Open Standard

ORCA: Open Regulatory Change Annotation

Version 1.3 · April 2026

ORCA extends the Federal Register API schema to cover all regulatory sources. Same field names where they overlap. Extended with AI-enriched intelligence fields where they don't.

Why ORCA Exists

Every GRC platform (ServiceNow, Archer, LogicGate, Hyperproof) has its own schema for regulatory data. Every content provider (CUBE, Thomson Reuters, FiscalNote) builds bespoke connectors. There is no STIX for regulations, no FHIR for compliance data.

The Federal Register API is the closest thing to a de facto standard. Well-designed JSON, 60+ fields, free, no auth. But it only covers formal Federal Register publications. Not the 90% of regulatory output that lives on agency websites, state portals, court dockets, and guidance pages with no API at all.

ORCA unifies all of these into one schema. Sources with structured APIs get their native fields preserved. Sources with no API get the same structured output via AI enrichment. One format for everything.

Design Principles

1. Federal Register compatible

Field names match the FR API where they overlap. Existing consumers don't learn new names.

2. AI-enriched where governments aren't

Intelligence fields (attention_level, required_actions, applies_to) come from AI annotation. They're what GRC platforms want but only premium providers supply.

3. Taxonomy, not mandate

Not all fields are always available. A state guidance page might fill 15 of 40+ fields. A Federal Register final rule might fill 35. Fill rate improves as models improve.

4. Machine and human readable

Every field has a defined type, allowed values where applicable, and plain-language description.

Field Groups

ORCA organizes 50+ fields into nine groups. The first five mirror established Federal Register conventions. The remaining four are GovPing extensions that add the intelligence layer, scheduled events, process tracking, and provenance metadata.

A. Identity

Core identifiers that uniquely locate a regulatory document. Mirrors the Federal Register API schema.

Field Type Example
document_number string FDA-GD-20260310-01
title string FDA Issues Final Rule on Laboratory Developed Tests
citation string 91 FR 12304
source_url string https://www.fda.gov/...
docket_ids string[] ["FDA-2023-N-2177"]
cfr_references object[] [{"title": 21, "part": 809}]
external_ids object {"federal_register_number": "2025-12345", "docket_file_number": "FDA-2024-N-0001"}
bill_id string H.R. 1234 (verbatim from source only)
source_language string BCP 47 code. e.g. "en", "es", "fr"

B. Authority

Which agency or body issued the document. Supports nested hierarchies (e.g. FDA under HHS).

Field Type Example
authority.id string fda
authority.name string Food and Drug Administration
authority.short_name string FDA
authority.country string ISO 3166-1 alpha-2. e.g. "US", "GB", "CA"
authority.level string federal / state / local / international
authority.parent_id string hhs
authority.branch string Executive / Legislative / Judicial / Independent / SRO / International
joint_authorities string[] Co-issuing authority short_names. e.g. ["FDIC", "OCC"] for an interagency rule
filing_type string single / joint

C. Jurisdiction

Where the regulation applies. Separates the issuing authority from the geographic scope of enforcement.

Field Type Example
jurisdiction.country string ISO 3166-1 alpha-2. e.g. "US", "GB", "CA"
jurisdiction.level string federal / state / local
jurisdiction.subdivision string ISO 3166-2 region code. e.g. "CA" (California), "NY", "ENG"

D. Dates

Key dates for compliance deadlines, comment periods, and effective dates. The fields your GRC workflow routes on.

Field Type Description
publication_date date When published or detected
effective_on date When it takes effect
comment_close_date date Comment period deadline for proposed rules/consultations
compliance_deadline date When entities must act by
detected_at datetime When the monitoring system found it (ISO 8601)

E. Classification

What kind of regulatory action this is. Combines Federal Register document types with extended categories for guidance, enforcement, and informal actions.

Field Type Allowed Values
type string Rule, Proposed Rule, Notice, Guidance, Enforcement, Consultation, FAQ
action string Free-text action description
change_type string Added, Amended, Removed
status string Draft, Proposed, Final, Interim Final, Interpretive, Concept, Corrected, Withdrawn
change_scope string Minor, Substantive, Structural
topics string[] Topic/keyword tags
sector string[] NAICS code + name. Closed list of 45 sectors. e.g. "3254 - Pharmaceutical Manufacturing"
related_framework string[] Compliance frameworks impacted. Closed list of 25. e.g. "HIPAA", "SOX", "PCI DSS"

F. Intelligence

AI-enriched fields unique to GovPing. This is what enterprise platforms charge $10K-50K/year for: urgency scoring, action items, and plain-language analysis.

Field Type Description
attention_level string Urgent / Priority review / Routine
legal_weight string Binding / Non-binding
summary string 2-3 sentence plain-language summary
analysis string Multi-paragraph AI analysis with implications
applies_to string[] Who must act
required_actions string[] Specific action items
penalty_info string Fines/consequences for non-compliance
geographic_scope string ISO 3166 code. Country: "US", "GB". Subdivision: "US-CA", "US-NY". EU-wide: "EU"
operational_domain string Which team/function owns this
analyst_note string Optional operational read of why this matters. Empty when no defensible read can be grounded in source text.
pull_quote string One verbatim sentence from the source, programmatically verified as a contiguous substring. Empty when no qualifying sentence exists.
related_changes string[] Bidirectional cross-references to related ORCA records by change_id

G. Events

Hearings, meetings, webinars, and proceedings on the regulator's calendar. Only populated for scheduled events.

Field Type Description
event_type string Hearing / Meeting / Proceeding / Webinar / Conference
event_date date YYYY-MM-DD
event_time string HH:MM, local to event_location
event_end_time string HH:MM
event_location string Venue address or virtual-attendance URL

H. Process

Rulemaking process fields from Regulations.gov. Tracks comment periods, public participation, and supporting documents.

Field Type Description
within_comment_period boolean Is this actionable now?
open_for_comment boolean Can you submit comments?
comment_count integer Number of public comments
attachments object[] Supporting documents with URLs and formats

I. Metadata

Provenance and versioning. Tells consumers when the record was enriched, which schema version was used, and who produced it.

Field Type Description
enriched_at datetime When AI enrichment was applied
content_hash string SHA-256 of source content
version string Schema version number
provider string Who produced this record

J. Entities

v1.3. Structured references to citations, authorities, and parties named in the source. Every value is traceable — the LLM proposes, server-side validation disposes. Citations run through regex-based canonicalisation, authority_entities are resolved against a curated entity table, and parties must appear as verbatim substrings of the source document.

Field Type Description
citations object[] Legal citations (CFR, USC, Executive Order, Public Law, H.R./S. bills, EU directives). Each {raw, canonical, context}. canonical is a deterministic slug (e.g. cfr_21_314.50) for cross-document dedup.
authority_entities object[] Agencies, statutes, frameworks, and courts named in the source. Each {raw, canonical_slug, display_name, hub_type, hub_path}. Resolved against a curated entity table; unresolvable entries are dropped.
parties string[] Companies, firms, or persons identified as the subject of the action (respondent, recalling firm, defendant, sanctioned entity). Verified as verbatim NFKC-normalised substrings of the source document.

Example Output

The same FDA final rule in three formats. Same ORCA data, different representations. Pick the one that fits your consumer.

JSON

For GRC platforms, dashboards, and structured integrations. Full ORCA schema with typed fields.

{
  "document_number": "FDA-GD-20260310-01",
  "title": "FDA Issues Final Rule on Laboratory Developed Tests",
  "citation": null,
  "source_url": "https://www.fda.gov/regulatory-information/final-rule-ldt",
  "docket_ids": ["FDA-2023-N-2177"],
  "cfr_references": [
    {"title": 21, "part": 809},
    {"title": 21, "part": 820}
  ],

  "authority": {
    "id": "fda",
    "name": "Food and Drug Administration",
    "short_name": "FDA",
    "country": "US",
    "level": "federal",
    "parent_id": "hhs"
  },

  "jurisdiction": {
    "country": "US",
    "level": "federal",
    "subdivision": null
  },

  "dates": {
    "publication_date": "2026-03-10",
    "effective_on": "2026-04-10",
    "comment_close_date": null,
    "compliance_deadline": "2027-03-10",
    "detected_at": "2026-03-10T14:23:00Z"
  },

  "classification": {
    "type": "Rule",
    "action": "Final rule.",
    "change_type": "Added",
    "status": "Final",
    "change_scope": "Structural",
    "topics": ["Laboratory Testing", "FDA Oversight", "Clinical Diagnostics"],
    "sector": ["3345 - Medical Device Manufacturing", "6221 - Hospitals & Health Systems"],
    "related_framework": ["FDA 21 CFR Part 11", "GxP"]
  },

  "intelligence": {
    "attention_level": "Urgent",
    "legal_weight": "Binding",
    "summary": "The FDA published a final rule establishing oversight of laboratory developed tests under the FD&C Act.",
    "analysis": "The FDA has finalized its rule to regulate LDTs as medical devices...",
    "analyst_note": "Clinical labs that have historically operated under CMS/CLIA oversight only must now build an FDA-style quality system. The 12-month registration window is the binding constraint, not the 18-month adverse event reporting deadline.",
    "pull_quote": "Laboratories must register and list each laboratory developed test with the FDA within 12 months of the effective date of this rule.",
    "applies_to": ["Healthcare providers", "Medical device makers", "Clinical investigators"],
    "required_actions": [
      "Inventory all laboratory developed tests and classify by risk level",
      "Register and list LDTs with FDA within 12 months",
      "Implement adverse event reporting within 18 months"
    ],
    "penalty_info": "Warning letters, injunctions, civil penalties for non-compliance",
    "geographic_scope": "US",
    "operational_domain": "Clinical Operations",
    "related_changes": ["FDA-GD-20240501-12", "FDA-GD-20240618-03"]
  },

  "process": {
    "within_comment_period": false,
    "open_for_comment": false,
    "comment_count": null,
    "attachments": []
  },

  "metadata": {
    "enriched_at": "2026-03-10T14:25:00Z",
    "content_hash": "sha256:abc123...",
    "version": "1.3",
    "provider": "govping"
  }
}

Markdown

For AI agents, LLM pipelines, and RAG systems. YAML frontmatter with structured fields, prose below. Zero parsing required.

---
document_number: FDA-GD-20260310-01
title: FDA Issues Final Rule on Laboratory Developed Tests
authority: FDA
type: Rule
status: Final
attention_level: Urgent
legal_weight: Binding
effective_on: 2026-04-10
compliance_deadline: 2027-03-10
geographic_scope: US
sector: [3345 - Medical Device Manufacturing, 6221 - Hospitals & Health Systems]
related_framework: [FDA 21 CFR Part 11, GxP]
applies_to: [Healthcare providers, Medical device makers, Clinical investigators]
source_url: https://www.fda.gov/regulatory-information/final-rule-ldt
---

The FDA published a final rule establishing oversight of laboratory
developed tests under the FD&C Act. Clinical laboratories must begin
phaseout compliance within 12 months.

## Required Actions
- Inventory all laboratory developed tests and classify by risk level
- Register and list LDTs with FDA within 12 months
- Implement adverse event reporting within 18 months

## Penalties
Warning letters, injunctions, civil penalties for non-compliance.

RSS

For feed readers, simple alerting, and GRC platforms that consume Atom/RSS. Lightweight summary with a link to the full record.

<entry>
  <title>FDA Issues Final Rule on Laboratory Developed Tests</title>
  <link href="https://changeflow.com/govping/changes/FDA-GD-20260310-01"/>
  <id>urn:govping:FDA-GD-20260310-01</id>
  <published>2026-03-10T14:23:00Z</published>
  <category term="Rule"/>
  <category term="Urgent"/>
  <category term="FDA"/>
  <summary>The FDA published a final rule establishing oversight of
  laboratory developed tests under the FD&C Act.</summary>
</entry>

How to Consume

GovPing publishes every regulatory change in ORCA format. The API lets you filter by agency, jurisdiction, document type, date range, topic, and sector. Request JSON for your GRC platform, markdown for your AI agents, or RSS for your feed reader. Same data, multiple representations.

Format Endpoint Description
Browse changeflow.com/govping HTML pages, role-filtered views, search
RSS/Atom changeflow.com/govping/feed.rss Standard feed, works in any reader or GRC platform
OPML changeflow.com/govping/feeds.opml Subscribe to all feeds at once
JSON API Coming soon REST API with full ORCA fields. Filter by agency, jurisdiction, type, date, topic.
Markdown append .md to any change URL Machine-readable format. Structured metadata plus prose. Every change and source page supports it. llms.txt index at govping.org/llms.txt.
CSV Coming soon Download and filter in Excel/Sheets

GRC Platform Compatibility

ORCA fields map directly to every major GRC platform. If your team already uses one of these, integration is straightforward.

Platform Integration Field Mapping
ServiceNow RCM REST API authority → Regulator, type → Content Type, attention_level → Priority
IBM OpenPages REST API document_number → Event ID, dates → Event dates, topics → Taxonomy tags
LogicGate Risk Cloud CSV/REST Flat field mapping to customer-defined layouts
Archer REST API Already understands regulatory data (owns Compliance.ai)
Jira Webhook required_actions → subtasks
Slack/Teams Webhook Formatted alert with summary + attention_level

Versioning

Current version: 1.3 (April 2026)

Changes since 1.0:

  • 1.3 (Apr 2026): adds citations, authority_entities, parties. Citations (CFR, USC, Executive Order, Public Law, bills, EU directives) are re-validated server-side against a regex pattern and re-canonicalised to deterministic slugs — the LLM cannot invent its own slug format. authority_entities (agencies, statutes, frameworks, courts) are resolved against a curated entity table; unresolvable entries are dropped. parties (named companies, firms, or persons) must appear as an NFKC-normalised verbatim substring of the source or they are dropped. Every v1.3 field is optional and defaults to [].
  • 1.2 (Apr 2026): adds branch, joint_authorities, filing_type, event_*, source_language, bill_id, external_ids, pull_quote, related_changes. Every new field is optional and follows strict anti-fabrication rules — pull_quote is verified as a verbatim contiguous substring of the source, identifiers are populated only from authoritative APIs or verbatim source text.
  • 1.1: adds analyst_note (operational read of why the change matters), grounded against source text and empty when no defensible note can be supported.

The ORCA spec is versioned. Breaking changes increment the major version. New optional fields increment the minor version. The metadata.version field in every record indicates which schema version was used.

Questions, feedback, or want to adopt ORCA? [email protected]