Insights

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights.

On June 30, 2026, the U.S. Supreme Court issued its decision in West Virginia v. B.P.J. / Little v. Hecox, holding that Title IX permits schools to limit participation in girls’ and women’s sports to students assigned female at birth and that state laws limiting such teams to students assigned female at birth do not violate the federal Equal Protection Clause. The decision provides significant guidance for K-12 schools, colleges and universities, athletic departments, and state policymakers navigating participation rules for school-sponsored athletics.

On June 18, 2026, the Illinois Department of Labor took a long-anticipated step by adopting comprehensive amendments to 56 Ill. Adm. Code Part 320, the administrative rules implementing the pay transparency requirements of the Illinois Equal Pay Act of 2003 (820 ILCS 112, the Act).

Following the 10th Circuit's April 21, 2026, decision affirming the disallowance of Liberty Global’s $2.4 billion deduction under the codified economic substance doctrine, I.R.C. § 7701(o), Liberty Global filed a petition for panel rehearing or rehearing en banc on June 5, 2026. That petition has since drawn significant amicus support from various industry groups representing large taxpayers, as discussed below.

The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.

In Utech, Inc. v. United States, No. 24-1586 (Fed. Cir. June 24, 2026), the U.S. Court of Appeals for the Federal Circuit clarified that in most cases, a pre-award protest must be filed before the proposal submission deadline to avoid the Blue & Gold waiver rule.  This decision, while nonprecedential, is in line with U.S. Government Accountability Office (GAO) precedent, which has long held that pre-award protests must be filed before the proposal submission deadline.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

The EU’s steel safeguard under Implementing Regulation (EU) 2019/159 expired on 30 June 2026 and has been replaced by a new permanent instrument — the EU Steel Overcapacity Regulation (Regulation (EU) 2026/1384) (the Regulation”). It imposes tariff-rate quotas and an out-of-quota duty, similarly to the steel safeguard measures that expired. The out-of-quota duty has been raised from 25% to 50% to minimize the risk of trade diversion. The Regulation reduces duty-free imports of 26 categories of steel products into the EU by an average of 47% compared with the quotas under the until recently applicable safeguard measures.

The United States had barely finished blowing out 250 candles on its birthday cake when the Federal Trade Commission (FTC) decided to remind corporate America what “Made in USA” is actually supposed to mean. On July 6, 2026, the FTC sent a pointed message to the marketplace: unsubstantiated “Made in USA” claims will not go unnoticed. The FTC sent warning letters to several companies advertising products as “Made in USA” — and, in at least one case, “Made in Texas” — despite information suggesting that the products were imported in whole or in significant part.

On July 1, 2026, EPA proposed the sixth Unregulated Contaminant Monitoring Rule (UCMR 6), which will require public water systems (PWS) to monitor 30 unregulated contaminants — including certain PFAS chemicals — but not microplastics. For now, EPA is using other tools, such as the Contaminant Candidate List (CCL), to learn more about microplastics before requiring PWSs to monitor for them.

As part of its ongoing effort to conform the Cost Accounting Standards (“CAS”) to generally accepted accounting principles (“GAAP”), the CAS Board published a final rule rescinding CAS 408 (Accounting for costs of compensated personal absence) and CAS 411 (Accounting for acquisition costs of material).  The CAS Board also rescinded CAS 404 (Capitalization of tangible assets) and CAS 409 (Depreciation of tangible capital assets) but retained certain requirements of CAS 404 and 409, which will be located in new paragraphs of CAS 405 (Accounting for unallowable costs).  Specifically, the CAS Board retained the requirements currently located at CAS 404-50(d)(1), CAS 409-50(e)(5), CAS 409-50(j)(1), and CAS 409-50(j)(4), which the CAS Board explained are necessary to protect the Government’s interests.  Otherwise, the CAS Board determined that the requirements of CAS 404, 408, 409, and 411 overlapped with GAAP such that GAAP “may be applied reasonably as a substitute for CAS to support contract cost and pricing.”

We are pleased to announce that Crowell & Moring and Crowell GovCon Strategies will be exhibiting at Farnborough International Airshow (FIA 2026), one of the world's premier aerospace, defence and space events. FIA is where the aerospace, defence and space industry comes together. It is where deals are made, partnerships are formed, and the future direction of the sector takes shape. For businesses operating in this environment, navigating complex regulation, competing for government contracts, protecting critical intellectual property and managing international trade across multiple jurisdictions demands the right legal and strategic counsel.

On July 6, 2026, Illinois Governor JB Pritzker signed SB 315, the Artificial Intelligence (AI) Safety Measures Act (the Illinois Act), to establish a framework for AI safety, transparency, and accountability for the world’s most powerful AI models. The governor’s approval follows unanimous passage of the bill by the Illinois House and nearly-unanimous support in the Illinois Senate in May. 

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

A recent enforcement action led by Minnesota Attorney General Keith Ellison along with a bipartisan coalition of state attorneys general signals an accelerating and coordinated crackdown on competitively sensitive information-sharing arrangements.

On July 2, 2026, the Department of War (DoW) issued an Advance Notice of Proposed Rulemaking (ANPR) setting out a framework to implement the prohibition on acquisition of covered printed circuit boards (PCBs) from “covered nations”—North Korea, China, Russia, and Iran—enacted under sections 841 and 851 of the National Defense Authorization Acts (NDAAs) for Fiscal Years 2021 and 2022, respectively, and codified at 10 U.S.C. § 4873.  DoW invites industry to respond to specific questions and provide comments on the ANPR by August 31, 2026.

As schools, athletes, and other entities continue to navigate the boundaries of the House Settlement (In Re College Athlete NIL Litigation, No. 4:20-cv-03919-CW), at least one recent decision made clear a court’s position on what qualifies as an Associated Entity under the settlement. As noted previously, the College Sports Commission (CSC) sent out a rules reminder in January regarding Associated Entities. Under the House Settlement, these entities include those

On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy "Rev5" authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028. 

On June 22, 2026, House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) announced a bipartisan agreement on a revised version of the KIDS Act (H.R. 7757), marking the most significant congressional advance on children's online safety legislation in years. The House passed H.R. 7757, as amended, on June 29, 2026, setting up a potential showdown with the Senate. The revised KIDS Act consolidates elements of 14 pending legislative proposals — including KOSA and COPPA 2.0, both of which have previously passed the Senate and cleared the House Energy and Commerce Committee — into a single, comprehensive framework. The announcement, however, was met immediately with objections from Senate sponsors and civil liberties groups, underscoring the difficult legislative road ahead.

The week of June 29 brought a flurry of regulatory activity from the Department of Transportation (DOT), the Federal Aviation Administration (FAA), and the Transportation Security Administration (TSA) impacting companies across sectors including airlines, supersonic aircraft manufacturers, drone operators, and owners/operators of critical infrastructure facilities.  A summary of the key developments is below.