A federal requirement that predates most researchers’ attention to it is now showing up as an institutional deadline on campus. Virginia Tech’s research office, for example, has asked all faculty who actively publish or seek external funding to link an ORCID iD to their institutional research-profile system by August 2026, framing it explicitly as compliance with a “federal requirement: digital persistent identifier.” Georgetown, George Washington University, and the University of Kansas have published similar guidance in 2026 tying mandatory ORCID linkage to the same federal policy. None of these are ORCID being nice-to-have anymore — they are institutions translating a federal mandate into an internal deadline ahead of enforcement.
The federal policy behind the deadlines
The underlying requirement traces to NSPM-33, the 2021 National Security Presidential Memorandum on research security, and specifically to the Digital Persistent Identifier (DPI) provisions in its 2022 implementation guidance issued through the National Science and Technology Council. That guidance directs federal research-funding agencies to require researchers to use a persistent identifier meeting a defined set of “common/core” standards — interoperability, uniqueness, persistence, and machine-readability among them — when disclosing affiliations, support, and other information in grant applications and progress reports. As of mid-2026, ORCID iD is the only individual identifier service that agencies recognize as meeting those standards; institutional guidance from DOE, Georgetown, and the University of Kansas all state this plainly.
This is a distinct policy thread from the separate NSPM-33 disclosure requirements (current-and-pending support, biographical sketch, conflict-of-interest reporting) that CASRAI covered in its 18-months-in status report. The DPI requirement is narrower and more mechanical: it is about how a researcher’s identity is captured and linked across systems, not about what they must disclose. In practice the two threads converge, because ORCID is also becoming the source record several agencies pull structured disclosure data from — but a university mandating “get an ORCID iD and link it” is answering the DPI requirement specifically, not the broader disclosure-content requirement.
Three agencies, three enforcement clocks
Individual federal agencies have moved on the DPI requirement at different speeds, which is part of why the campus-level messaging has looked scattered:
- Department of Energy made PID inclusion mandatory for R&D financial-assistance applications effective May 1, 2025, implemented through Financial Assistance Letter FAL 2024-05, with ORCID identified as the only qualifying PID.
- NSF has required ORCID iDs for senior personnel in SciENcv-generated biographical sketches and current-and-pending-support disclosures since submissions due on or after January 30, 2023, though as of mid-2026 NSF has not implemented a hard, submission-blocking validation the way NIH now has.
- NIH moved last but hardest: after a leniency period that ran through May 7, 2026, eRA Commons switched from a warning to a hard submission-blocking error on May 8, 2026, for any application, JIT, RPPR, or prior-approval request where senior/key personnel lack a properly linked ORCID iD. CASRAI covered that enforcement date change in detail in NIH Common Forms Enforcement, May 2026 — that piece is the place to go for the NIH-specific mechanics (SciENcv, eRA Commons linkage, the specific validation failure modes). This piece is about the broader federal DPI push across agencies and how institutions are responding to it, not a duplicate of that NIH-specific story.
The result is that a researcher’s actual deadline depends on which agency funds them, while a university’s research-security and research-computing offices have to support all of them at once — which is a large part of why several institutions have stopped waiting for each agency’s individual enforcement date and set a single, earlier, university-wide ORCID-linkage deadline instead.
Why universities are setting their own deadlines
Waiting for each agency’s enforcement date to force compliance one grant application at a time is operationally expensive: a blocked submission at the deadline is a worse failure mode than a researcher completing ORCID linkage months in advance. Institutional research offices that have published explicit internal deadlines are, in effect, front-loading the compliance work so it happens as routine onboarding and annual-review housekeeping rather than as a last-minute scramble tied to a specific proposal deadline. Virginia Tech’s guidance ties the linkage requirement to its research-information system (Elements); Georgetown and George Washington University have published NSPM-33/DPI-specific guidance pages aimed at faculty and research-administration staff; the University of Kansas requires principal investigators and senior/key personnel to maintain authenticated ORCID profiles with affiliation, funding, and appointment information updated annually, framed explicitly as NSPM-33 DPI compliance.
The common thread across these institutional policies is linking ORCID iDs into whatever current research information system (CRIS) the institution already uses for faculty profiles — Elements, Pure, Symplectic, or a homegrown equivalent — rather than treating ORCID as a separate, unconnected credential a researcher registers once and forgets. That linkage is what lets an institution answer “which of our federally funded researchers has a properly connected DPI” as a query instead of a manual audit.
Why ORCID and not another identifier
The NSPM-33 implementation guidance did not name ORCID specifically; it specified standards a DPI must meet. ORCID iD is, as of mid-2026, the only individual-researcher identifier service that federal agencies and the institutions implementing this guidance recognize as satisfying those standards for the purpose of this requirement — DOE’s own guidance states this directly, as does Georgetown’s and the University of Kansas’s. This is a narrower claim than “ORCID is required by law”: it reflects which identifier the current implementation guidance and agency rollouts have converged on, not a permanent or exclusive designation. Institutions and agencies could recognize additional DPI services in the future if new ones meet the same standards.
What this means for researchers and research offices
For researchers with federal funding, or applying for it, the practical checklist is short but has real consequences for missing it: register an ORCID iD if you do not already have one (registration itself takes under a minute), link it to the institution’s CRIS/faculty-profile system, and link it to any agency-specific system that requires it directly — eRA Commons for NIH, in particular, where the ORCID-to-eRA-Commons link is a distinct step from having an ORCID iD at all. For research-administration offices, the operational task is less about the individual linkage step and more about visibility: knowing which federally funded researchers on the books do not yet have a properly linked DPI, before that gap becomes a blocked submission at a proposal deadline the office does not control.
Frequently asked questions
Is the digital persistent identifier requirement the same as NSPM-33’s disclosure requirements?
No. NSPM-33 covers a broader set of research-security disclosure requirements (current-and-pending support, biographical sketch content, conflict-of-interest and conflict-of-commitment reporting). The digital persistent identifier (DPI) requirement is a narrower, more mechanical piece of the same 2022 implementation guidance: it specifies that researchers must be identified using a persistent identifier meeting defined technical standards, which in practice means an ORCID iD linked into the relevant system. A researcher can be fully DPI-compliant (ORCID linked) while still having disclosure content to fix, or vice versa.
Does every federal agency enforce the DPI requirement the same way?
No. DOE made it a hard requirement for R&D financial-assistance applications from May 1, 2025. NSF has required ORCID iDs in SciENcv-generated biosketches and current-and-pending-support forms since January 2023 but, as of mid-2026, has not implemented a hard submission-blocking check. NIH implemented a hard, submission-blocking validation on May 8, 2026, after a leniency period. Other agencies covered by NSPM-33 (DOD, NASA, USDA, and others) have varying implementation timelines under the same underlying guidance.
Why are universities setting their own ORCID deadlines instead of just waiting for each agency’s date?
A university’s federally funded researchers are typically spread across several agencies, each with its own enforcement date and mechanics. Setting one institution-wide deadline lets the research office front-load ORCID registration and CRIS linkage as routine onboarding and annual-review work, rather than discovering gaps one blocked submission at a time as each agency’s individual deadline arrives.
