Open Standard
ORCA: Open Regulatory Change Annotation
Version 1.0 · March 2026
ORCA extends the Federal Register API schema to cover all regulatory sources. Same field names where they overlap. Extended with AI-enriched intelligence fields where they don't.
Why ORCA Exists
Every GRC platform (ServiceNow, Archer, LogicGate, Hyperproof) has its own schema for regulatory data. Every content provider (CUBE, Thomson Reuters, FiscalNote) builds bespoke connectors. There is no STIX for regulations, no FHIR for compliance data.
The Federal Register API is the closest thing to a de facto standard. Well-designed JSON, 60+ fields, free, no auth. But it only covers formal Federal Register publications. Not the 90% of regulatory output that lives on agency websites, state portals, court dockets, and guidance pages with no API at all.
ORCA unifies all of these into one schema. Sources with structured APIs get their native fields preserved. Sources with no API get the same structured output via AI enrichment. One format for everything.
Design Principles
1. Federal Register compatible
Field names match the FR API where they overlap. Existing consumers don't learn new names.
2. AI-enriched where governments aren't
Intelligence fields (attention_level, required_actions, applies_to) come from AI annotation. They're what GRC platforms want but only premium providers supply.
3. Taxonomy, not mandate
Not all fields are always available. A state guidance page might fill 15 of 40+ fields. A Federal Register final rule might fill 35. Fill rate improves as models improve.
4. Machine and human readable
Every field has a defined type, allowed values where applicable, and plain-language description.
Field Groups
A. Identity from Federal Register schema
| Field | Type | Example |
|---|---|---|
document_number
|
string | FDA-GD-20260310-01 |
title
|
string | FDA Issues Final Rule on Laboratory Developed Tests |
citation
|
string | 91 FR 12304 |
source_url
|
string | https://www.fda.gov/... |
docket_ids
|
string[] | ["FDA-2023-N-2177"] |
cfr_references
|
object[] | [{"title": 21, "part": 809}] |
B. Authority
| Field | Type | Example |
|---|---|---|
authority.id
|
string | fda |
authority.name
|
string | Food and Drug Administration |
authority.short_name
|
string | FDA |
authority.country
|
string | US |
authority.level
|
string | federal / state / local / international |
authority.parent_id
|
string | hhs |
C. Jurisdiction
| Field | Type | Example |
|---|---|---|
jurisdiction.country
|
string | US |
jurisdiction.level
|
string | federal / state / local |
jurisdiction.subdivision
|
string | CA |
jurisdiction.scope
|
string | National (US) |
D. Dates
| Field | Type | Description |
|---|---|---|
publication_date
|
date | When published or detected |
effective_on
|
date | When it takes effect |
comments_close_on
|
date | Comment period deadline |
compliance_deadline
|
date | When entities must act by |
detected_at
|
datetime | When the monitoring system found it (ISO 8601) |
E. Classification Federal Register base + extensions
| Field | Type | Allowed Values |
|---|---|---|
type
|
string | Rule, Proposed Rule, Notice, Guidance, Enforcement, Consultation, FAQ |
action
|
string | Free-text action description |
change_type
|
string | Added, Amended, Removed |
status
|
string | Draft, Proposed, Final, Interim Final, Interpretive, Concept, Corrected, Withdrawn |
change_scope
|
string | Minor, Substantive, Structural |
topics
|
string[] | Topic/keyword tags |
sector
|
string[] | Affected industries |
F. Intelligence GovPing extensions, AI-enriched
| Field | Type | Description |
|---|---|---|
attention_level
|
string | Urgent / Priority review / Routine |
legal_weight
|
string | Binding / Non-binding |
summary
|
string | 2-3 sentence plain-language summary |
analysis
|
string | Multi-paragraph AI analysis with implications |
applies_to
|
string[] | Who must act |
required_actions
|
string[] | Specific action items |
penalty_info
|
string | Fines/consequences for non-compliance |
geographic_scope
|
string | Geographic applicability |
operational_domain
|
string | Which team/function owns this |
G. Process from Regulations.gov
| Field | Type | Description |
|---|---|---|
within_comment_period
|
boolean | Is this actionable now? |
open_for_comment
|
boolean | Can you submit comments? |
comment_count
|
integer | Number of public comments |
attachments
|
object[] | Supporting documents with URLs and formats |
H. Metadata
| Field | Type | Description |
|---|---|---|
enriched_at
|
datetime | When AI enrichment was applied |
content_hash
|
string | SHA-256 of source content |
version
|
string | Schema version number |
provider
|
string | Who produced this record |
Example JSON
{
"document_number": "FDA-GD-20260310-01",
"title": "FDA Issues Final Rule on Laboratory Developed Tests",
"citation": null,
"source_url": "https://www.fda.gov/regulatory-information/final-rule-ldt",
"docket_ids": ["FDA-2023-N-2177"],
"cfr_references": [
{"title": 21, "part": 809},
{"title": 21, "part": 820}
],
"authority": {
"id": "fda",
"name": "Food and Drug Administration",
"short_name": "FDA",
"country": "US",
"level": "federal",
"parent_id": "hhs"
},
"jurisdiction": {
"country": "US",
"level": "federal",
"subdivision": null,
"scope": "National (US)"
},
"dates": {
"publication_date": "2026-03-10",
"effective_on": "2026-04-10",
"comments_close_on": null,
"compliance_deadline": "2027-03-10",
"detected_at": "2026-03-10T14:23:00Z"
},
"classification": {
"type": "Rule",
"action": "Final rule.",
"change_type": "Added",
"status": "Final",
"change_scope": "Structural",
"topics": ["Laboratory Testing", "FDA Oversight", "Clinical Diagnostics"],
"sector": ["Healthcare", "Diagnostics"]
},
"intelligence": {
"attention_level": "Urgent",
"legal_weight": "Binding",
"summary": "The FDA published a final rule establishing oversight of laboratory developed tests under the FD&C Act. Clinical laboratories must begin phaseout compliance within 12 months.",
"analysis": "The FDA has finalized its rule to regulate LDTs as medical devices...",
"applies_to": ["Healthcare providers", "Medical device makers", "Clinical investigators"],
"required_actions": [
"Inventory all laboratory developed tests and classify by risk level",
"Register and list LDTs with FDA within 12 months",
"Implement adverse event reporting within 18 months"
],
"penalty_info": "Warning letters, injunctions, civil penalties for non-compliance",
"geographic_scope": "National (US)",
"operational_domain": "Clinical Operations"
},
"process": {
"within_comment_period": false,
"open_for_comment": false,
"comment_count": null,
"attachments": []
},
"metadata": {
"enriched_at": "2026-03-10T14:25:00Z",
"content_hash": "sha256:abc123...",
"version": "1.0",
"provider": "govping"
}
}
How to Consume
| Format | Endpoint | Description |
|---|---|---|
| Browse | changeflow.com/govping | HTML pages, role-filtered views, search |
| RSS/Atom |
changeflow.com/govping/feed.rss
|
Standard feed, works in any reader or GRC platform |
| OPML |
changeflow.com/govping/feeds.opml
|
Subscribe to all feeds at once |
| JSON API | Coming soon | REST API, full ORCA format |
| CSV | Coming soon | Download and filter in Excel/Sheets |
GRC Platform Compatibility
Every major GRC platform can consume this schema:
| Platform | Integration | Field Mapping |
|---|---|---|
| ServiceNow RCM | REST API | authority → Regulator, type → Content Type, attention_level → Priority |
| IBM OpenPages | REST API | document_number → Event ID, dates → Event dates, topics → Taxonomy tags |
| LogicGate Risk Cloud | CSV/REST | Flat field mapping to customer-defined layouts |
| Archer | REST API | Already understands regulatory data (owns Compliance.ai) |
| Jira | Webhook | required_actions → subtasks |
| Slack/Teams | Webhook | Formatted alert with summary + attention_level |
Versioning
Current version: 1.0 (March 2026)
The ORCA spec is versioned. Breaking changes increment the major version. New optional fields increment the minor version. The
metadata.version
field in every record indicates which schema version was used.
Questions, feedback, or want to adopt ORCA? [email protected]