On 18 September 2026 the FAR Council published another rule in the Revolutionary FAR Overhaul. It covers parts 9, 27 and 47, it runs to roughly a hundred pages of the Federal Register, and it is filed under an executive order about eliminating excessive regulation. The coverage it has received treats it as housekeeping.
It is not housekeeping. FAR Case 2026-011 deletes the government’s civilian data-rights regime and replaces it with the Pentagon’s. For any company whose value sits in technical data or software rather than in hardware, this is among the most consequential of the twelve rules, and the comment window closes on 19 October 2026.
What the rule actually does
Three changes matter, and they pull in different directions.
Subpart 27.4 is deleted in its entirety. The rule strikes “Rights in Data and Copyrights,” along with its associated provisions and clauses, and replaces it with content derived from the Defense Federal Acquisition Regulation Supplement. The rebuilt subpart is retitled for other-than-commercial products, components, services, processes and software. A new subpart 27.5 is created alongside it to hold the commercial side. The result is the DFARS structure, with its commercial and other-than-commercial split, asserted restrictions, validation procedures and deferred ordering, installed in the FAR, where it governs NASA, Energy, Health and Human Services, Homeland Security and every other civilian buyer.
SBIR and STTR data protection is rewritten, in the contractor’s favor. The protection period becomes a single, non-extendable twenty-year term running from the date of award, replacing an extendable four-year period. When that term expires the Government receives perpetual government purpose rights rather than unlimited rights. STTR, which the FAR has never addressed, gets its own coverage, including the allocation of intellectual property between the small business and its research institution partner and two new clauses, FAR 52.227-36 and 52.227-37, carrying preaward and postaward STTR requirements. The FAR Council is explicit that this aligns the FAR with the SBA SBIR/STTR Policy Directive that took effect on 3 May 2023.
And the categories in which the Government takes unlimited rights go from four to eleven. This appears in the rule’s own impact analysis, in a single sentence, and it has gone essentially unreported: the proposed change “would also provide the Government with unlimited rights in eleven different categories of data, while the FAR currently provides unlimited data for only four categories.” That expansion applies to other-than-commercial data generally. It is not limited to SBIR.
Read together, this is not one story
The SBIR and STTR changes are a genuine improvement for small business. Four years of protection, extendable in principle but fragile in negotiation, becomes twenty years that nobody has to argue for. The rights the Government holds afterward narrow from unlimited to government purpose, which means the data cannot be released for commercial purposes outside the Government. A firm whose Phase II work matures slowly now has a protection period that resembles an actual commercialization timeline.
The broader part 27 rewrite runs the other way. Expanding unlimited rights from four categories to eleven is a transfer of position from contractor to Government, and it reaches the far larger universe of other-than-commercial work that is not SBIR or STTR. A company that does both, and most do, gets a better deal on its SBIR line and a tighter one on everything else.
The rule’s own justification for the broader change is worth quoting, because it is an argument about price: contractors “would be more likely to lower prices if they have more assurance that they would receive adequate data rights and that their data would be better protected.” That is a coherent theory. It is also the theory a buyer advances, and the burden of testing it against practice falls on the companies that will live under the clause.
Who this moves, and who has been living it already
The firms with the most at stake are not the primes, and not DoD-only SBIR shops. A company doing Navy or Air Force SBIR work already operates under DFARS 252.227-7018, which carries the twenty-year term and the government purpose rights construct. For them this rule is convergence, and convergence is mostly good: one data-rights playbook instead of two, and an end to the quiet penalty for winning work on the civilian side.
The firms that should be reading closely are those whose SBIR and STTR portfolio sits at the National Institutes of Health, the National Science Foundation, NASA, Energy or Homeland Security. Those companies have been operating under the four-year FAR construct. Their protection period is about to get five times longer, their residual exposure is about to narrow, and the markings and assertions they have been making under the old clauses will have to be re-papered against new ones.
Universities and their STTR partners sit in a third position. The FAR has never carried STTR-specific IP allocation. It is about to, and the split between the small business and the research institution will be shaped by clause text rather than solely by what the parties negotiate. Any institution with an active STTR portfolio should be reading 52.227-36 and 52.227-37 now, not after the rule is final.
What to do before 19 October
Comments go to the Federal eRulemaking Portal under FAR Case 2026-011, docket FAR-2026-0011. The Initial Regulatory Flexibility Analysis states that, as of January 2026, 401,196 entities registered in the System for Award Management were small for at least one NAICS code they had selected. That is the population the FAR Council believes it is regulating. A comment from a company that can describe a real commercialization timeline carries weight in that setting, and the Council must respond to substantive comments before the rule is final.
Three things are worth putting in writing.
Whether twenty years, fixed and non-extendable, actually covers the commercialization path in a given sector. For software it is generous. For a qualified hardware component entering a platform that flies for forty years, a clock that starts at award and never resets is a different proposition, and the Council has asked for this kind of specificity.
What perpetual government purpose rights mean for a product line intended to sell commercially for decades. Government purpose rights permit release to other contractors for government purposes. That includes competitors, on government work, permanently.
And whether the expansion from four to eleven unlimited-rights categories is supported on the record. That sentence appears once in a hundred-page rule, without a category-by-category accounting. Asking the Council to show its work is a fair comment.
The Signal
The Revolutionary FAR Overhaul is being read as a page-count exercise, and the page count is real. But the twelve rules are also the largest rewrite of federal acquisition policy in a generation, and they are moving on comment windows measured in weeks. In this one, a streamlining headline sits on top of a data-rights regime change that will help decide who owns the output of federally funded research for the next twenty years.
Firms that treat the overhaul as someone else’s paperwork will meet it later as clause text in an award they cannot redline. The comment window is the redline. It closes on 19 October 2026.
Source presentation is carried in the article body where applicable. Reported facts and analytic judgment are kept distinct.