DEI Compliance Remains an Active Concern

Consistent with that direction, ED added ACTS to the Integrated Postsecondary Education Data System, which requires schools to submit admissions and enrollment counts by race-sex pair and disaggregation across variables such as test-score quintiles, GPA quintiles, income ranges, Pell eligibility, and parental education, among other data points. ACTS collection opened on December 18, 2025, and closes on March 18, 2026 (though there are reports that some institutions may be granted an extension to April 8, 2026, if certain conditions are met). The government’s stated purpose for collecting the additional data is to “capture information that could indicate whether institutions of higher education are using race-based preferencing in their admissions processes.”

On March 11, 2026, a multistate coalition filed a lawsuit challenging these new requirements as contrary to law and arbitrary and capricious. According to a press release issued by the California Attorney General, “the coalition is concerned that this unreliable data will be used to initiate costly and harmful investigations and enforcement actions against colleges and universities to further partisan political ends.”

Separately, ED’s Office for Civil Rights (OCR) opened an investigation last year into whether Harvard was disregarding the SFFA decision and continuing to use race as a factor in admissions. In September 2025, OCR announced that it had issued a denial of access letter to Harvard for failing to provide requested admissions data.

Enforcement Has Expanded Beyond Admissions: Scholarships, Partnerships, and Hiring
The Department of Justice and OCR have also expanded enforcement efforts beyond admissions. As described in a prior alert, the Department of Justice’s July 29, 2025 Memorandum titled “Guidance for Recipients of Federal Funding Regarding Ending Unlawful Discriminatory Practices” (DOJ Memo) signaled the administration’s intention to investigate race- and gender-based practices in several areas including scholarships, third-party partnerships, and hiring. Investigations announced by OCR over the last year have been consistent with the DOJ Memo.

For example, OCR announced on February 19, 2026, that it had secured agreement from 31 colleges and universities to end their partnerships with The Ph.D. Project, an organization that allegedly limited participants’ eligibility based on race. OCR has also announced findings that George Mason violated Title VI by using race in university hiring practices, an investigation into whether the Duke Law Journal uses race in the selection of journal members, and investigations into multiple schools for allegedly discriminating based on national origin in awarding scholarships.

The DOJ also launched a Civil Rights Fraud Initiative highlighting the use of the False Claims Act to “investigate and, as appropriate, pursue claims against any recipient of federal funds that knowingly violates federal civil rights laws,” by “promot[ing] divisive DEI policies.” Although the requirement that recipients of federal funds certify that they did not “operate any programs promoting DEI that violate any applicable Federal anti-discrimination laws,” was initially enjoined, the Fourth Circuit recently vacated the preliminary injunction and the General Services Administration has proposed expanding the certification requirement beyond education to include all government contracts.

Public-Facing Materials and Media Reporting Are Frequently the “Entry Point”
While OCR’s enforcement capacity has likely been disrupted by staffing reductions, a network of advocacy organizations continues to pursue DEI-related compliance challenges through complaints, referrals, and litigation. Recent referrals and investigations have often been triggered by publicly accessible materials (including job postings and program/scholarship descriptions), and in some cases OCR has opened directed investigations expressly based on “recent reporting.” Institutions should assume that at least some portion of their public-facing footprint is being systematically monitored.

For example, in February 2026, an Iowa state lawmaker referred three University of Iowa job postings to the state Attorney General after a third-party organization highlighted language referencing “belonging,” “inclusive instructional practices,” and “cultural competency” during a legislative presentation. According to press reports, the referral was based entirely on publicly available job advertisements, underscoring how routine employment postings can become the basis for state-level scrutiny. Similarly, OCR’s announcement of the investigation into the Duke Law Journal was expressly “based on recent reporting” concerning alleged race-based selection criteria. In both instances, the initial trigger was not a confidential complaint or on-site inspection, but material available in the public domain or highlighted through media coverage—reinforcing that universities’ websites, job postings, and program descriptions can function as the entry point for enforcement activity.

Further, civil rights complaints can be submitted to OCR by members of the public. One such complaint was filed in July 2025 regarding the University of Tulsa. It identified several programs, including an admissions goal, several scholarships, and an affinity group. The complaint quoted from several publicly available University webpages.  

A Targeted Compliance Approach: Privileged Exposure Mapping
Schools seeking to reduce enforcement risk may consider conducting a privileged, structured review. In practice, decentralized institutions often lack a centralized inventory of potentially high-risk touchpoints, and outdated or legacy descriptions may remain publicly accessible long after programs have evolved. A structured review helps ensure that leadership has a complete and accurate understanding of institutional exposure.

That said, a months-long, enterprise-wide audit is not always the best first step, especially where decision-makers want a clearer picture of exposure before committing to deeper remediation work. Accordingly, a practical approach many institutions have taken is:

• Phase I (Exposure Mapping/Risk Tiering): a privileged, targeted effort to identify and risk-tier the most visible and most complaint-likely public-facing touchpoints.
• Phase II (Remediation and Programmatic Review): a deeper, privileged review of the highest-risk items and underlying documentation, with options for remediation and governance controls.

This phased approach supports proactive, risk-informed institutional decision-making by creating a structured and defensible assessment of exposure—allowing leadership to address risk on their own timeline rather than in response to an external mandate.

Conclusion
Enhanced reporting on admissions data is happening now and is expected to be used as a tool to identify potential noncompliance with SFFA. At the same time, recent OCR activity reflects attention beyond admissions, including scholarships, hiring, and third‑party partnerships, and investigations may be triggered by public-facing materials and/or media reporting. A targeted, privileged review can help leadership and boards understand current risks, make informed decisions, and create internal alignment across decentralized stakeholders before an external complaint, referral, or investigation sets the agenda.

Pillsbury’s Education Group advises colleges and universities on civil rights compliance, governance risk, and high-stakes investigations. Our experience includes conducting privilege-protected risk assessments, advising boards and senior leadership, and defending institutions in discrimination and Title VI matters. Institutions interested in discussing a targeted Phase I review may contact Jeff Metzler or Sarah Rowan.