Open Standard

ORCA: Open Regulatory Change Annotation

Version 1.0 · March 2026

ORCA extends the Federal Register API schema to cover all regulatory sources. Same field names where they overlap. Extended with AI-enriched intelligence fields where they don't.

Why ORCA Exists

Every GRC platform (ServiceNow, Archer, LogicGate, Hyperproof) has its own schema for regulatory data. Every content provider (CUBE, Thomson Reuters, FiscalNote) builds bespoke connectors. There is no STIX for regulations, no FHIR for compliance data.

The Federal Register API is the closest thing to a de facto standard. Well-designed JSON, 60+ fields, free, no auth. But it only covers formal Federal Register publications. Not the 90% of regulatory output that lives on agency websites, state portals, court dockets, and guidance pages with no API at all.

ORCA unifies all of these into one schema. Sources with structured APIs get their native fields preserved. Sources with no API get the same structured output via AI enrichment. One format for everything.

Design Principles

1. Federal Register compatible

Field names match the FR API where they overlap. Existing consumers don't learn new names.

2. AI-enriched where governments aren't

Intelligence fields (attention_level, required_actions, applies_to) come from AI annotation. They're what GRC platforms want but only premium providers supply.

3. Taxonomy, not mandate

Not all fields are always available. A state guidance page might fill 15 of 40+ fields. A Federal Register final rule might fill 35. Fill rate improves as models improve.

4. Machine and human readable

Every field has a defined type, allowed values where applicable, and plain-language description.

Field Groups

A. Identity from Federal Register schema

Field Type Example
document_number string FDA-GD-20260310-01
title string FDA Issues Final Rule on Laboratory Developed Tests
citation string 91 FR 12304
source_url string https://www.fda.gov/...
docket_ids string[] ["FDA-2023-N-2177"]
cfr_references object[] [{"title": 21, "part": 809}]

B. Authority

Field Type Example
authority.id string fda
authority.name string Food and Drug Administration
authority.short_name string FDA
authority.country string US
authority.level string federal / state / local / international
authority.parent_id string hhs

C. Jurisdiction

Field Type Example
jurisdiction.country string US
jurisdiction.level string federal / state / local
jurisdiction.subdivision string CA
jurisdiction.scope string National (US)

D. Dates

Field Type Description
publication_date date When published or detected
effective_on date When it takes effect
comments_close_on date Comment period deadline
compliance_deadline date When entities must act by
detected_at datetime When the monitoring system found it (ISO 8601)

E. Classification Federal Register base + extensions

Field Type Allowed Values
type string Rule, Proposed Rule, Notice, Guidance, Enforcement, Consultation, FAQ
action string Free-text action description
change_type string Added, Amended, Removed
status string Draft, Proposed, Final, Interim Final, Interpretive, Concept, Corrected, Withdrawn
change_scope string Minor, Substantive, Structural
topics string[] Topic/keyword tags
sector string[] Affected industries

F. Intelligence GovPing extensions, AI-enriched

Field Type Description
attention_level string Urgent / Priority review / Routine
legal_weight string Binding / Non-binding
summary string 2-3 sentence plain-language summary
analysis string Multi-paragraph AI analysis with implications
applies_to string[] Who must act
required_actions string[] Specific action items
penalty_info string Fines/consequences for non-compliance
geographic_scope string Geographic applicability
operational_domain string Which team/function owns this

G. Process from Regulations.gov

Field Type Description
within_comment_period boolean Is this actionable now?
open_for_comment boolean Can you submit comments?
comment_count integer Number of public comments
attachments object[] Supporting documents with URLs and formats

H. Metadata

Field Type Description
enriched_at datetime When AI enrichment was applied
content_hash string SHA-256 of source content
version string Schema version number
provider string Who produced this record

Example JSON

{
  "document_number": "FDA-GD-20260310-01",
  "title": "FDA Issues Final Rule on Laboratory Developed Tests",
  "citation": null,
  "source_url": "https://www.fda.gov/regulatory-information/final-rule-ldt",
  "docket_ids": ["FDA-2023-N-2177"],
  "cfr_references": [
    {"title": 21, "part": 809},
    {"title": 21, "part": 820}
  ],

  "authority": {
    "id": "fda",
    "name": "Food and Drug Administration",
    "short_name": "FDA",
    "country": "US",
    "level": "federal",
    "parent_id": "hhs"
  },

  "jurisdiction": {
    "country": "US",
    "level": "federal",
    "subdivision": null,
    "scope": "National (US)"
  },

  "dates": {
    "publication_date": "2026-03-10",
    "effective_on": "2026-04-10",
    "comments_close_on": null,
    "compliance_deadline": "2027-03-10",
    "detected_at": "2026-03-10T14:23:00Z"
  },

  "classification": {
    "type": "Rule",
    "action": "Final rule.",
    "change_type": "Added",
    "status": "Final",
    "change_scope": "Structural",
    "topics": ["Laboratory Testing", "FDA Oversight", "Clinical Diagnostics"],
    "sector": ["Healthcare", "Diagnostics"]
  },

  "intelligence": {
    "attention_level": "Urgent",
    "legal_weight": "Binding",
    "summary": "The FDA published a final rule establishing oversight of laboratory developed tests under the FD&C Act. Clinical laboratories must begin phaseout compliance within 12 months.",
    "analysis": "The FDA has finalized its rule to regulate LDTs as medical devices...",
    "applies_to": ["Healthcare providers", "Medical device makers", "Clinical investigators"],
    "required_actions": [
      "Inventory all laboratory developed tests and classify by risk level",
      "Register and list LDTs with FDA within 12 months",
      "Implement adverse event reporting within 18 months"
    ],
    "penalty_info": "Warning letters, injunctions, civil penalties for non-compliance",
    "geographic_scope": "National (US)",
    "operational_domain": "Clinical Operations"
  },

  "process": {
    "within_comment_period": false,
    "open_for_comment": false,
    "comment_count": null,
    "attachments": []
  },

  "metadata": {
    "enriched_at": "2026-03-10T14:25:00Z",
    "content_hash": "sha256:abc123...",
    "version": "1.0",
    "provider": "govping"
  }
}

How to Consume

Format Endpoint Description
Browse changeflow.com/govping HTML pages, role-filtered views, search
RSS/Atom changeflow.com/govping/feed.rss Standard feed, works in any reader or GRC platform
OPML changeflow.com/govping/feeds.opml Subscribe to all feeds at once
JSON API Coming soon REST API, full ORCA format
CSV Coming soon Download and filter in Excel/Sheets

GRC Platform Compatibility

Every major GRC platform can consume this schema:

Platform Integration Field Mapping
ServiceNow RCM REST API authority → Regulator, type → Content Type, attention_level → Priority
IBM OpenPages REST API document_number → Event ID, dates → Event dates, topics → Taxonomy tags
LogicGate Risk Cloud CSV/REST Flat field mapping to customer-defined layouts
Archer REST API Already understands regulatory data (owns Compliance.ai)
Jira Webhook required_actions → subtasks
Slack/Teams Webhook Formatted alert with summary + attention_level

Versioning

Current version: 1.0 (March 2026)

The ORCA spec is versioned. Breaking changes increment the major version. New optional fields increment the minor version. The metadata.version field in every record indicates which schema version was used.

Questions, feedback, or want to adopt ORCA? [email protected]