” affiliates, including Huawei Tech. Investment Co., Ltd., Hong Kong (collectively, Huawei). The same day, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a parallel civil administrative settlement with Bosch.

Two significant recent developments illustrate the Trump administration’s increasing focus on policing of hospital contracting practices that limit health plan network design flexibility. On June 16, 2026, the U.S. Department of Justice (DOJ) Antitrust Division and Ohio attorney general filed a proposed consent decree resolving their civil antitrust suit against OhioHealth. (Prior Alert) Two days later, the White House Council of Economic Advisers (CEA) released a memorandum quantifying the potential economic effects of a broader ban on the types of contracting restrictions at issue in the OhioHealth case and the DOJ's parallel suit against NewYork-Presbyterian. This alert updates our prior coverage of the OhioHealth complaint and summarizes both developments.

The nation’s power grid and infrastructure are facing increased pressure from artificial intelligence (AI) data centers, prompting new questions around environmental regulatory design and compliance. As technology companies race to build and expand new data center factories, they face a web of permitting requirements as well as potential community opposition, and environmental litigation — all against a backdrop of rapid and still-evolving agency guidance.

A recent U.S. Government Accountability Office (GAO) decision dismissing three pre-award protests as untimely highlights an important procedural trap for would-be protesters. In Oready, LLC, GAO dismissed three protests filed one business day too late, even though they were submitted prior to the solicitation closing date and time. 

From June 19, 2026, all online traders active within the EU are required to provide a “withdrawal button” on their websites and apps. The introduction of this withdrawal button represents a significant shift in the online consumer cancellation landscape. In this alert, we provide an overview of what this requirement means in practice and why compliance is so important.

The General Services Administration (GSA) is seeking public comment on a new GSA Regulation clause, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems (LLMs), governing data safeguards and requirements prime contractors must comply with when providing or using LLMs under federal contracts. This updated clause (Revised Clause) reflects substantial revisions from an earlier version released in March 2026 (Original Clause) that faced substantial pushback from industry. Where the Original Clause cast a wide net — imposing obligations broadly across AI systems with little differentiation among supply-chain participants — the Revised Clause is more narrowly tailored. The Revised Clause: