The FAR Overhaul: What Changed for Technology Buyers

If you have opened a federal solicitation in the last year and found a clause number you did not recognize, you are not behind. The Federal Acquisition Regulation is being rewritten from end to end, and the rewrite is arriving through a mechanism most people outside a contracting shop have never had to think about: agency-by-agency deviations. The result is that two solicitations for nearly identical software, issued the same week by two different agencies, can cite two different clause numbers for the same legal requirement.

This article explains what the overhaul is trying to do, how deviations work while it proceeds, why part and clause numbers are shifting, and how to read a solicitation that mixes old numbering with new. It is written for people who buy or sell technology to the government: program managers writing requirements, small-business owners responding to them, and engineers who have to turn a clause into a control.

One note before we start. This is general information, not legal advice on your contract. The clause that binds you is the one printed in your contract, not the one on a website. When the two disagree, the contract wins, and your contracting officer is the person who resolves it.

What the overhaul actually is

Executive Order 14275, Restoring Common Sense to Federal Procurement, was signed on April 15, 2025. Its instruction to the FAR Council was blunt: go through the FAR and keep only what statute requires or what is genuinely essential to sound procurement. Everything else comes out. The initiative took the name the Revolutionary FAR Overhaul, usually shortened to RFO, and it has its own section of acquisition.gov.

The FAR Council did not publish one enormous rewrite. It went part by part. For each FAR part it published model deviation text, which is a rewritten version of that part in plainer language with the non-statutory material stripped out. Alongside each part it published a Practitioner Album containing a summary of changes, a line-out document showing exactly what was deleted, and buying guides for the workforce.

That last piece matters more than it sounds. A lot of what was removed from the FAR was not repealed; it was reclassified. Procedural advice, sample language, and workflow guidance moved out of the regulation and into non-binding buying guides. If you are used to pointing at a FAR section to argue that an agency must do something a certain way, check whether that sentence still lives in the regulation or has become guidance. Guidance does not create the same obligation, and it does not give you the same protest footing.

Why deviations came before rulemaking

Changing the FAR normally means notice-and-comment rulemaking: a proposed rule in the Federal Register, a comment period, a final rule, an effective date. That process is slow by design, and an end-to-end rewrite through ordinary rulemaking would have taken years before anyone saw a benefit.

So the administration used a faster lever. OMB Memorandum M-25-26, Overhauling the Federal Acquisition Regulation, issued May 2, 2025, told agencies to put the FAR Council's model text into effect through individual or class deviations, generally within 30 days of the Council releasing the text for a part. Agencies were told to send copies of their deviations to the FAR Secretariat for public posting. The memo also allowed agencies to combine several parts into one deviation, and some did exactly that rather than issuing dozens of separate memos.

A deviation is an existing, ordinary tool. FAR subpart 1.4 has always let an agency depart from FAR text when it documents the basis for doing so; a class deviation applies to a class of contracts rather than one. What is unusual here is the scale. Instead of a handful of narrow departures, agencies are running most of their acquisitions under deviation text for most of the FAR.

The first model deviation text went up on May 2, 2025, and the parts rolled out through the rest of that year. By August 2025 more than thirty agencies had issued their own deviations. The FAR Council closed out its final governmentwide batch, Parts 2 and 52, in October 2025.

Because each agency issues its own instrument, the numbering is agency-specific. GSA numbers its deviations by FAR part, so its Part 39 deviation is RFO-2025-39 and its Part 40 deviation is RFO-2025-40. The Department of Energy used its own procurement flash series, such as PF 2025-43 for FAR Part 39. The Department of Defense ran a parallel DFARS effort through its own class deviation numbering, in the 2026-O00xx series, and issued its final batch of DFARS parts through DPCAP in March 2026.

Where the rulemaking stands

Deviations are temporary by nature. The permanent change happens in the Code of Federal Regulations, and that phase started on June 23, 2026, when the FAR Council published four proposed rules in the Federal Register covering twenty FAR parts:

• FAR Case 2026-001 covering Parts 1, 2, 4, 33, 39, 40, and 53
• FAR Case 2026-002 covering Parts 6, 7, 10, 18, 26, 37, and 41
• FAR Case 2026-005 covering Parts 5, 24, and 29
• A fourth proposed rule covering Parts 3 and 49

The comment period ran thirty days and closed on July 23, 2026. The Council has said it intends twelve proposed rules in total, which together will cover the whole FAR. Several parts that matter enormously to technology buyers, including Part 12 on commercial items, Part 13 on simplified acquisition, Part 15 on negotiated procurement, and Part 19 on small business programs, have deviation text in force but had not reached proposed-rule stage as of this writing.

The practical consequence is a layered rulebook. For any given requirement you may be looking at legacy FAR text still codified in 48 CFR, deviation text an agency has adopted that supersedes it for that agency's buys, and proposed text that is not yet binding on anyone. All three can be findable on the internet at the same time, and a search engine will happily hand you the wrong one.

Why the clause numbers moved

Two separate forces are moving numbers, and it helps to keep them apart.

The first is consolidation. When the rewrite merged scattered coverage into one place, the clauses moved with it. The clearest example is the new Part 40. Requirements that used to be spread across FAR subparts 4.4, 4.19 through 4.23, and 25.7 were pulled into a single part covering security and supply chain. More than a dozen separate provisions and clauses were merged into four instruments: one provision and three clauses. A merged clause cannot keep four old numbers, so it gets a new one.

The second is a deliberate renumbering proposal. In the June 2026 rulemaking, the FAR Council raised the idea of relocating every provision and clause into a new subpart of Part 52. Under that proposal, clauses in the overhauled FAR would sit in subpart 52.4 and their numbers would begin with 52.4 rather than 52.2. The stated reason is precisely the confusion this article is about: a clause number that starts 52.4 tells you immediately that you are looking at overhauled text, and one that starts 52.2 tells you it is legacy. As of late July 2026 this is a proposal in a proposed rule, not settled law.

There is a third pattern worth recognizing. Deviation clauses frequently take numbers ending in 90 or above, because that range has long been reserved for agency-supplemental and deviation clauses rather than FAR clauses. When you see a clause numbered 52.240-90, the 90 is a signal that you are reading deviation text.

What changed for technology buys

Part 39 was rewritten and renamed. It is no longer "Acquisition of Information Technology." It is now Acquisition of Information and Communication Technology, which widens the frame for future rulemaking on emerging technology. The standalone privacy section at FAR 39.105 and its clause at 52.239-1 were deleted as redundant and inconsistently applied; privacy and security obligations now come from the security part and from statute rather than from a general-purpose clause bolted onto IT buys. Two long-pending FAR cases were folded in, one on the NICE cybersecurity workforce framework and one adding a positioning, navigation, and timing step to acquisition planning.

One rule small firms should be glad survived: the prohibition on writing minimum personnel experience or education requirements into IT-services solicitations absent a documented agency need. That rule sat at FAR 39.104 in the legacy text. It is preserved in the rewrite, at a different section number. If you have ever lost a competition because a solicitation demanded a bachelor's degree and five years for a role your best engineer does the work of without either, that clause is your friend, and it still exists.

Part 40 is now the security part. This is the change most likely to surprise a technology vendor. Controlled unclassified information handling, the Section 889 telecommunications prohibitions, the Federal Acquisition Supply Chain Security Act, and prohibitions on covered foreign technology now live together in Part 40 instead of being scattered through Part 4 and Part 25. Section 889 coverage moved from subpart 4.21 to FAR 40.202(d), with the definitions centralized at 40.201.

The clause-level effect is direct. The Section 889 representation and clause that everyone in federal technology knows by heart, 52.204-24 and 52.204-25, are replaced under the Part 40 deviation by 52.240-90, Security Prohibitions and Exclusions Representations and Certifications, and 52.240-91, Security Prohibitions and Exclusions. Same statute, same underlying prohibition, different number on the page.

On the defense side, data rights numbering changed too. DoD ran its own overhaul of the DFARS through class deviations. The Part 227 deviation, covering patents, data, and copyrights, took effect on February 1, 2026 and rewrote the part for clarity. Provisions were renumbered into a 79xx series: the familiar DFARS 252.227-7017, Identification and Assertion of Use, Release, or Disclosure Restrictions, appears in the deviation as 252.227-7992. If you build software and your assertions table template cites 7017, it is citing a provision your solicitation may no longer use.

A short crosswalk

These are the mappings a technology buyer or vendor hits most often. Treat it as a starting point and confirm against the specific agency deviation your solicitation runs under.

Reading a solicitation that mixes both

Here is the working method. It takes about ten minutes per solicitation and it prevents nearly every problem in this area.

1. Find the word DEVIATION. FAR 52.252-6 requires that when a clause is used with an authorized deviation, the contracting officer keeps the same number, title, and date but adds "(DEVIATION)" after the date. FAR 52.252-5 does the same for solicitation provisions. That parenthetical is your single best signal that the text you are about to comply with is not the text on the public FAR site.
2. Read the clauses-incorporated-by-reference list carefully, not quickly. Most clauses are pulled in by reference under 52.252-1 and 52.252-2, meaning only the number and title appear. If you skim the list you will read a number you recognize and assume you know the text. Under a deviation that assumption is exactly wrong.
3. Identify the agency and find its deviation. The instrument that governs is that agency's deviation memo, posted publicly, not the FAR Council's model text. GSA's Part 40 deviation, DoD's DFARS deviations, and DOE's procurement flashes each carry their own effective dates and, occasionally, their own tailoring.
4. Check the effective date against the solicitation date. A deviation effective February 1 does not govern a solicitation issued in January. Line the dates up before concluding anything.
5. Note the 90-and-above tell. A clause number ending in 90 or higher is almost always agency-supplemental or deviation text. Treat it as a prompt to go read the actual words.
6. Ask in writing during the question period. If a solicitation cites both 52.204-25 and 52.240-91, or cites one while the reps and certs ask for the other, submit a question. Quote both numbers and ask which governs. Contracting officers would rather answer that in Q&A than in a protest, and an ambiguity you raised in writing is a much better position than one you guessed at.
7. Do not assume anything changed in your existing contracts. A deviation issued after your award does not rewrite the clauses in an awarded contract. Those change by modification, signed by both parties. Your compliance obligation today is the clause list in your contract document.
8. Fix your flow-downs. If your prime contract carries 52.240-91 and your subcontract template flows down 52.204-25, you have flowed down a clause the prime contract does not contain. Map your templates to the prime, every time.

Five mistakes that will bite you

One, trusting a search result. Searching a clause number returns legacy text from a dozen mirror sites, most of them stale. Go to the solicitation, then to the agency deviation, then to acquisition.gov. In that order.

Two, assuming every agency is in the same place. Adoption ran on separate schedules across agencies, and a handful of parts are still working through the rulemaking pipeline. Cross-agency assumptions are the most common failure I see.

Three, treating deleted FAR text as a repealed obligation. Much of what came out of the FAR was procedural guidance that moved to a buying guide, and some of it restated a statute that is still perfectly in force. Section 889 did not go away when subpart 4.21 did.

Four, reusing last year's proposal boilerplate. Compliance matrices, assertions tables, and reps-and-certs crosswalks written against 52.204-25 or DFARS 252.227-7017 will cite instruments that are not in the current solicitation. That reads as carelessness to an evaluator even when the substance is right.

Five, waiting for the dust to settle. With twelve proposed rules planned and only four published so far, the layered state is going to last a while. Build the habit now.

What to do this month

Two concrete steps. First, build a one-page crosswalk for the ten or fifteen clauses your organization actually touches, with three columns: legacy number, deviation number, and the agency deviation that governs. Put a date on it, keep it in version control, and re-check it when the next tranche of proposed rules publishes. This is a small artifact that prevents a large class of errors.

Second, read the Practitioner Album for the two or three parts closest to your work. For most people reading this, that is Part 39, Part 40, and whichever of Parts 12, 13, or 15 you buy or sell under. The line-out documents show what was deleted, and half an hour with those is worth more than any summary, including this one.

The overhaul is a real improvement in readability. The FAR was accumulating procedural text for four decades and a lot of it deserved to come out. The cost is a transition period where the same requirement wears two numbers, and the people who get hurt by that are usually the smallest firms with the thinnest compliance staff. Ten minutes of clause-number discipline per solicitation closes most of that gap.