The Federal Acquisition Regulatory Council published four proposed rules in the Federal Register on June 23, 2026, marking the transition of the Revolutionary FAR Overhaul from administrative streamlining actions into formal notice-and-comment rulemaking. The four rules collectively amend 21 FAR parts spanning contract administration, information technology, security, protests, and the clause library. Interested parties have 30 days from publication — a comment deadline falling on or about July 23, 2026 — to submit written input before the FAR Council finalizes the rules.

What the First Batch Covers

The four proposed rules divide the 21 affected parts into logical clusters. The first rule addresses Parts 1, 2, 4, 33, 39, 40, 52, and 53 — the foundational administrative parts, security, IT, protests, and the clause library. The second rule covers Parts 5, 24, 29, and 52. The third addresses Parts 3, 49, and 52. The fourth covers Parts 6, 7, 10, 18, 26, 37, 41, and 52. Part 52, which contains the FAR's entire clause library, appears in all four rules because many of the substantive changes require corresponding clause revisions.

This first formal rulemaking batch does not include several high-profile parts still under review: Part 19 (small business), Part 8 (required sources), Part 12 (commercial items), Part 13 (simplified acquisitions), and Part 15 (competitive proposals). Those parts are expected to be addressed in subsequent rulemaking batches later in fiscal 2026 and into fiscal 2027.

Key Substantive Changes

The most operationally significant changes for contractors and contracting officers include the following.

Increased contracting officer discretion. Many of the proposed changes convert mandatory requirements — actions that current FAR language requires contracting officers to take — into discretionary authorities where the officer may act or not based on the circumstances of the acquisition. The FAR Council characterizes this as restoring judgment to acquisition professionals rather than imposing one-size-fits-all process requirements across all procurement types and dollar thresholds.

Reduced public award announcement requirement. Under the proposed rule, agencies would no longer be required to publicly announce contract awards exceeding $5.5 million. The current threshold requiring public announcement is $4.5 million. The change reduces the volume of publicly reported award actions while still maintaining reporting requirements for larger awards and those subject to congressional notification thresholds.

New Part 40 security consolidation. The proposed rule creates a new Part 40 that consolidates multiple existing security-related requirements into a single framework covering supply chain risk management, security prohibitions, exclusions from procurement for identified entities, and controlled unclassified information handling. Part 40 would also standardize the cyber incident reporting timeline across FAR at 72 hours from discovery, aligning with the Cyber Incident Reporting for Critical Infrastructure Act of 2022 and with existing DoD CUI reporting requirements.

IT acquisition expansion in Part 39. The proposed changes to Part 39, which currently governs information technology acquisitions, would expand the part's coverage to information and communication technology broadly and incorporate requirements related to cybersecurity workforce standards and positioning, navigation, and timing services. The expansion reflects the convergence of IT and operational technology in federal acquisitions and the growing importance of resilient timing infrastructure in government systems.

Agency-level protest enhancements in Part 33. Changes to Part 33 aim to strengthen internal agency protest resolution before matters escalate to the Government Accountability Office or the Court of Federal Claims. Proposed changes would require contracting officers to promptly report protests to the head of contracting activity, give protesters seeking independent review access to a redacted source selection decision, and allow submission of supplemental statements. The 14-day procurement integrity violation reporting requirement was deleted. References to GAO protest procedures are reorganized to point to 4 CFR Part 21 rather than repeating procedural language, and claim dispute procedures are consolidated into a single FAR 33.205 section for clarity. This structural consolidation is part of the broader overhaul theme of eliminating redundant language — the FAR Council has already eliminated 2,724 mandatory clauses and reduced the regulation's page count by 25 percent through prior class deviations and administrative actions.

What It Means for Contractors

  • The July 23, 2026 comment deadline is 30 days from publication — contractors and trade associations with substantive concerns about the Part 39, 40, or 33 changes should file comments through the Federal eRulemaking Portal at regulations.gov, citing docket number FAR-2026-12559.
  • The proposed reduction in mandatory award announcements from $4.5M to $5.5M will make it modestly harder to track small competitive awards through public sources — firms relying on SAM.gov for market intelligence should anticipate a slight gap in award visibility at the lower end.
  • The new Part 40 security consolidation is a positive simplification for contractors managing multiple overlapping security compliance requirements under existing FAR parts 4, 24, and 39 — but the transition will require compliance programs to map existing obligations to the new consolidated framework.
  • The 72-hour cyber incident reporting standard in Part 40 aligns FAR with DFARS and CIRCIA — for contractors not yet meeting this timeline, the proposed rule signals that FAR-covered civilian agency contracts will soon carry the same incident reporting expectations as DoD contracts.
  • Parts 19, 12, 13, and 15 — which govern small business set-asides, commercial item acquisition, micro-purchases, and competitive negotiated procurements — are still pending and likely to carry the most commercially significant changes for contractors when published.
  • Contractors managing compliance programs that span both FAR-only civilian contracts and DFARS-covered DoD contracts should assess whether the proposed 72-hour cyber incident reporting standard in new Part 40 creates a harmonized baseline or introduces new inconsistencies with the existing DFARS 252.204-7012 reporting chain.
  • Trade associations representing small businesses — which often bear disproportionate compliance costs from new FAR requirements — should prioritize submitting comments on the proposed reduction in mandatory contracting officer actions, as reduced process requirements cut both ways: they can reduce administrative burden or they can reduce predictability for offerors who rely on mandatory debriefing and announcement procedures to track competition outcomes.

Sources