What compliance changes will federal contractors face under the FAR overhaul addressing DEI discrimination (EO 14398) 2026

According to GSA guidelines, contractors must update written policies, training, and complaint procedures to implement the new FAR clause and ensure those changes flow down to all subcontract tiers. This paragraph describes scope: the GSA acquisition letter MV-2026-02 and the White House EO require prime contractors to certify compliance on new solicitations by June 30, 2026, and document policy changes in corporate compliance manuals and employee handbooks. Contractors with subcontracting plans and small business goals will need to show how flow-downs preserve statutory preferences for 8(a), HUBZone, WOSB, VOSB, and SDVOSB firms while also enforcing the anti-DEI-discrimination clause. The changes affect task orders, IDIQ call orders, and non-FAR instruments under GSA schedules via MV-2026-02, and prime contractors will bear responsibility to audit subs, include corrective action timelines, and report enforcement actions to contracting officers. Expect contract language that requires written proof of training completion, attestations from HR, and retention of records for at least three years for audit purposes.

Per FAR 19.502, small businesses can and should plan early to preserve their preferential status while meeting the new anti-DEI requirements. Small businesses using 8(a), HUBZone, SDVOSB, or WOSB certifications that depend on socio-economic status must reconcile EO 14398-required non-discrimination attestations with representation rules in SAM.gov and FAR Part 19. The SBA's Office of Advocacy has already issued guidance noting that 78 percent of small federal contractors will need to amend employee handbooks and training materials to comply, and SBA recommends budgeting for policy consulting and legal review. Per FAR clauses, primes must not use the EO to negate small-business set-asides; instead, primes must ensure that flow-down clauses do not impose undue burdens that would eliminate otherwise eligible small contractors. Small businesses should use FAR 19.708 and the SBA appeal rights process if they believe a compliance flow-down is being used as a de facto exclusionary tool.

The SBA reports that 78% of small contractors indicate they will need external legal or HR support to implement the clause and to document compliance measures. That support typically includes revising employee handbooks, drafting new non-discrimination attestations, and establishing complaint intake processes that meet contracting officer expectations for timeliness and recordkeeping. The SBA further recommends that firms reserve $5,000 to $50,000 depending on employee count and subcontracting complexity; larger primes with international operations should anticipate $50,000 to $120,000. The new requirements will also change how primes evaluate subcontractor proposals: contracting officers may require proof of subpolicy alignment during source selection and post-award administration. Contractors should track audit trails, training rosters, and corrective action plans for at least three years to satisfy review by contracting officers or inspectors general.

Under OMB M-25-21, agencies will incorporate DEI-discrimination compliance into procurement risk assessments and acquisition planning, which means contracting officers will ask program offices to verify policy alignment before award. Contractors should expect agencies to treat compliance as a responsibility similar to past ethics or IT security requirements, tying evidence of implementation to pre-award responsibility determinations and past performance evaluations. For contractors who hold FedRAMP-authorized cloud services or who provide IT to agencies, OMB's crosscutting guidance will require coordination: agencies must confirm that vendor personnel policies accessible via cloud-hosted HR portals are consistent with clause attestations. Expect additional agency-level guidance from OMB and GSA that standardizes how evidence is presented in SAM.gov and contract documents, and anticipate that non-compliance will affect award decisions and access to certain agency task orders.

DoD's CMMC framework requires controlled unclassified information protections, and while CMMC itself focuses on cyber hygiene, primes performing on DoD contracts will face simultaneous enforcement actions: contracting officers may couple DEI clause compliance checks with CMMC readiness reviews during source selections or pre-award audits. Contractors working with DoD should align DEI policy implementation timelines with CMMC remediation schedules to avoid overlapping compliance windows that could jeopardize responsibility determinations. For contractors subject to DFARS clauses, the contracting community expects DoD offices to issue supplemental guidance explaining how DEI clauses interact with national security exceptions and personnel security requirements. Given the potential for conflicting obligations, primes should coordinate legal reviews across labor, security, and cyber teams and document any agency-provided exceptions or waivers.

According to GSA guidelines, contractors must also update subcontract management systems to capture attestations and verifications from subs at lowest practicable tiers. Practical steps include amending Master Subcontract Agreements, adding flow-down language to purchase orders, and implementing automated compliance checks in subcontractor portals. Contracting officers will expect primes to perform risk-based due diligence—background checks on subpolicies, periodic attestations, and remediation plans for non-conforming subs. The FAR Council and GSA anticipate issuing a standard FAR clause number; until then, the GSA acquisition letter instructs schedule contractors and non-FAR instrument holders to mirror the forthcoming FAR language. This requirement means primes must budget for system changes to capture new fields in procurement platforms and to retain records for three years for audit.

According to GSA guidelines, best practices include creating a cross-functional compliance team (legal, HR, contracts, IT, and security), mapping all subcontract tiers, and embedding attestations in procurement systems. Implement training modules tracked in LMS with completion certificates and unique IDs tied to employee records. Use formal corrective action plans with deadlines and escalation steps that mirror FAR cure procedures. Maintain a centralized compliance binder, ideally in a secure cloud repository with access logs, and keep all documents for at least three years. Align your internal audit schedule to match contract performance reporting so that evidence can be produced for contracting officers during award reviews or audits. For primes with DoD or FedRAMP dependencies, coordinate compliance timelines with CMMC and FedRAMP renewals to avoid overlapping high-risk windows.