Four Certifications, One Academic Year: The December 31 FAR Deadline and the Section 117 Rule That Now Gates Your Grant Eligibility

Compliance obligations rarely arrive as a single event. They accumulate, each one reasonable in isolation, until an institution discovers it has signed four certifications in eighteen months, each of which a federal prosecutor can now characterize as material to payment.

A grant compliance roadmap published August 19, 2026 by Nixon Peabody's higher education practice lays out where colleges and universities stand entering the 2026–2027 academic year. Most of the coverage of the last two years has focused on the diversity-related certifications, which we have written about repeatedly. Two items in the roadmap get far less attention and carry harder dates.

The two underdiscussed items

First: FAR 52.222-90 and December 31, 2026.

Executive Order 14398, issued March 26, 2026, prohibits what it terms "racially discriminatory DEI activities" in federal contracts. Its implementing contract clause, FAR 52.222-90, took effect April 25, 2026 for new awards. The date that matters more is the back-fill: existing contracts must come into compliance by December 31, 2026.

That is a flow-down exercise, not a policy exercise. Every open federal procurement contract an institution holds — and universities hold more of these than they typically track centrally, across facilities, IT, research services, and clinical operations — needs to be reviewed against the clause before the end of the calendar year. Institutions that manage grants centrally and contracts departmentally are structurally exposed here, because the office that knows about the clause is often not the office holding the contract.

Second: Section 117 is now a grant eligibility condition.

Section 117 of the Higher Education Act has required postsecondary institutions receiving federal financial support to disclose foreign gifts and contracts of $250,000 or more from a single foreign source in a calendar year since long before the current enforcement posture. For most of its history it was a reporting obligation with weak teeth.

Executive Order 14282, issued April 23, 2025, changed the consequence structure. It provides that certification of Section 117 compliance is material for purposes of the False Claims Act and material to the receipt of federal grant funds, which are not to be provided in cases of noncompliance.

Read that carefully, because it is a different kind of rule than a reporting requirement. A missed or inaccurate Section 117 filing is no longer principally a Department of Education matter resolved through corrected reporting. It is a potential predicate for FCA liability — treble damages, statutory penalties, qui tam exposure — and an asserted basis for withholding grant money across every agency, not just ED.

The enforcement infrastructure caught up in 2026. A new reporting portal was implemented in January 2026. On February 23, 2026, the Department of Education announced an interagency partnership with the Department of State to support Section 117 enforcement, with State taking on administration of the biannual reporting, initiation of civil investigations, investigative audits, and interagency coordination. ED's Office of General Counsel has opened institution-specific investigations, including one at UC Berkeley. The most recent reporting deadline fell on July 31, 2026; the reporting cycle is biannual, so the next one arrives in the winter.

The practical implication for a research office: the accuracy of your Section 117 filing is now a research funding question. If your sponsored programs office and your advancement office do not talk — and at many institutions they structurally do not — the gift your development team booked and the disclosure your compliance team filed may not match, and the consequence of that mismatch is no longer a letter.

The full stack, in order

Assembled from the roadmap, here is what an institution is certifying to or operating under going into this academic year:

Layered on top: restrictions on participation in malign foreign talent recruitment programs, agency-specific grant terms at NIH and NSF that have changed materially in the last two cycles, and an FCA enforcement posture that is no longer hypothetical.

The enforcement posture is real, and the first settlement was not a university

On April 10, 2026, the Justice Department announced the first False Claims Act settlement under its Civil Rights Fraud Initiative. IBM agreed to pay $17,077,043 to resolve allegations that it maintained employment practices discriminating on the basis of race, color, national origin, or sex during a 2019–2026 period, while certifying compliance with anti-discrimination provisions incorporated into its federal contracts. The government pointed to diversity-linked compensation, demographic hiring targets, and programs restricted by protected characteristic.

It is worth being precise: that settlement was with a technology company, not a university. But the theory of the case is the part that transfers. The alleged fraud was not the underlying practice — it was the certification made while the practice was in place. Any institution that certifies compliance while operating a program a prosecutor could characterize as inconsistent with the certification is exposed to the identical theory, and universities certify far more often than IBM does.

The roadmap flags a specific and uncomfortable corollary: public statements can become evidence of a certification gap. Institutional commitments published on websites, in strategic plans, in press releases, and in responses to the Education Department's National Call to Action are discoverable and can be read against a later certification. Institutions have historically treated public-facing mission language and compliance filings as separate genres written by separate offices. That separation is now a liability.

What a defensible file looks like

The roadmap's recommendations are procedural rather than substantive, which is the right emphasis — the question in an FCA case is rarely whether you were right, it is whether your process was reasonable and contemporaneously documented.

Centralize certification review. No certification should be executed by the office that happens to receive the request. Route every one through counsel before signature. At most institutions this is the single highest-value change available, because the current failure mode is a departmental administrator clicking through a SAM.gov attestation without anyone senior reading it.

Run a scoped audit, not a general one. Five areas: programs and hiring practices against the DEI certifications; Section 117 disclosures against advancement records; foreign research relationships and personnel; current NIH and NSF grant terms as actually issued, not as remembered; and federal procurement contracts against FAR 52.222-90.

Document the analysis when you make it, not when you are asked for it. Checklists, dated memoranda, the reasoning behind a judgment call. Contemporaneous documentation is the difference between a defensible good-faith position and a reconstruction that looks like one.

Review public commitments before they are published. Add a compliance read to the workflow for anything institutional that goes out under the university's name and touches these subjects.

Prepare for the October 1 framework change. The OMB rewrite would alter indirect cost treatment and impose new restrictions on discretionary awards, and it would land mid-fiscal-year for most institutions. We covered its substance in the 2 CFR Part 200 overhaul analysis and the peer review demotion in the 200.205(d) piece.

The calendar between now and the new year

• September 30, 2026 — end of the federal fiscal year; the OMB rule's proposed effective date follows immediately.
• October 1, 2026 — target effective date for the rewritten Uniform Guidance. Award terms issued after this date should be read fresh, not assumed.
• December 31, 2026 — FAR 52.222-90 compliance deadline for existing contracts. This is the hardest date on the list and the one least likely to be on a research office's calendar, because it is a procurement date, not a grants date.
• Winter 2026–2027 — next Section 117 biannual reporting cycle, now filed into a portal administered with State Department involvement and backed by civil investigative authority.

Four certifications, one academic year. The DEI attestations have absorbed nearly all the institutional attention, and they deserved much of it — see our coverage of the SAM.gov certification mechanics. But the two items most likely to produce an unpleasant surprise this year are a procurement clause with a December deadline and a foreign gift disclosure rule that quietly became a condition of getting paid at all.