The FAR overhaul: what changes for agencies buying software and AI

Two versions of the FAR are running at once

A contracting officer buying software in November 2026 is working with two versions of the Federal Acquisition Regulation. The codified FAR still sits in Title 48 of the Code of Federal Regulations. The rewritten text reaches the desk through class deviations that agencies issued part by part, and that same rewrite is now moving through formal notice and comment. For any given buy, the first question is which layer governs at your agency, for that FAR part, on your solicitation date.

Executive Order 14275, signed April 15, 2025, directed that the FAR keep only what statute requires or what sound procurement needs. OMB Memorandum M-25-26, dated May 2, 2025, launched the Revolutionary FAR Overhaul and set two phases: model deviation text for each part first, then rulemaking under the normal notice and comment process. Most how-to material moved out of the regulation into non-regulatory resources, chiefly the FAR Companion, now at Version 3.0, and the Category Management Buying Guide. Those guides inform a contracting officer's judgment and carry no regulatory force.

Everything below marked as proposed could change before it becomes final. Agency deviations can also differ from the model text, so treat the model text as a reference and your own agency's deviation as the instruction.

The dates that matter

Date	Action	Why a software or AI buyer cares
April 3, 2025	OMB M-25-22 on AI acquisition	Sets data, lock-in and testing expectations for AI contracts
April 15, 2025	Executive Orders 14275 and 14271	Start the overhaul and reinforce commercial buying
September 30, 2025	M-25-22 begins to apply	Covers solicitations issued on or after this date and options exercised after it
October 1, 2025	Inflation adjustment takes effect (90 FR 41872)	Simplified acquisition threshold rises to $350,000, micro-purchase threshold to $15,000
February 1, 2026	First Department of War class deviations take effect	Defense buyers move to rewritten text with DFARS changes alongside
April 30, 2026	Executive Order 14402	Makes fixed price the default contract type
June 23, 2026	First four proposed rules (91 FR 37550, 37636, 37676, 37698)	Parts 1 to 7, 10, 18, 24, 26, 29, 33, 37, 39, 40, 41, 49 and 53
July 15, 2026	Part 16 justifications begin under the updated deviation	New solicitations need approval before release when covered
September 18, 2026	Second four proposed rules (91 FR 59406, 59476, 59534, 59584)	Parts 8, 9, 12 to 17, 27, 28, 35, 36, 38, 44, 47 and 51
October 19, 2026	GSA AI clause takes effect as a class deviation	Reaches large language model buys through GSA contracts
July 15, 2027	Back-stop date for Part 16 justifications on certain existing work	Applies to contracts with 18 months or more remaining as of July 15, 2026

Commercial first now starts at market research

FAR Part 10 would disappear as a standalone part. The June proposed rule moves market research into a new subpart 7.2, on the reasoning that you cannot plan a buy without first understanding the market. Part 7 would let agencies decide when a written or oral acquisition plan is needed.

The flexibility comes with a harder edge. The FAR would no longer list the techniques you must use, but proposed 7.201(f) ranks the outcomes. Using the results of market research, the agency works down this order:

1. A commercial product or service on an existing governmentwide contract can meet the need.
2. The requirement could be modified so the agency can use an existing governmentwide contract.
3. A commercial product or service is available from another source.
4. A commercial product or service could be modified to meet the need.
5. The requirement can be met only by a nondevelopmental item.

Vendors may be asked for no more than the minimum information needed to make those determinations. Research done within 18 months before award stays acceptable if it is still current, accurate and relevant. The FAR 15.201 language on exchanges with industry moves to 7.105, which makes vendor engagement part of planning.

Part 8 adds a further step. Under the September proposed rule, when a commercial product or service is on a governmentwide contract, the agency must use it if OFPP has designated that vehicle "required use," unless the Senior Procurement Executive grants an exception. It then considers "best in class" vehicles, then other governmentwide vehicles, before creating a new contract. OFPP will set the criteria and name the vehicles.

OMB is already acting on the policy. M-26-12, issued April 17, 2026, reports that more than two-thirds of FY 2024 federal contract spending in FPDS was non-commercial, including more than $130 billion for common services such as professional support and IT and telecom services. It restated the requirement from Executive Order 14271 for Senior Procurement Executive review and approval when an agency seeks to solicit a non-commercial product or service. A custom software build therefore needs a written answer to why a modified commercial product will not do. The test in the definition of commercial services is whether the service is "of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed or specific outcomes to be achieved and under standard commercial terms and conditions."

Simplified procedures reach further for commercial buys

The simplified acquisition threshold is $350,000 and the micro-purchase threshold is $15,000, both effective October 1, 2025. The larger number for software buyers is $9 million. That is the ceiling for simplified procedures on commercial products and services, up from $7.5 million in the same adjustment, and $15 million for certain emergency and disaster uses.

The proposed rule folds this into a rebuilt Part 12, so commercial buyers would stop reconciling Parts 5, 12 and 13. Part 13 would then cover only noncommercial buys at or below the threshold. At these values, proposed 12.201-1 calls for a request for quotations followed by a purchase order. Proposed 12.203 says evaluation factors for most commercial buys need not go beyond technical, price and past performance, that predetermined technical subfactors are not required, and that for some commercial products, such as emerging technology, past performance should include commercial market experience.

Source selection moves from discussions to negotiation

The proposed Part 15 changes matter most when a product is hard to judge from a written volume:

• Negotiation: offerors in the competitive range must still have deficiencies and significant weaknesses addressed, but contracting officers could hold more than one negotiation with one offeror without doing so with all of them. The preamble names intellectual property rights, licensing agreements and pricing as terms to bargain.
• Deficiency: redefined as a part of a proposal that does not conform to a material term of the RFP, where a material term affects price, quantity, quality or delivery, or is a prerequisite the RFP requires at submission.
• Clarifications: allowed up to award at the contracting officer's discretion, with no proposal revisions and no cure of a material omission.
• Competitive range: proposals "best suited for further negotiation," with no requirement to include all of the most highly rated.
• Highest technically rated with a fair and reasonable price (proposed 15.102-3): no tradeoffs. Evaluate the top technical proposal's price, and move to the next if the price is not fair and reasonable.
• Phased evaluation (proposed 15.102-4): a formal place for down-selects, with offerors addressing some factors first and the rest in later submissions.

Pair those with M-25-22, which says agencies must, to the greatest extent practicable, test proposed AI solutions when evaluating proposals, and should seek demonstrations in scenarios close to the real operating environment. Proposed 15.104-1 lets oral presentations substitute for portions of a written proposal and lists sample tasks among suitable content.

A workable evaluation on demonstrated capability looks like this. Phase one is a short written submission on approach, relevant experience and data handling, used to down-select. Phase two gives remaining offerors a sample task on data the agency defined, in a setting close to production, with the scoring rubric published in the solicitation. Score accuracy on your task, behavior on hard cases, security posture and the cost to run the system. Tie the rubric to the stated factors and keep the record, because broader discretion still has to be documented and applied fairly.

Fixed price is now the default contract type

Executive Order 14402, signed April 30, 2026 (91 FR 24325), makes fixed-price contracts with performance-based considerations the default and preferred method of procurement. It names cost-reimbursement, time-and-material and labor-hour contracts as non-fixed-price types that must be justified. The FAR Council updated the Part 16 model text on July 1, 2026, and the September proposed rule adds a new 16.104.

Agency	Justification threshold, covered contracts and orders
Department of War	$100 million
NASA	$35 million
Department of Homeland Security	$25 million
All other agencies	$10 million

Under proposed 16.104, covered work includes anything other than fixed price, firm-fixed-price level-of-effort term contracts, and hybrids whose covered portion meets the threshold. The agency head approves, and may delegate only to the chief acquisition officer or another non-career Senior Executive Service official. Research and development, emergencies and pre-production major system development are excepted. A multiple-award contract itself is excepted, but its orders are covered. Under the Part 16 implementation guidance, justifications are required for solicitations issued on or after July 15, 2026, and should be issued by July 15, 2027 for awards from earlier solicitations and existing work with at least 18 months remaining, options included, as of July 15, 2026.

A large task order for agile development on labor hours can now reach an agency head, so plan for it. Three structures tend to fit. Price a fixed amount per sprint or release against stated acceptance criteria. Use the consumption-based language for metered work: proposed Part 16, following section 1825 of the FY 2026 NDAA, treats fixed-price units billed on actual usage as firm-fixed-price, with cloud capacity as an example. Keep true discovery work small and separate. The order also counts contracts that tie profit to performance-based metrics, which supports connecting incentives to your quality surveillance plan.

Small business programs and the clause set

Part 19 is outside the eight published rules, so the model text and your agency's deviation are the working source. The model text, released September 26, 2025 and updated February 20, 2026, keeps the Rule of Two for contracts above the micro-purchase threshold. For orders under multiple-award contracts, it states that the rule does not apply and that set-asides are at the contracting officer's discretion. FAR Case 2026-004 will carry Part 19 into rulemaking with Parts 22, 23 and 25.

The proposed clause changes that matter most to software buyers:

• Omnibus provisions removed: 52.212-3 and 52.212-5 would go, with the Government deciding which clauses apply through updated prescriptions.
• Adding clauses to commercial buys: a clause not prescribed for commercial products or services would need an individual or class deviation under Part 1.
• Commercial software licenses: proposed 12.107 keeps the rule that software is acquired under licenses customarily provided to the public where they satisfy the Government's needs, and the Government has only the rights in that license.
• Data rights: Part 27 would replace subpart 27.4 with DFARS-derived coverage split between commercial and other-than-commercial data and software.
• Information and communication technology: Part 39 would be retitled and broadened, and 39.105 and clause 52.239-1 on privacy or security safeguards would be removed.
• Security prohibitions: Part 40 would create a single "do not buy" list and harmonize over a dozen provisions and clauses.

Outside the FAR, M-26-05 (January 23, 2026) rescinded M-22-18 and M-23-16, so the secure software attestation Common Form is now an option within each agency's risk-based approach. M-26-10 (March 31, 2026) restates that CFO Act agency contracts for IT need CIO review and approval, and directs agencies to include provisions requiring IT vendors to disclose utilization and pricing information in solicitations and contracts issued after that date.

Where OMB's AI rules fit

The overhaul shortens the FAR, while OMB's AI memoranda set out what an AI contract must say. M-25-22 remains the governing acquisition memo. It replaced M-24-18, it does not apply to AI acquired as a component of a National Security System, and OMB's published memoranda list through M-26-19 (September 10, 2026) shows no successor. M-26-04, dated December 11, 2025, adds to it for large language models: solicitations and orders must address its Unbiased AI Principles, existing contracts should be modified to the extent practicable before an option extends them, and agency policies were due by March 11, 2026.

M-25-22 subject	What the contract should do
Government data	Permanently prohibit using non-public agency inputs and outputs to further train publicly or commercially available AI, absent explicit agency consent
Data and IP rights	Delineate ownership and IP rights, and scope licenses to the intended use
Vendor lock-in	Address knowledge transfer, data and model portability, rights to code and models produced in performance, and transparency in licensing and pricing
Testing	Let the agency regularly evaluate performance, risk and effectiveness (for example, quarterly or biannually), using agency-defined data the vendor cannot access
Performance monitoring	Encourage vendor monitoring, performance standards before a new version deploys, and rollback when a version falls short
Change notice	Consider requiring notice before new AI features or enhancements are integrated

If proposed Part 12 is finalized, a commercial AI buy would run on the vendor's customary license, and adding a non-prescribed clause would take a deviation. M-25-22's terms still have to reach the contract. Decide now how your agency will do that: through negotiated license terms, through requirements in the work statement, or through a class deviation.

GSA has taken its own route. GSAR 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems," took effect as a class deviation on October 19, 2026, and GSA plans to carry it into Multiple Award Schedule Refresh 34 this month. It applies where large language model functionality is a material feature and government data is submitted to or produced by the model. It takes precedence over conflicting vendor terms of service and click-wrap agreements, and it drops out when use is limited to the contractor's internal systems.

Writing the work statement for software and AI

M-25-22 strongly encourages performance-based techniques, including statements of objectives, performance work statements, quality assurance surveillance plans and incentives. The proposed Part 37 consolidates performance-based policy into subpart 37.1 and calls it a core statutory requirement. With fixed price as the default, the work statement carries most of the risk control.

Section	What to write
Outcome	The mission result and the user's task, in terms a program officer can verify, with the method left to the vendor
Operating conditions	Network, identity, data classification, volume and latency the system must handle
Data	What the agency provides, its known quality problems, who holds it, and how a held-back evaluation set is managed
Acceptance	Measurable thresholds on an agency-defined test set, the method of measurement, and what happens on a miss
Change control	Notice before model or version changes, a re-test before release, and a rollback path
Monitoring	Measures, frequency and owner in the quality surveillance plan, tied to any incentive
Exit	Formats for data and model portability, documentation, knowledge transfer and the transition period

Before release, have someone who did not write it try to price it. If they cannot tell what done looks like, a fixed price will either carry a large risk premium or end in a modification. M-25-22 also calls for a cross-functional team, and for early involvement of the Senior Agency Official for Privacy on AI buys that touch personally identifiable information.

What to do in the next 90 days

• Pull your agency's class deviations for Parts 7, 8, 10, 12, 13, 15, 16, 19, 27, 39, 40 and 52 from the acquisition.gov deviation guide, and check the effective date and any supplement. Defense buyers should read them with the DFARS changes.
• Write a one-page crosswalk of the codified text, your deviation and the proposed rule for those parts.
• List every planned software, data and AI action. Mark each commercial or non-commercial, with the market research behind the call and any Senior Procurement Executive review it needs.
• Flag non-fixed-price work and level-of-effort term contracts near your Part 16 threshold, including orders under multiple-award contracts. Build approval time into the schedule, and list existing work that needs a justification by July 15, 2027.
• Check for OFPP "required use" and "best in class" designations before planning a new vehicle.
• Confirm your M-25-22 and M-26-04 procedures, and have contract language ready for data use, portability, testing and change notice. Get counsel's view on how it enters a commercial buy.
• Build one reusable evaluation package: phased structure, sample task, scoring rubric, and a test environment and held-back data if practicable.
• Bring your CIO in early on IT contracts, and add the utilization and pricing disclosure from M-26-10.
• If you buy through GSA, review GSAR 552.239-7001 and watch for Refresh 34.
• Assign one person to track the four remaining proposed rules and the final rules, and to update the crosswalk.

Frequently asked questions