Each card gives the rule, its status, the words that matter and our part in the work. Your agency makes the determinations; we provide the evidence and the documentation.
U.S. federal (executive agencies)Key date: April 3, 2025
OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government
In force; rescinds and replaces M-24-18. Applies to contracts awarded from solicitations issued on or after September 30, 2025 (180 days after issuance) and to options exercised after that date; it does not apply to AI acquired as a component of a National Security System.
“Ensuring contracts permanently prohibit the use of non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent”
What we do: Our contract terms keep your data out of model training without your written consent, keep your data and the work we build for you portable, make knowledge transfer a deliverable, and give a performance-based contract a pre-registered measure it can use.
Source: OMB M-25-22 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (executive agencies)Key date: March 10, 2026
OMB Circular A-123 (revised 2026): Management's Responsibility for Internal Control
In force on issuance (March 10, 2026); supersedes all previous versions of the Circular, and Appendices A, B, C and D remain in effect.
“When possible, agencies should consider automated systems and technologies to streamline the process of conducting risk assessments, testing controls, and monitoring control performance.”
What we do: We build the governed data model and dashboards your control owners use for automated control testing and monitoring, on the financial system you already run.
Source: OMB Circular A-123 (revised 2026) (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (executive agencies)Key date: August 20, 2025
OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay
In force (issued August 20, 2025); implements Executive Order 14249 Section 3(c) and (d) through a standard Do Not Pay routine use in agency system of records notices and the conditions for Treasury's waiver of computer matching agreements.
“ensure that a thorough review of available databases with relevant information on eligibility occurs to determine program or award eligibility and prevent improper payments before the release of any Federal funds”
What we do: We build the data flows that prepare payee and award data for the Do Not Pay checks your agency is authorized to run, and the approval steps where your staff review the results before a payment is released.
Source: OMB M-25-32 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (executive agencies)Key date: January 15, 2025
OMB M-25-05: Phase 2 Implementation of the Evidence Act (Open Government Data Access and Management)
In force (issued January 15, 2025; rescinds and replaces M-13-13). The initial actions, including inventory listings in the DCAT-US 3.0 schema (published May 1, 2026) and the inventory hosted at www.[agency].gov/data.json, were due September 30, 2026; agencies update the inventory within 90 days of a new data asset and at least once a year.
“Each agency is required to develop and maintain a comprehensive data inventory of all data assets maintained by the agency.”
What we do: We build the governed data catalog on Databricks or Microsoft Fabric in your tenant and supply the metadata for its data assets to your agency's comprehensive data inventory, so the same data serves reporting, AI and open-data publication.
Source: OMB M-25-05 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (Treasury)Key date: November 1, 2026
Treasury GTAS (Governmentwide Treasury Account Symbol Adjusted Trial Balance System)
Current Treasury reporting system; FY 2027 reporting runs in monthly windows starting December 4, 2026.
“Entities, including agencies, use GTAS to provide proprietary financial reporting information”
What we do: We build reconciliation views from the general ledger to your GTAS submissions so differences surface before the close.
Source: Treasury GTAS (fiscal.treasury.gov) (opens in a new tab) · Checked November 10, 2026
U.S. federal and state (criminal justice information)Key date: June 25, 2026
FBI CJIS Security Policy (v6.1) and Microsoft CJIS agreements
CJIS Security Policy v6.1 released June 25, 2026; Texas audits through March 31, 2027 use v5.9.5.
“All Texas CJIS audits through March 31, 2027 are conducted against FBI CJIS Security Policy version 5.9.5.”
What we do: Criminal-justice data stays inside the Microsoft government services your state's CJIS agreement covers, and we design to the policy version your auditor uses.
Source: FBI CJIS Security Policy (dps.texas.gov) (opens in a new tab) · Checked November 10, 2026
U.S. federal and state (federal tax information)Key date: November 2021
IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies
Rev. 11-2021 current (IRS Safeguards page, last reviewed June 28, 2026). An early-release draft, Rev. 12-2026, takes effect 6 months after its publication date and adds a section on artificial intelligence.
“Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies … (Rev. 11-2021)”
What we do: Federal tax information stays inside the authorized government cloud boundary your safeguards review relies on, and we design the data platform to the current Publication 1075.
Source: IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (irs.gov) (opens in a new tab) · Checked November 10, 2026
U.S. (state and local governments)Key date: April 20, 2026
ADA Title II web and mobile accessibility rule: compliance dates extended (DOJ interim final rule)
IFR (91 FR 20902) effective April 20, 2026: 50,000 or more → April 26, 2027; under 50,000 and special districts → April 26, 2028; WCAG 2.1 AA stands as adopted in 2024. DOJ plans future rulemaking on the substance, and NFB v. DOJ, No. 1:26-cv-02007 (D. Md., filed May 21, 2026), which asks the court to vacate the extension, is pending.
“The compliance date for public entities with a total population of less than 50,000, or any special district government, is extended from April 26, 2027, to April 26, 2028.”
What we do: Public-facing apps, agents and dashboards we build for state and local governments are built and tested to WCAG 2.1 Level AA, and remediation against your compliance date becomes a costed line in the business case.
Source: ADA Title II web and mobile accessibility rule (govinfo.gov) (opens in a new tab) · Checked November 12, 2026