The rules behind your budget and your buying, mapped to the work we do.

U.S. federal (executive agencies)Key date: April 3, 2025

OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust

In force; rescinds and replaces M-24-10. Minimum practices for high-impact AI were due within 365 days (April 3, 2026).

“the intended purpose for the AI and its expected benefit, supported by specific metrics or qualitative analysis”

What we do: We produce the evidence an AI impact assessment asks for: the expected benefit against the current process, the costs and expected savings, the pre-deployment test results and the monitoring plan, and your agency's reviewers make the determinations.

Source: OMB M-25-21 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies)Key date: April 3, 2025

OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government

In force; rescinds and replaces M-24-18. Applies to contracts awarded from solicitations issued on or after September 30, 2025 (180 days after issuance) and to options exercised after that date; it does not apply to AI acquired as a component of a National Security System.

“Ensuring contracts permanently prohibit the use of non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent”

What we do: Our contract terms keep your data out of model training without your written consent, keep your data and the work we build for you portable, make knowledge transfer a deliverable, and give a performance-based contract a pre-registered measure it can use.

Source: OMB M-25-22 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies; LLM procurement)Key date: December 11, 2025

OMB M-26-04: Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles

In force (issued December 11, 2025); agency policies were due March 11, 2026, and existing LLM contracts should be modified, at the latest, before an option extends the period of performance. The memo ceases to have effect on December 11, 2027 unless the OMB Director provides otherwise.

“No later than March 11, 2026, agencies must update their policies and procedures to ensure that contracts for the procurement of LLMs include contractual requirements addressing compliance with the Unbiased AI Principles.”

What we do: For every model we deploy, we gather the vendor documentation your acquisition team requests under M-26-04, such as the acceptable use policy and model or system cards, and set up the user-reporting route your policy describes.

Source: OMB M-26-04 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federalKey date: December 8, 2025

OMB M-26-03: President's Management Agenda

Current President's Management Agenda.

“Reduce wasteful processes through artificial intelligence”

What we do: We tie each AI investment to the systems it consolidates or retires and to the savings it is expected to free, so the business case answers the agenda's goals in budget terms.

Source: OMB M-26-03 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federalKey date: April 13, 2026

2025 Federal Agency AI Use Case Inventory (OMB)

Published repository; summary as of April 13, 2026.

“3,611 individually-reported AI use cases (all stages of development)”

What we do: We turn an agency's inventory entries into a ranked roadmap with a business case for the use cases worth funding first.

Source: 2025 Federal Agency AI Use Case Inventory (github.com) (opens in a new tab) · Checked November 10, 2026

U.S. federal (voluntary framework; named by Texas law)Key date: January 26, 2023

NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile (NIST AI 600-1)

AI RMF 1.0 released January 26, 2023 and being revised under the AI Action Plan; NIST AI 600-1 released July 26, 2024.

“The AI RMF 1.0 is being revised as part of the White House AI Action Plan.”

What we do: We map the delivery to the NIST AI RMF and its Generative AI Profile, and keep the risk screen, the test results and the review records with your team.

Source: NIST AI Risk Management Framework (nist.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal budgetKey date: November 6, 2026

OMB Circular A-11 (2026), Section 55: Information Technology Investments

Current edition: OMB Circular A-11 (2026), Transmittal Memorandum No. 100 of November 6, 2026, which supersedes all previous versions.

“Agencies should regularly review their Major IT Investments to ensure that they continue to add the expected value to the agency's stated business goals or mission outcomes.”

What we do: We write investment business cases that carry the planned and actual costs, the anticipated and achieved benefits and the cost, schedule and performance risks that Section 55 asks agencies to document for Major IT Investments.

Accounting treatment is determined by your auditors; we provide evidence and documentation.

Source: OMB Circular A-11 (2026), Section 55 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federalKey date: April 8, 2025

OMB Circular A-94 (1992), reinstated by OMB M-25-23

In force: M-25-23 (April 8, 2025) revoked the 2023 Circular and reinstated the October 29, 1992 Circular with appendices A and B.

“The net present value of such investments should be evaluated with the 7 percent real discount rate discussed in Section 8.b. unless the analysis is able to allocate the investment's costs between provision of Federal cost savings and external social benefits.”

What we do: Our business cases compute net present value at the discount rates the Circular prescribes and show federal savings and public benefits separately.

Source: OMB Circular A-94 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal budgetKey date: November 6, 2026

OMB Circular A-11 (2026), Appendix B: budgetary treatment of lease-purchases and leases

Current edition: OMB Circular A-11 (2026), Transmittal Memorandum No. 100 of November 6, 2026, which supersedes all previous versions; the Appendix B scoring rules carry over unchanged.

“budget authority will be scored in the year in which the authority is first made available in the amount of the net present value of the Government's total estimated legal obligations over the life of the contract”

What we do: We compare buying, leasing and as-a-service options in the terms OMB uses for budget scoring, and your budget office settles how each option scores, with its OMB representatives where Appendix B asks for review.

Source: OMB Circular A-11 (2026), Appendix B (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (CFO Act agencies)Key date: December 12, 2017

Modernizing Government Technology Act, IT working capital funds (Pub. L. 115-91, sec. 1077; note to 40 U.S.C. 11301)

In force (statutory note).

“may reprogram and transfer any amounts saved as a direct result of the cost savings activities approved under clause (i)”

What we do: We build the savings register and the business case an IT working capital fund request rests on, and the reprogramming decision stays with your agency and its appropriators.

Source: Modernizing Government Technology Act, IT working capital funds (govinfo.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies)Key date: July 29, 2016

MEGABYTE Act of 2016 (Pub. L. 114-210): software license inventories

In force since July 29, 2016.

“establish a comprehensive inventory, including 80 percent of software license spending and enterprise licenses in the executive agency, by identifying and collecting information about software license agreements using automated discovery and inventory tools”

What we do: The teardown starts from the license inventory the Act already requires and adds usage, price benchmarks and retire-or-consolidate decisions.

Source: MEGABYTE Act of 2016 (Pub. L. 114-210) (govinfo.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies)Key date: January 15, 2025

OMB M-25-05: Phase 2 Implementation of the Evidence Act (Open Government Data Access and Management)

In force (issued January 15, 2025; rescinds and replaces M-13-13). The initial actions, including inventory listings in the DCAT-US 3.0 schema (published May 1, 2026) and the inventory hosted at www.[agency].gov/data.json, were due September 30, 2026; agencies update the inventory within 90 days of a new data asset and at least once a year.

“Each agency is required to develop and maintain a comprehensive data inventory of all data assets maintained by the agency.”

What we do: We build the governed data catalog on Databricks or Microsoft Fabric in your tenant and supply the metadata for its data assets to your agency's comprehensive data inventory, so the same data serves reporting, AI and open-data publication.

Source: OMB M-25-05 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (FedRAMP)Key date: January 1, 2027

FedRAMP Consolidated Rules for 2026 (CR26): timeline

Optional early adoption from July 4, 2026; mandatory adoption January 1, 2027; no new Rev5 certification applications after June 11, 2027; all grace periods end February 1, 2028.

“All stakeholders should begin incrementally adopting or transitioning to the Consolidated Rules for 2026.”

What we do: We record in the blueprint which cloud services each workload uses, with the FedRAMP status and class the FedRAMP Marketplace shows on the day of design, and check them again at every milestone.

Source: FedRAMP Consolidated Rules for 2026 (CR26) (fedramp.gov) (opens in a new tab) · Checked November 12, 2026

U.S. federal (FedRAMP)Key date: February 25, 2026

FedRAMP Certification Classes (Notice 0004 and the agency guidance on classes)

In force under the Consolidated Rules for 2026 (launched June 24, 2026; mandatory January 1, 2027), as announced in Notice 0004 of February 25, 2026: four classes from Class A (minimal assurance) to Class D; Class B includes the current LI-SaaS and Low baselines, Class C the Moderate baseline and Class D the High baseline; classes are not one-for-one replacements for impact levels.

“Agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels.”

What we do: Your agency categorizes the system first, and the blueprint then records, for each workload, the cloud service and the FedRAMP class it holds, ready for your agency's risk decision.

Source: FedRAMP Certification Classes (fedramp.gov) (opens in a new tab) · Checked November 12, 2026

U.S. federal (statute)Key date: December 23, 2022

FedRAMP Authorization Act: presumption of adequacy (44 U.S.C. 3613(e)(1))

In force since December 23, 2022; the Act's sunset (Pub. L. 117-263, section 5921(d)) strikes 44 U.S.C. 3607 through 3616, including this section, on December 23, 2027 unless Congress extends it.

“shall be presumed adequate for use in an agency authorization to operate cloud computing products and services.”

What we do: We build production on cloud services that hold FedRAMP authorization in the cloud your agency uses and record each one's status in the blueprint, so your agency's own authorization starts from the provider's assessed package.

Source: FedRAMP Authorization Act (law.cornell.edu) (opens in a new tab) · Checked November 10, 2026

U.S. federal (statute)Key date: December 18, 2014

FISMA: agency information security responsibilities (44 U.S.C. 3554)

In force.

“providing information security protections commensurate with the risk and magnitude of the harm”

What we do: With every system we build or run for your agency, we hand over the security evidence for our part of it: configuration as code, control implementation notes mapped to the NIST SP 800-53 controls your agency selects, test results and logging settings.

Source: FISMA (law.cornell.edu) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies; national security systems and the Defense and Intelligence Community systems described in 44 U.S.C. 3553(e) excluded)Key date: May 22, 2026

OMB M-26-14: agency logging and network visibility (rescinds M-21-31)

In force since May 22, 2026; covers systems operated by third parties and the IoT/OT within them. CISA published the Logging Reference Architecture on August 20, 2026, which sets the agency deadlines: Agency Logging Plan by November 18, 2026, Level 1 (Basic) maturity by December 18, 2026, Intermediate by February 16, 2027 and Advanced by July 6, 2027.

“including any Internet of Things (IoT) devices or operational technology (OT) that is part of or constitutes such an information system”

What we do: Twin and robotics pilots log from the first sensor, and the logging design follows your agency's logging plan.

Source: OMB M-26-14 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies; national security systems excluded)Key date: June 24, 2026

OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography

In force since June 24, 2026 (implements Executive Order 14412); agency migration plans were due October 22, 2026; prioritized systems move to post-quantum key establishment by December 31, 2030 and to post-quantum signatures by December 31, 2031, with full migration by 2035.

“Systems incapable of supporting PQC or hybrid cryptography must be identified and given priority for replacement or decommissioning.”

What we do: We put the post-quantum migration into the capital plan as a costed, scheduled line, and we price the replace-or-retire decision for each system that cannot make the move, so the run costs freed by retirement help fund the AI roadmap.

Source: OMB M-26-15 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies)Key date: January 23, 2026

OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security (rescinds M-22-18 and M-23-16)

In force since January 23, 2026.

“Agencies shall continue to maintain a complete inventory of software and hardware”

What we do: The software and hardware inventory your agency keeps is where the license and application teardown starts.

Source: OMB M-26-05 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (executive agencies)Key date: January 26, 2022

OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

Issued January 26, 2022; its FY2024 objectives have passed; no rescission found.

“For agency staff, contractors, and partners, phishing-resistant MFA is required.”

What we do: We design identity, network and data-boundary controls on zero trust principles: phishing-resistant MFA, conditional access and least privilege.

Source: OMB M-22-09 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. federal (NIST)Key date: August 27, 2025

NIST SP 800-53 Rev. 5 (Release 5.2.0)

Current; minor release 5.2.0 of August 27, 2025.

“On August 27, 2025, NIST issued a minor release of SP 800-53 (Release 5.2.0)”

What we do: We map the controls of every system we build to the NIST SP 800-53 controls your agency selects.

Source: NIST SP 800-53 Rev. 5 (Release 5.2.0) (csrc.nist.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (defense contracts and the defense industrial base)Key date: July 13, 2026

CMMC (DFARS 252.204-7021): Phase II suspended by the Department of War (Department of Defense)

DFARS rule effective November 10, 2025 (Phase I self-assessments in force). Phase II, scheduled for November 10, 2026, was suspended on July 13, 2026 and has not started; no new Phase II date as of November 10, 2026, and the CMMC rule texts (32 CFR part 170, DFARS 252.204-7021) are unchanged.

“The Department of War today announces the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally scheduled to come into effect on November 10, 2026. All Phase I self-assessment requirements remain firmly in place.”

What we do: For defense contractors, we design controlled unclassified information (CUI) enclaves in GCC High or Azure Government inside the contractor's tenant and assemble the evidence for its own NIST SP 800-171 Rev. 2 self-assessment.

Source: CMMC (DFARS 252.204-7021) (war.gov) (opens in a new tab) · Checked November 12, 2026

U.S. federal and state (criminal justice information)Key date: June 25, 2026

FBI CJIS Security Policy (v6.1) and Microsoft CJIS agreements

CJIS Security Policy v6.1 released June 25, 2026; Texas audits through March 31, 2027 use v5.9.5.

“All Texas CJIS audits through March 31, 2027 are conducted against FBI CJIS Security Policy version 5.9.5.”

What we do: Criminal-justice data stays inside the Microsoft government services your state's CJIS agreement covers, and we design to the policy version your auditor uses.

Source: FBI CJIS Security Policy (dps.texas.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal and state (federal tax information)Key date: November 2021

IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies

Rev. 11-2021 current (IRS Safeguards page, last reviewed June 28, 2026). An early-release draft, Rev. 12-2026, takes effect 6 months after its publication date and adds a section on artificial intelligence.

“Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies … (Rev. 11-2021)”

What we do: Federal tax information stays inside the authorized government cloud boundary your safeguards review relies on, and we design the data platform to the current Publication 1075.

Source: IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (irs.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (HHS)Key date: January 6, 2025

HIPAA Security Rule: proposed rule to strengthen the cybersecurity of ePHI (RIN 0945-AA22)

Proposed January 6, 2025; Unified Agenda lists it under Long-Term Actions with final action 07/2027; the current Security Rule applies.

“HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information”

What we do: Where your agency is a HIPAA covered entity, such as a public hospital or a state Medicaid program, we keep protected health information in your tenant, work under a business associate agreement signed before any access, and map the design to the HIPAA Security Rule in force.

Source: HIPAA Security Rule (reginfo.gov) (opens in a new tab) · Checked November 10, 2026

Vendor statement (Microsoft Learn)Key date: September 21, 2026

Azure Government: authorizations and regions

US Gov Arizona, US Gov Texas and US Gov Virginia: FedRAMP High P-ATO and DoD IL2, IL4 and IL5 PAs (IL5 with workload isolation); Azure Government Secret: DoD IL6. FedRAMP Marketplace (November 10, 2026): FedRAMP Certified, Class D (High), package F1603087869.

“Azure Government maintains the following authorizations that pertain to Azure Government regions US Gov Arizona, US Gov Texas, and US Gov Virginia (US Gov regions)”

What we do: We design and deliver inside your agency's own Azure Government tenant, choosing each service from Microsoft's audit scope for the impact level your agency sets.

Source: Azure Government (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

Vendor statement (Microsoft Learn audit scope)Key date: September 21, 2026

Azure OpenAI in Azure Government

In audit scope and authorized: FedRAMP High, DoD IL2, IL4, IL5 (workload isolation) in Azure Government; DoD IL6 in Azure Government Secret.

“✅ = service is included in audit scope and has been authorized”

What we do: We build agents and copilots on Azure OpenAI in Microsoft Foundry Models in your agency's Azure Government tenant, at the impact level your authorization covers.

Source: Azure OpenAI in Azure Government (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

Vendor statements (Microsoft Learn; Databricks)Key date: September 21, 2026

Azure Databricks in Azure Government; Databricks on AWS GovCloud

Azure Databricks in Azure Government (US Gov Arizona and US Gov Virginia): FedRAMP High, DoD IL2, IL4 and IL5 (workload isolation), within Microsoft's Azure Government package (FedRAMP Marketplace F1603087869). Databricks on AWS GovCloud: FedRAMP Certified, Class D (High), since February 26, 2025 (FedRAMP Marketplace FR2324740262); a separate GovCloud DoD environment for DoD agencies with IL5 requirements.

“✅ = service is included in audit scope and has been authorized”

What we do: We put the lakehouse where your data's authorization sits: Azure Databricks in Azure Government, or Databricks on AWS GovCloud where your agency runs AWS.

Source: Azure Databricks in Azure Government; Databricks on AWS GovCloud (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

Vendor statement (Microsoft Learn; Microsoft US Government blog)Key date: October 1, 2026

Microsoft Fabric in GCC High

General availability in GCC High from October 1, 2026 (US Gov Virginia and US Gov Texas, listed workloads only); FedRAMP High authorization for GCC High under government assessment (Azure Government roadmap, November 5, 2026: FedRAMP High 'Awaiting Review', DoD IL4 'Planned', IL5 WI and IL6 'Forecasted'); Fabric is not listed in the Azure Government audit-scope table.

“Microsoft submitted all required artifacts for Fabric GCC High FedRAMP High authorization and is currently undergoing assessment by U.S. government reviewers. Fabric is already FedRAMP High authorized in commercial cloud environments.”

What we do: We design Microsoft Fabric workloads in GCC High from the items Microsoft lists there, and place a workload on Power BI or Azure Databricks in Azure Government when it needs a FedRAMP High authorized service today.

Source: Microsoft Fabric in GCC High (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

Vendor statement (Microsoft Learn)Key date: November 9, 2026

Microsoft 365 Copilot in U.S. government clouds

Available in GCC, GCC High and DoD; features differ per environment.

“Microsoft Copilot is available in GCC, GCC High, and DoD, and operates entirely within the customer's U.S. government cloud tenant.”

What we do: We plan Copilot adoption per environment, matched to the features Microsoft lists for your agency's cloud.

Source: Microsoft 365 Copilot in U.S. government clouds (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

Vendor statement (Microsoft Learn)Key date: December 9, 2025

Dynamics 365 US Government and Power Platform

FedRAMP JAB High P-ATO (March 2018), authorized within the Azure Government FedRAMP ATO; GCC High designed to align with DISA SRG IL4 (since April 2019); DoD designed to align with IL5 (since April 2021), with Finance and Supply Chain Management pending IL5 approval; Power Apps holds DISA provisional authorizations at IL4 (GCC High) and IL5 (DoD).

“In March 2018, the service impact level was granted a FedRAMP JAB High P-ATO.”

What we do: We deliver Dynamics 365 and the Power Platform in GCC, GCC High or DoD, matched to the data your agency holds, with the ERP kept as the master record.

Source: Dynamics 365 US Government and Power Platform (learn.microsoft.com) (opens in a new tab) · Checked November 12, 2026

GovRAMP Authorized Product List; vendor statement (Microsoft Learn)Key date: April 24, 2022

Microsoft services on the GovRAMP Authorized Product List

GovRAMP Authorized Product List: Microsoft Azure Government and Microsoft Azure Commercial at High, Authorized, April 24, 2022; M365 Government Community Cloud & Supporting Services at High, Authorized, July 21, 2024; Microsoft 365 Commercial at Moderate, Core, November 20, 2025.

“To be covered by the GCC GovRAMP Authorization, customers must purchase a GCC SKU.”

What we do: We confirm each service's status on the GovRAMP and TX-RAMP lists for your project before design starts.

Source: Microsoft services on the GovRAMP Authorized Product List (govramp.org) (opens in a new tab) · Checked November 12, 2026

U.S. (participating state and local governments)Key date: November 1, 2026

GovRAMP security program (verification statuses)

Current program built on NIST SP 800-53 Rev. 5.

“Built on NIST SP 800-53 Rev. 5”

What we do: We list each proposed cloud service's GovRAMP status for your project and design on the services your government accepts.

Source: GovRAMP security program (govramp.org) (opens in a new tab) · Checked November 10, 2026

ColoradoKey date: January 1, 2027

Colorado SB 26-189: Automated Decision-Making Technology (repeals and re-enacts SB 24-205)

Signed May 14, 2026 (Session Law ch. 131); takes effect January 1, 2027 for developers and deployers and applies to consequential decisions made on or after that date. Attorney General rules are due by January 1, 2027 (hearing held October 26, 2026). A federal court order of April 27, 2026 in xAI v. Weiser (D. Colo.) bars enforcement for violations occurring up to 14 days after a ruling on a preliminary-injunction motion due within 28 days of the final rules. Each government body's counsel determines whether it is a deployer.

“essential government services and public benefits”

What we do: Where a system helps decide access to public benefits, we design the notice, the plain-language explanation and the human review path in from the start.

Source: Colorado SB 26-189 (leg.colorado.gov) (opens in a new tab) · Checked November 12, 2026

California (state entities)Key date: March 2024

California Technology Letter 24-01: GenAI risk assessment and vendor disclosure in state procurement

Active (CDT Technology Letters index, checked November 10, 2026); issued March 21, 2024: GenAI disclosure language in solicitations from March 21, 2024 and the SIMM 5305-F risk assessment from July 1, 2024. Technology Letter 25-01 (February 20, 2025) added the GenAI policies in SAM 4986.1–4986.13; SAM 4986.9 GenAI Procurement (revised November 2025) has the state entity complete the SIMM 5305-F prior to award and submit it to CDT for all risk levels, and puts a GenAI disclosure clause in IT and telecommunications solicitations and contracts.

“State entities acquiring GenAI tools must complete a SIMM 5305-F Generative Artificial Intelligence Risk Assessment.”

What we do: We disclose every generative AI component we propose, so your team can complete the state's GenAI risk assessment before award.

Source: California Technology Letter 24-01 (cdt.ca.gov) (opens in a new tab) · Checked November 10, 2026

New York (state contracts that incorporate it; issued by NYS ITS)Key date: April 2025

New York Appendix C-AI: Standard Terms for AI Purchases for NYS Office of Information Technology Services

Current ITS standard clauses (April 2025), listed on the ITS vendor resources page on November 10, 2026; they bind the contracts that incorporate them.

“Contractor or Vendor agrees to provide ITS with written notice at least 90 days prior to the implementation or use of any artificial intelligence (AI) technology”

What we do: For contracts that carry New York's Appendix C-AI, we plan the 90-day written AI notice and the State's written approval into the schedule, and keep prompts, uploaded content and outputs as the State's property.

Source: New York Appendix C-AI (ogs.ny.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. (community water systems serving more than 3,300 people)Key date: October 23, 2018

America's Water Infrastructure Act §2013: risk and resilience assessments and emergency response plans

In force. This cycle's risk and resilience assessment certifications were due March 31, 2025, December 31, 2025 and June 30, 2026, by system size; emergency response plans follow six months after each assessment certification, the last on EPA's schedule by December 31, 2026; reviews repeat at least once every five years.

“electronic, computer, or other automated systems (including the security of such systems)”

What we do: Utility twin, operational-data and capital-planning work is scoped so its findings can feed the risk and resilience assessment and the emergency response plan a community water system reviews and certifies to EPA at least once every five years.

Source: America's Water Infrastructure Act §2013 (epa.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (and the states it addresses)Key date: December 11, 2025

Executive Order 14365, Sec. 8(b): the proposed federal AI framework is not to preempt state laws on state procurement and use of AI

In force (signed December 11, 2025). The Sec. 8(a) legislative recommendation was published in March 2026 and proposes that a national standard not preempt requirements governing a state's own use of AI, including procurement; it is a proposal to Congress. The Sec. 3 AI Litigation Task Force (January 9, 2026) was merged into the DOJ Super Intelligence Task Force by an Attorney General memorandum of October 13, 2026, announced November 5, 2026.

“The legislative recommendation called for in subsection (a) of this section shall not propose preempting otherwise lawful State AI laws relating to: … (iii) State government procurement and use of AI”

What we do: We design for each state's own rules on how its agencies buy and use AI, which the White House's March 2026 legislative recommendations propose not to preempt.

Source: Executive Order 14365, Sec. 8(b) (federalregister.gov) (opens in a new tab) · Checked November 12, 2026

U.S. (state and local government accounting)Key date: June 15, 2022

GASB Statement No. 96: Subscription-Based Information Technology Arrangements

Effective for fiscal years beginning after June 15, 2022.

“A SBITA is defined as a contract that conveys control of the right to use another party's (a SBITA vendor's) information technology (IT) software, alone or in combination with tangible capital assets (the underlying IT assets), as specified in the contract for a period of time in an exchange or exchange-like transaction.”

What we do: For state and local governments, the business case models how subscription payments and implementation costs may be treated under GASB Statement No. 96, and your auditors determine the classification.

Accounting treatment is determined by your auditors; we provide evidence and documentation.

Source: GASB Statement No. 96 (gasb.org) (opens in a new tab) · Checked November 10, 2026

U.S. (educational agencies and institutions)Key date: January 8, 2009

FERPA: contractors as school officials (34 CFR 99.31(a)(1)(i)(B))

In force since January 8, 2009 (final rule of December 9, 2008, 73 FR 74806); §99.31 last amended December 2, 2011.

“Is under the direct control of the agency or institution with respect to the use and maintenance of education records”

What we do: Where education records are in scope, the contract places our work under your direct control and FERPA's redisclosure limits.

Source: FERPA (ecfr.gov) (opens in a new tab) · Checked November 10, 2026

U.S. (states without an approved State Plan, including Texas)Key date: December 29, 1970

OSHA coverage of state and local government workers (State Plans)

In force: the OSH Act's definition of employer leaves out states and their political subdivisions (29 U.S.C. 652(5)); OSHA lists 22 State Plans covering private sector and state and local government workers and seven covering state and local government workers only, and Texas is under federal OSHA jurisdiction for most private sector workers.

“State and local government workers are not covered by federal OSHA.”

What we do: In Texas we build the safety case for a municipal robot pilot on the robot-safety standards and your own safety program, include the federal OSHA duties of the contractors on site, and follow the State Plan in states with public-sector plans.

Source: OSHA coverage of state and local government workers (osha.gov) (opens in a new tab) · Checked November 10, 2026