Open Standard
ORCA: Open Regulatory Change Annotation
Version 1.3 · April 2026
ORCA extends the Federal Register API schema to cover all regulatory sources. Same field names where they overlap. Extended with AI-enriched intelligence fields where they don't.
Why ORCA Exists
Every GRC platform (ServiceNow, Archer, LogicGate, Hyperproof) has its own schema for regulatory data. Every content provider (CUBE, Thomson Reuters, FiscalNote) builds bespoke connectors. There is no STIX for regulations, no FHIR for compliance data.
The Federal Register API is the closest thing to a de facto standard. Well-designed JSON, 60+ fields, free, no auth. But it only covers formal Federal Register publications. Not the 90% of regulatory output that lives on agency websites, state portals, court dockets, and guidance pages with no API at all.
ORCA unifies all of these into one schema. Sources with structured APIs get their native fields preserved. Sources with no API get the same structured output via AI enrichment. One format for everything.
Design Principles
1. Federal Register compatible
Field names match the FR API where they overlap. Existing consumers don't learn new names.
2. AI-enriched where governments aren't
Intelligence fields (attention_level, required_actions, applies_to) come from AI annotation. They're what GRC platforms want but only premium providers supply.
3. Taxonomy, not mandate
Not all fields are always available. A state guidance page might fill 15 of 40+ fields. A Federal Register final rule might fill 35. Fill rate improves as models improve.
4. Machine and human readable
Every field has a defined type, allowed values where applicable, and plain-language description.
Field Groups
ORCA organizes 50+ fields into nine groups. The first five mirror established Federal Register conventions. The remaining four are GovPing extensions that add the intelligence layer, scheduled events, process tracking, and provenance metadata.
A. Identity
Core identifiers that uniquely locate a regulatory document. Mirrors the Federal Register API schema.
| Field | Type | Example |
|---|---|---|
document_number
|
string | FDA-GD-20260310-01 |
title
|
string | FDA Issues Final Rule on Laboratory Developed Tests |
citation
|
string | 91 FR 12304 |
source_url
|
string | https://www.fda.gov/... |
docket_ids
|
string[] | ["FDA-2023-N-2177"] |
cfr_references
|
object[] | [{"title": 21, "part": 809}] |
external_ids
|
object | {"federal_register_number": "2025-12345", "docket_file_number": "FDA-2024-N-0001"} |
bill_id
|
string | H.R. 1234 (verbatim from source only) |
source_language
|
string | BCP 47 code. e.g. "en", "es", "fr" |
B. Authority
Which agency or body issued the document. Supports nested hierarchies (e.g. FDA under HHS).
| Field | Type | Example |
|---|---|---|
authority.id
|
string | fda |
authority.name
|
string | Food and Drug Administration |
authority.short_name
|
string | FDA |
authority.country
|
string | ISO 3166-1 alpha-2. e.g. "US", "GB", "CA" |
authority.level
|
string | federal / state / local / international |
authority.parent_id
|
string | hhs |
authority.branch
|
string | Executive / Legislative / Judicial / Independent / SRO / International |
joint_authorities
|
string[] | Co-issuing authority short_names. e.g. ["FDIC", "OCC"] for an interagency rule |
filing_type
|
string | single / joint |
C. Jurisdiction
Where the regulation applies. Separates the issuing authority from the geographic scope of enforcement.
| Field | Type | Example |
|---|---|---|
jurisdiction.country
|
string | ISO 3166-1 alpha-2. e.g. "US", "GB", "CA" |
jurisdiction.level
|
string | federal / state / local |
jurisdiction.subdivision
|
string | ISO 3166-2 region code. e.g. "CA" (California), "NY", "ENG" |
D. Dates
Key dates for compliance deadlines, comment periods, and effective dates. The fields your GRC workflow routes on.
| Field | Type | Description |
|---|---|---|
publication_date
|
date | When published or detected |
effective_on
|
date | When it takes effect |
comment_close_date
|
date | Comment period deadline for proposed rules/consultations |
compliance_deadline
|
date | When entities must act by |
detected_at
|
datetime | When the monitoring system found it (ISO 8601) |
E. Classification
What kind of regulatory action this is. Combines Federal Register document types with extended categories for guidance, enforcement, and informal actions.
| Field | Type | Allowed Values |
|---|---|---|
type
|
string | Rule, Proposed Rule, Notice, Guidance, Enforcement, Consultation, FAQ |
action
|
string | Free-text action description |
change_type
|
string | Added, Amended, Removed |
status
|
string | Draft, Proposed, Final, Interim Final, Interpretive, Concept, Corrected, Withdrawn |
change_scope
|
string | Minor, Substantive, Structural |
topics
|
string[] | Topic/keyword tags |
sector
|
string[] | NAICS code + name. Closed list of 45 sectors. e.g. "3254 - Pharmaceutical Manufacturing" |
related_framework
|
string[] | Compliance frameworks impacted. Closed list of 25. e.g. "HIPAA", "SOX", "PCI DSS" |
F. Intelligence
AI-enriched fields unique to GovPing. This is what enterprise platforms charge $10K-50K/year for: urgency scoring, action items, and plain-language analysis.
| Field | Type | Description |
|---|---|---|
attention_level
|
string | Urgent / Priority review / Routine |
legal_weight
|
string | Binding / Non-binding |
summary
|
string | 2-3 sentence plain-language summary |
analysis
|
string | Multi-paragraph AI analysis with implications |
applies_to
|
string[] | Who must act |
required_actions
|
string[] | Specific action items |
penalty_info
|
string | Fines/consequences for non-compliance |
geographic_scope
|
string | ISO 3166 code. Country: "US", "GB". Subdivision: "US-CA", "US-NY". EU-wide: "EU" |
operational_domain
|
string | Which team/function owns this |
analyst_note
|
string | Optional operational read of why this matters. Empty when no defensible read can be grounded in source text. |
pull_quote
|
string | One verbatim sentence from the source, programmatically verified as a contiguous substring. Empty when no qualifying sentence exists. |
related_changes
|
string[] | Bidirectional cross-references to related ORCA records by change_id |
G. Events
Hearings, meetings, webinars, and proceedings on the regulator's calendar. Only populated for scheduled events.
| Field | Type | Description |
|---|---|---|
event_type
|
string | Hearing / Meeting / Proceeding / Webinar / Conference |
event_date
|
date | YYYY-MM-DD |
event_time
|
string | HH:MM, local to event_location |
event_end_time
|
string | HH:MM |
event_location
|
string | Venue address or virtual-attendance URL |
H. Process
Rulemaking process fields from Regulations.gov. Tracks comment periods, public participation, and supporting documents.
| Field | Type | Description |
|---|---|---|
within_comment_period
|
boolean | Is this actionable now? |
open_for_comment
|
boolean | Can you submit comments? |
comment_count
|
integer | Number of public comments |
attachments
|
object[] | Supporting documents with URLs and formats |
I. Metadata
Provenance and versioning. Tells consumers when the record was enriched, which schema version was used, and who produced it.
| Field | Type | Description |
|---|---|---|
enriched_at
|
datetime | When AI enrichment was applied |
content_hash
|
string | SHA-256 of source content |
version
|
string | Schema version number |
provider
|
string | Who produced this record |
J. Entities
v1.3. Structured references to citations, authorities, and parties named in the source. Every value is traceable — the LLM proposes, server-side validation disposes. Citations run through regex-based canonicalisation, authority_entities are resolved against a curated entity table, and parties must appear as verbatim substrings of the source document.
| Field | Type | Description |
|---|---|---|
citations
|
object[] | Legal citations (CFR, USC, Executive Order, Public Law, H.R./S. bills, EU directives). Each {raw, canonical, context}. canonical is a deterministic slug (e.g. cfr_21_314.50) for cross-document dedup. |
authority_entities
|
object[] | Agencies, statutes, frameworks, and courts named in the source. Each {raw, canonical_slug, display_name, hub_type, hub_path}. Resolved against a curated entity table; unresolvable entries are dropped. |
parties
|
string[] | Companies, firms, or persons identified as the subject of the action (respondent, recalling firm, defendant, sanctioned entity). Verified as verbatim NFKC-normalised substrings of the source document. |
Example Output
The same FDA final rule in three formats. Same ORCA data, different representations. Pick the one that fits your consumer.
JSON
For GRC platforms, dashboards, and structured integrations. Full ORCA schema with typed fields.
{
"document_number": "FDA-GD-20260310-01",
"title": "FDA Issues Final Rule on Laboratory Developed Tests",
"citation": null,
"source_url": "https://www.fda.gov/regulatory-information/final-rule-ldt",
"docket_ids": ["FDA-2023-N-2177"],
"cfr_references": [
{"title": 21, "part": 809},
{"title": 21, "part": 820}
],
"authority": {
"id": "fda",
"name": "Food and Drug Administration",
"short_name": "FDA",
"country": "US",
"level": "federal",
"parent_id": "hhs"
},
"jurisdiction": {
"country": "US",
"level": "federal",
"subdivision": null
},
"dates": {
"publication_date": "2026-03-10",
"effective_on": "2026-04-10",
"comment_close_date": null,
"compliance_deadline": "2027-03-10",
"detected_at": "2026-03-10T14:23:00Z"
},
"classification": {
"type": "Rule",
"action": "Final rule.",
"change_type": "Added",
"status": "Final",
"change_scope": "Structural",
"topics": ["Laboratory Testing", "FDA Oversight", "Clinical Diagnostics"],
"sector": ["3345 - Medical Device Manufacturing", "6221 - Hospitals & Health Systems"],
"related_framework": ["FDA 21 CFR Part 11", "GxP"]
},
"intelligence": {
"attention_level": "Urgent",
"legal_weight": "Binding",
"summary": "The FDA published a final rule establishing oversight of laboratory developed tests under the FD&C Act.",
"analysis": "The FDA has finalized its rule to regulate LDTs as medical devices...",
"analyst_note": "Clinical labs that have historically operated under CMS/CLIA oversight only must now build an FDA-style quality system. The 12-month registration window is the binding constraint, not the 18-month adverse event reporting deadline.",
"pull_quote": "Laboratories must register and list each laboratory developed test with the FDA within 12 months of the effective date of this rule.",
"applies_to": ["Healthcare providers", "Medical device makers", "Clinical investigators"],
"required_actions": [
"Inventory all laboratory developed tests and classify by risk level",
"Register and list LDTs with FDA within 12 months",
"Implement adverse event reporting within 18 months"
],
"penalty_info": "Warning letters, injunctions, civil penalties for non-compliance",
"geographic_scope": "US",
"operational_domain": "Clinical Operations",
"related_changes": ["FDA-GD-20240501-12", "FDA-GD-20240618-03"]
},
"process": {
"within_comment_period": false,
"open_for_comment": false,
"comment_count": null,
"attachments": []
},
"metadata": {
"enriched_at": "2026-03-10T14:25:00Z",
"content_hash": "sha256:abc123...",
"version": "1.3",
"provider": "govping"
}
}
Markdown
For AI agents, LLM pipelines, and RAG systems. YAML frontmatter with structured fields, prose below. Zero parsing required.
---
document_number: FDA-GD-20260310-01
title: FDA Issues Final Rule on Laboratory Developed Tests
authority: FDA
type: Rule
status: Final
attention_level: Urgent
legal_weight: Binding
effective_on: 2026-04-10
compliance_deadline: 2027-03-10
geographic_scope: US
sector: [3345 - Medical Device Manufacturing, 6221 - Hospitals & Health Systems]
related_framework: [FDA 21 CFR Part 11, GxP]
applies_to: [Healthcare providers, Medical device makers, Clinical investigators]
source_url: https://www.fda.gov/regulatory-information/final-rule-ldt
---
The FDA published a final rule establishing oversight of laboratory
developed tests under the FD&C Act. Clinical laboratories must begin
phaseout compliance within 12 months.
## Required Actions
- Inventory all laboratory developed tests and classify by risk level
- Register and list LDTs with FDA within 12 months
- Implement adverse event reporting within 18 months
## Penalties
Warning letters, injunctions, civil penalties for non-compliance.
RSS
For feed readers, simple alerting, and GRC platforms that consume Atom/RSS. Lightweight summary with a link to the full record.
<entry>
<title>FDA Issues Final Rule on Laboratory Developed Tests</title>
<link href="https://changeflow.com/govping/changes/FDA-GD-20260310-01"/>
<id>urn:govping:FDA-GD-20260310-01</id>
<published>2026-03-10T14:23:00Z</published>
<category term="Rule"/>
<category term="Urgent"/>
<category term="FDA"/>
<summary>The FDA published a final rule establishing oversight of
laboratory developed tests under the FD&C Act.</summary>
</entry>
How to Consume
GovPing publishes every regulatory change in ORCA format. The API lets you filter by agency, jurisdiction, document type, date range, topic, and sector. Request JSON for your GRC platform, markdown for your AI agents, or RSS for your feed reader. Same data, multiple representations.
| Format | Endpoint | Description |
|---|---|---|
| Browse | changeflow.com/govping | HTML pages, role-filtered views, search |
| RSS/Atom | changeflow.com/govping/feed.rss | Standard feed, works in any reader or GRC platform |
| OPML | changeflow.com/govping/feeds.opml | Subscribe to all feeds at once |
| JSON API | Coming soon | REST API with full ORCA fields. Filter by agency, jurisdiction, type, date, topic. |
| Markdown | append .md to any change URL | Machine-readable format. Structured metadata plus prose. Every change and source page supports it. llms.txt index at govping.org/llms.txt. |
| CSV | Coming soon | Download and filter in Excel/Sheets |
GRC Platform Compatibility
ORCA fields map directly to every major GRC platform. If your team already uses one of these, integration is straightforward.
| Platform | Integration | Field Mapping |
|---|---|---|
| ServiceNow RCM | REST API | authority → Regulator, type → Content Type, attention_level → Priority |
| IBM OpenPages | REST API | document_number → Event ID, dates → Event dates, topics → Taxonomy tags |
| LogicGate Risk Cloud | CSV/REST | Flat field mapping to customer-defined layouts |
| Archer | REST API | Already understands regulatory data (owns Compliance.ai) |
| Jira | Webhook | required_actions → subtasks |
| Slack/Teams | Webhook | Formatted alert with summary + attention_level |
Versioning
Current version: 1.3 (April 2026)
Changes since 1.0:
- 1.3 (Apr 2026): adds citations, authority_entities, parties. Citations (CFR, USC, Executive Order, Public Law, bills, EU directives) are re-validated server-side against a regex pattern and re-canonicalised to deterministic slugs — the LLM cannot invent its own slug format. authority_entities (agencies, statutes, frameworks, courts) are resolved against a curated entity table; unresolvable entries are dropped. parties (named companies, firms, or persons) must appear as an NFKC-normalised verbatim substring of the source or they are dropped. Every v1.3 field is optional and defaults to [].
- 1.2 (Apr 2026): adds branch, joint_authorities, filing_type, event_*, source_language, bill_id, external_ids, pull_quote, related_changes. Every new field is optional and follows strict anti-fabrication rules — pull_quote is verified as a verbatim contiguous substring of the source, identifiers are populated only from authoritative APIs or verbatim source text.
- 1.1: adds analyst_note (operational read of why the change matters), grounded against source text and empty when no defensible note can be supported.
The ORCA spec is versioned. Breaking changes increment the major version. New optional fields increment the minor version. The
metadata.version
field in every record indicates which schema version was used.
Questions, feedback, or want to adopt ORCA? [email protected]