USPTO TM Fraud ID QuestionsandResponses 4.29.26.pdf

USPTO Fraud Identification, Unsupervised AI, and Preventing Impersonations RFI - Questions & Responses

Vendor Questions USPTO Responses

I wanted to confirm if the project mentioned above is considered as a potential new requirement or is there an incumbent contract currently performing these services? This is a new requirement.

If there are incumbent vendor(s), would you be able to provide the contract details (such as: Vendor Name, Contract Number, Award and end dates, total contract value)? This is a new requirement with no incumbent vendor(s).

We noticed there is a FedRAMP requirement which we do not have.

Please note that we do not process, store, transmit, or use Federal information; therefore, FedRAMP authorization is not necessary. We only collect and store publicly available information. We comply with commercial data storage requirements, and assessments are available upon request. Are we able to participate in this RFI? Many of our current customers who initially required FedRAMP certification have move forward with them once it was understood that we only store publicly available information.

We conferred with Trademarks, CIO, and cybersecurity regarding this request, and the requirement for FedRAMP authorization remains intact. Although the information may be publicly accessible, it is incorporated into a federal system. Please feel free to evaluate alternative solutions and provide a response, or get a FedRAMP certification.

We have experience supporting secure on-premises, cloud, hybrid, and migration/transition models across federal environments. To help tailor the most relevant response, does USPTO have any preferred or required deployment model constraints for this effort?

FedRAMP SaaS is preferred. USPTO managed data center is not an option.

Should this effort align with any broader Zero Trust, identity modernization, or enterprise security initiatives currently underway at

USPTO?

Yes, the effort should align with all federal security rules, regulations, and priorities.

Can USPTO share additional detail on the current environment and key platforms relevant to this effort?

No, the USPTO is seeking innovative solutions to meet the requirement(s).

Can USPTO elaborate on expectations for explainability, auditability, and review of AI-generated recommendations, alerts, or risk scores? A legally sustainable solution is required.

Given the request for a rough order of magnitude, can USPTO share estimated user populations, filing volumes, transaction volumes, or analyst workloads relevant to solution sizing and pricing assumptions?

A user population of approximately 50. USPTO staffing is currrently very limited so workload remains TBD.

Our solution inherits the FedRAMP certification from AWS since our solution utilizes FedRAMP high-certified AWS components. Will the government accept AWS's FedRAMP certification? No, your solution still needs FEDRAMP authorization.

Does the government have any predisposition on the buy to build continuum? (e.g., [1] Government is seeking only full stack COTS solutions inclusive of data platform, analytics, case tracking, etc;

[2]Government is seeking a fully bespoke solution built for purpose; [3] the Government is seeking a platform-based solution with advanced flexibility in user experience; [4] the Government is agnostic at this RFI phase and looks forward to our best recommendation(s))?

The USPTO has an established “buy-vs.-build” acquisition strategy. The agency would prefer that vendors follow that approach as a primary guide for success. However, there will always be situations where a

COTS/SaaS/PaaS/IaaS/CaaS option does not exist and the desired capability must be developed outright. The USPTO expects any responding vendor to use its best judgement to make the most appropriate offer to answer the question in the problem statement.

11 What is the current process for analyzing documents for fraud?

If a USPTO.gov account is filing a high volume of unauthorized filings (such as CARs and REAs), forms in which attorney credentials are misused, or is engaging in other serious or rapid filing behavior, RPO has SOPs to shutdown accounts. In some cases, private attorneys alert us that their credentials are being misused, or customers identify filings submitted on their behalf by bad actors. We review meta data to identify connections between suspicious accounts and filings. In other cases, documents on their face appear digitially altered or fake, and some display connections to fraudulent websites. Due to capacity constraints, the USPTO does not currently monitor accounts or review documents for fraud unless and until they are brought to our atttention by external or internal sources.

What are your existing tools for fraud detection? Would you expect to integrate across these tools or replace them?

Trademarks currently employs an anomoly detection tool and is working on a risk predictor. Augment or replace are both viable solutions.

Are current examples of fraudulent documents currently in structured formats? Is there an interest in structuring these documents to train a potential AI solution?

Documents are in both structured and unstructured format; yes, the USPTO would be interested

How do you track and store data regarding past confirmed fraud cases or scam? Is there a repository of documents with this information that could be used for training an AI model?

USPTO tracks and stores through various means; USPTO will provide sample data.

15 Is there a need to consolidate information/data from different sources? Consolidation would be a viable solution.

For the Fraud Identification Process explained on Page 5, what technology is currently being used? How do you currently flag anomalous filing and decide to suspend accounts? How do you currently validate attorney’s credentials?

USPTO currenty identifies patterns and incidences of inaccurate, false and fraudulent submissions through various internal systems. USPTO has Standard Operting procedures (SOPs) to shutdown accounts. USPTO utilizes

ID.me for account identiy verification. USPTO has not yet implemented an attorney credential validation procedure.

17 Do you currently have a process that identifies AI generated applications? No system currently exists.

What are the specific integration requirements for USPTO's existing systems? Which backend systems must the solution integrate with (Okta, Finance, USPTO.gov accounts, TMEP)? Are APIs available, or will custom integration be required? What data formats and protocols are currently in use?

The USPTO cannot generally answer this question as answers depend on the proposed solution(s).

For the "no black box" transparency requirement (Section II), what level of explainability is required? For example, should the proposed solution provide: Human-readable audit trails for each decision, real-time explanations accessible to examining attorneys, compliance with specific

AI explainability frameworks?

A legally sustainable solution is required. Every output listed would be acceptable.

Are there specific AI governance frameworks or standards USPTO requires compliance with (e.g. NIST AI Risk Management Framework - AI

RMF, ISO/IEC 42001 - AI Management System, OMB guidance on AI use in federal agencies)?

Compliance is required on requirements specified in all active Executive Orders, and OMB Mandates. This includes preference for American-built AI models, monitoring for bias etc.

Regarding FedRAMP certification (Section V), will "FedRAMP-ready" status suffice for Stage One, or must vendors already hold active

FedRAMP authorization at a specific impact level (Low, Moderate, High)?

The USPTO will consider solutions that have already achieved FedRAMP ready status.

Does USPTO expect vendors to provide a comprehensive AI governance framework as part of the solution, or does USPTO plan to manage AI governance internally? If vendor-provided, what specific governance capabilities are required: model registry and versioning, bias detection and fairness monitoring, performance monitoring and drift detection, audit trail generation and compliance reporting?

The USPTO is not seeking a comprehensive AI governance framework as part of this RFI. The USPTO does expect ultimate solutions to be legally sustainable.

For each of the three project areas (Fraud Detection, Unsupervised AI

Detection, Impersonation Detection), what is the expected balance between automated AI decisions and human review (e.g. AI recommendations with mandatory human approval, 2) automated decisions with human oversight/audit)?

Output one initially with output two being the desired end state.

What are USPTO's requirements for ongoing AI model monitoring, performance reporting, and accountability (e.g. real-time performance dashboards, automated alerts for model drift or performance degradation, regular audit reports “monthly, quarterly”)?

Solution dependent and USPTO expects vendors to propose these types of requirements (explainable and transparent) as part of any solution.

What data will be made available to vendors for 1) training and testing

AI/ML models during development, 2) prototype demonstration in Stage

Two, 3) historical fraud cases for model validation? Trademarks will provide sample data.

Are there specific data privacy, PII handling, or data residency requirements beyond FedRAMP that vendors must address? Yes, NIST 800-53.

Can vendors access production USPTO.gov account data, Okta logs, and

Finance transaction data during the sandbox/evaluation phase, or will synthetic/anonymized data be provided? No.

What are the specific "pendency targets" and "quality targets" mentioned in Section II that solutions must not exceed? Can you provide current average pendency times for trademark examination, acceptable quality score ranges, and false positive/negative tolerance levels for fraud detection?

Current "first action" pendency: 4.45

Current "disposal" pendency: 10.03 months

Current "first action" quality: 96.8%

Current "disposal" quality: 98.4%

Tolerance levels TBD - Pendency and Qualtiy targets are dependent on the work process and are set at the beginning of each fiscal year. For example, the FY26 examination first action pendency target is between 2.5 to

5 months, with a total (disposal) pendendency of 11 months. Quality metrics for examination states that 95.5% of first action cases are compliant with quality standards, while 97% of final actions are compliant. The expect that greater than 50% of all cases disposed of would have

"Excellent" quality. At this time, false positive/negative tolerance levels do not exist for fraud detection since they would be determined partially by the method being used and the business risk management plan.

For Requirement 2 (high-risk application identification), what is the expected: precision and recall for fraud detection, and volume of applications to be processed daily/monthly?

1) precision and recall depends upon solution;

2) New applications annually: 700K

3) Post-registrations annually: 300K

What constitutes "without affecting pendency" for diverted high-risk applications (Requirement 2)? Is additional processing time acceptable for flagged cases?

This is a reference to current USPTO processes for held applications, where applications in certain statuses do not impact pendency numbers.

Are vendors expected to address all three project areas (Fraud

Identification, Unsupervised AI, Discovering Impersonations) in a single integrated solution, or can vendors propose solutions for individual areas?

No, vendors can propose a separate solution for each individual area.

Within each project area, are all requirements equally prioritized, or are certain requirements (e.g., attorney credential validation vs. credit card fraud detection) higher priority? All requirements are equally prioritized.

For the attorney credential validation (Fraud Identification Requirement

3): How many state bar associations must be integrated? Are APIs available from state bars, or will screen scraping/manual verification be required? All state bar associations should be integrated.

What are the expected SLA requirements for system availability/ uptime, response time for fraud detection, and customer validation tool response time? To be determined based upon solution capabilities.

What constitutes a "sandbox environment" for USPTO staff evaluation

(Table 3, item vii): cloud-based demo environment, on-premise installation, and the expected number of USPTO users for hands-on evaluation? Vendor provided sandbox environment.

For the Stage Two prototype demonstration, what specific use cases or scenarios should the prototype address? will USPTO provide test data, or should vendors use synthetic data? Trademarks will provide sample data.

What is the anticipated contract duration and total budget range for this effort? Contract duration and budget have yet to be determined.

Are there separate budgets for each of the three project areas, or a single combined budget?

Depends on the selected solution. If a single vendor can provide a complete solution, one. If not, up to three.

For the ROM estimate in Stage One, what assumptions should vendors make regarding for 1) transaction volumes, 2) number of users, 3) data storage requirements, support and maintenance duration?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

2) approximately 50 users

3) TBD

What is the anticipated format for the vendor demo in Phase II? Does government plan to provide data or scenarios for the demo? Will it be a live, recorded, or hand-on testing event?

Trademarks will provide sample data; vendor choice for demontrations.

Please provide USPTO's definition for "FedRAMP-ready." What will be considered acceptable documentation to certify a "FedRAMP-ready" capability?

To achieve the FedRAMP Ready designation, a CSP must work with a FedRAMP recognized 3PAO to complete a

Readiness Assessment of its service offering. The Readiness

Assessment Report (RAR) documents the CSP's capability to meet federal security requirements.

https://www.fedramp.gov/docs/rev5/playbook/csp/author ization/agency-authorization-path/

The RFI states that the vendor will "maintain the information technology infrastructure necessary," which suggests the vendor will operate in an infrastructure as a service capacity. Are there plans to migrate the capability to USPTO owned and maintained infrastructure? Will the capability need to undergo agency ATO? There is no plan for on-prem migration.

43 What is the volume of filings on a daily/weekly/monthly basis?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

Each work process has unique submission volumes. In fiscal year 2025 and 2026 to date, initial applications are averaging around 52,000 per month, and 12,000 per week.

When anomalous filing behavior is identified, will vendor or USPTO be responsible for conducting alert review? Trademarks will be accountable.

Will data for previously identified scams, account data, application data, Okta logs, and Finance data be exportable to vendor infrastructure?

What is the format of the data listed (structured/unstructured)? Yes, to the extent possible. And both.

What is the population of the backlog of account holders with attorney user role?

There are approximately 45-50K attorney roles. Of those, 21K have cleared verification.

When potential match for attorney credential is identified, will vendor or

USPTO be responsible for conducting alert review? Trademarks will be accountable.

Is the process for attorney credentials validation expected to happen during the account opening, or will it be a daily/weekly process?

The current process lags the account opening by several days. Current process: attorney creates an account, it goes into a queue, and it gets approved or requires further action.

When potential accounts are flagged based on account creation data, will vendor or USPTO be responsible for conducting a review? Trademarks will be accountable.

Is the account creation data available in a structured database that can be shared with the vendor? Further, how many years of account creation data is available for analysis?

Yes, but it will be shared after the award is made. 10+ years of uspto.gov account creation data is available.

When potential transactions are flagged for fraud, will vendor or USPTO be responsible for conducting a review? Trademarks will be accountable.

Is the process for flagging potential card fraud expected to happen real time (at the time of transaction) or will it be a daily/weekly process? As close to real-time as possible.

Does USPTO store any communications from credit card issuers (banks) with regards to fraud flagged / investigated by them?

RPO does not store this information, but we work with

Finance when credit cards are flagged; this question is best suited for them.

For flagging filings based on accuracy of case law citations and summaries, should the tool simply provide a flag or including confidence score and supporting evidence for flagging the filing? As much as can be provided and iterated over time

Are there any labeled examples for "Bad Law" (known AI specimens / known hallucinated citations) for calibration and acceptance testing? USPTO has examples that can be provided at a later date.

Recommend USPTO consider use of NAICS code 541611 given the effort will require consultative services and not just software to be executed effectively. Received and acknowledged.

Does the solution have to be a FedRAMP SaaS, or can it be a in-boundary solution with an agency FedRAMP v5 ATO?

FedRAMP SaaS and agency ATO on the FedRAMP solution go hand in hand. Agency ATO is an option, if USPTO chooses a custom solution that will deploy within a USPTO managed cloud environment.

58 Is this a single-tenant or multi-tenant deployment? TBD based on proposed solution(s).

Who is the Authorizing Official (AO), and has an existing System Security

Plan (SSP) been started?

USPTO is the Authorizing Official. Vendors should assume that a SSP for this work has not been started.

60 How many named users are expected at launch and at 12 months?

A user population of approximately 50. USPTO staffing is currrently very limited so workload remains TBD.

What is the expected submission volume per day and is there a SLA on time to analyze the fraud risk?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

2) SLA TBD

62 Is there a backlog to be processed at launch? If so, how large?

1) Holding docket backlog: 25K

2) Unexamined inventory backlog: 245K

3) Post-reg inventory: 143K

63 What is the target go-live date? This has yet to be determined.

64 Is this fixed-price, time-and-materials, or SaaS/subscription?

This has not been determined yet. The USPTO is conducting market research.

65 What is the rough budget range the client has allocated? This has yet to be determined.

66 Is auto-scaling required, or is a fixed instance acceptable? Fixed to begin.

67 What contract vehicle applies — GSA Schedule, SEWP, BOSS, or direct?

This has not been determined yet. The USPTO is conducting market research.

68 Will the Government allow for live demos on the solution? Yes.

Are there target SLAs for processing or response times for each requirement? To be determined. The vendor will not be responsible.

Does the USPTO intend to provide anonymized training datasets of

"previously identified scams" and "known common data elements" to vendors invited to Stage Two to help refine AI risk predictors? Yes, to the extent possible.

Will vendors be granted real-time API access to "Okta logs and Finance data" during the prototype "bake-off," or should the solution be designed for retrospective log analysis? Trademarks will provide sample data.

Regarding the automated validation of attorney credentials, will the

USPTO provide centralized API access to state bar association databases, or is the vendor responsible for establishing independent data-sharing agreements with each individual state bar? To be determined. The vendor will not be responsible.

Does the USPTO have preferred accuracy thresholds or specific forensic benchmarks for distinguishing between authentic "specimens of use" and high-fidelity AI-generated imagery? The USPTO does not have these.

To satisfy the requirement that "Black box solutions will not be accepted," what is the required technical format for the records that will be generated for the "prosecution history" of an application?

The vendor can propose a non-proprietary format for

USPTO’s consideration.

Given the 2026 transition to FedRAMP 20x standards, will the USPTO accept "In-Process" status for specific new AI modules if the core cloud infrastructure is already FedRAMP authorized? Yes.

Will the USPTO provide a dedicated testing environment (sandbox) containing mock application data, or are vendors expected to host the entire demonstration environment on their own infrastructure? No, vendors are expected fully manage the demo.

To address Requirement 1 (account monitoring) and Requirement 2 (risk prediction), what are the anticipated data volumes and velocity for the

USPTO.gov account logs, Okta logs, and Finance data that the solution must ingest for real-time anomalous behavior detection

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

2) Okta logs and finance data accessibility TBD

The office receives approximately 5,000 submissions per day. The data volume will correspond to the data collected within our systems for those submissions.

For the citation verification and AI-generated specimen detection requirements, is USPTO open to solutions that leverage semantic similarity search and retrieval-augmented generation approaches, or is there a preference for a specific technical methodology The USPTO would be interested.

Hybrid and Multi-Cloud Architecture: The RFI asks for a recommended solution model (cloud vs. on-premise); Does USPTO have an existing cloud infrastructure preference or data residency requirement that should inform the recommended deployment model?

FedRAMP SaaS is preferred. USPTO managed data center is not an option.

Automated Credential Validation: Regarding Requirement 3 (attorney credential validation), will USPTO provide a structured data feed or API access to state bar association records, or should vendors propose integration approaches to third-party accreditation databases?

USPTO does not maintain integration with any state bar association data sources.

Cross-Project Correlation: While there are three distinct project areas, is the USPTO interested in a unified platform capable of correlating data across all three (e.g., linking a fraudulent credit card transaction in Project

1 to an AI-generated specimen in Project 2)? The USPTO would be interested in a combined solution.

Among the three detection targets in Requirement 1 — accuracy of case law citations, accuracy of publicly available facts, and AI-generated specimens of use — does USPTO have a relative priority? We want to ensure our proposed approach addresses the most pressing concern first

The order is (1) accuracy of case law citations (2) identifying

AI-generated specimens and (3) accuracy of publicly available facts.

Does USPTO have an existing labeled corpus of trademark submissions that have already been flagged as AI-generated or unsupervised-AI-produced through RPO's manual review process? Even a small labeled dataset would meaningfully shape the detection methodology. Trademarks will provide sample data.

What is the approximate daily volume of trademark filings and responses that would need to pass through the detection pipeline? And what latency is acceptable — must a flag be surfaced before an examining attorney opens a file, or is overnight batch enrichment acceptable?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

2) Latency TBD

What is the intended customer experience for the validation tool — would a customer upload or paste a suspicious communication into a self-service portal on USPTO.gov, or is the vision a more proactive, automated scanning capability on inbound channels?

USPTO applicants and registrants will not be expected to provide materials.

What types of communications are most commonly used in impersonation scams — email, physical mail, phone, text? Is there a breakdown from the TMScams mailbox?

All methods of communication/contact are used to perpetrate impersonation scams.

Does USPTO have a corpus of confirmed impersonation communications collected through TMScams@uspto.gov or other channels that could be made available to vendors for model development or testing purposes?

The USPTO has samples of impersonation communications reported to the USPTO TMScams@uspto.gov mailbox, which can be redacted to remove PII and shared. In addition, the USPTO's Examples of fraudulent or misleading solicitations page for publicly available documents:

https://www.uspto.gov/trademarks/protect/examples-fraudulent-misleading-solicitations

What's your current data platform landscape — do you have an existing

SIEM, log management, or data warehouse that we'd need to integrate with or displace?

Yes to integration depending on the solution, no to displacement. Leveraging existing USPTO technology is desireable, assume USPTO has existing SIEM, log management, and data warehouse technology to leverage, rather than duplicate.

Are you planning to award this as a single vehicle covering all three project areas, or do you see them potentially splitting into separate contracts?

A single solution is acceptable as are independent solutions.

What's your rough timeline from Stage One to contract award? And is there an existing budget ceiling you're designing against?

This is all to be determined. The agency's goal is to award a contract during the 4th Quarter of FY26 or the 1st Quarter of FY27.

Are you open to a proof-of-concept or sandboxed evaluation (Stage Two bake-off) against live USPTO filing data, or would it need to be synthetic? The USPTO would be interested.

The RFI requires FedRAMP certification. Given that the solution will process attorney PII, financial transaction data, and potentially applicant data, is USPTO targeting FedRAMP Moderate or FedRAMP High as the required impact level for this effort?" FedRAMP moderate is acceptable.

Our company currently has products listed as FedRAMP Ready on the

FedRAMP Marketplace and intends to pursue full FedRAMP authorization for future enhancements. Can the USPTO confirm whether this is sufficient to meet participation eligibility requirements? Yes.

For solutions that are not cloud-based, can the USPTO confirm whether alternative security authorization frameworks would be considered acceptable? It depends on the solution.

Does the USPTO currently utilize AI tools to support the functions described in this RFI? If so, can it share which products or solutions are in use?

The USPTO does not currently utilize AI tools to support these functions.

With respect to the “Unsupervised AI: Uncovering ‘Bad Law’” workstream, can the USPTO confirm whether it is seeking tools that:

Identify case law citations that cannot be validated through a legal citator; and Assess whether legal summaries accurately reflect the underlying case law?

The USPTO is seeking the best capability available. And yes, both would be ideal.

With respect to summarization requirements, are summaries of cases and code sections required? Are there other summary types that are necessary? Summaries are desired but not required.

What levels of editorial review and quality control do you require for legal content to be used in high stakes USPTO projects and decision making?

AI shall not be used in place of the attorney’s legal decision making. USPTO will be using AI to create packets or summaries of information as background; the bar is very high.

Can the USPTO clarify whether RFI 135-0035-26 (Examination and

Attorney Assistant Examination Quality Review) and RFI 135-0034 (Fraud

Identification, Unsupervised AI, and Preventing Impersonations) are intended to be separate efforts, or whether they are related and may form part of an integrated or single future requirement? These are separate efforts and requirements.

In relation to Section IV (Target Concerns and Requirements, Requirement 1), does the USPTO currently maintain defined filing behaviours and thresholds for what constitutes anomalous activity? The USPTO has an Anomalous Behavior Analysis Tool.

In relation to Section IV (Requirement 2), can the USPTO provide examples of common data elements associated with previously identified scams? Trademarks will provide sample data.

In relation to Section IV (Requirement 2), how are Okta logs currently used to identify or assess risk? They are not curently used.

With respect to Section V (Functional Areas), our solutions supporting these requirements are currently hosted in our own data centres. Would the USPTO consider alternative security standards, such as NIST 800-171, in place of FedRAMP? No.

How important is scalability and continuous development of AI technology?

Scalability is important in terms of meeting the business outcomes necessary for TM operations. Continuous

Development, Security, and Operations are very important in terms of continus improvement and sound IT operations.

105 How critical is a secure AI environment to you? Security is paramount.

Do you need to integrate with a Document Management System or other internal systems? Interoperability is desireable.

Is API access a requirement? Are there existing systems or APIs that solutions should integrate with to enable seamless adoption? Depends on the proposed solution.

108 What is the targeted user onboarding and rollout timeframe? To be determined.

What is the volume of files you expect to process though the AI system on a daily, weekly basis?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K

Will any internal files be manually uploaded to a Lexis vault or system, or do you require integration with a third-party tool to retrieve these files? There is no third-party requirement.

What type of information do you expect to upload, store or process through the system? A)PII B)PHI C)Trade Secrets D)Copyrighted material etc.

All categories of listed sensitive information (+SPII) could be filed and uploaded into the system by external users.

Do you have any specific USPTO security requirements and guidelines, outside of FedRAMP/ NIST framework, that the vendor would be required to comply with?

The USPTO follows all federal rules, regulations, policies, etc.

Does the USPTO intend to award a single vendor across all solution areas, or is there an option to award separate vendors for individual requirements?

A single solution is acceptable as are independent solutions.

Does the USPTO see additional value in a single vendor delivering across all three solution areas?

A single solution is acceptable as are independent solutions.

Can the Government share additional detail or documentation regarding the current processes and systems used when processing trademarks?

Additionally, can the USPTO share which technology is currently used to perform the tasks outlined in Section IV? To be determined.

For vendors selected to move to Stage 2 and beyond, will the

Government conduct discovery session(s) to allow vendors to adjust planned solutions and integrations for the USPTO environment? Such a request would be considered by the USPTO.

Can the Government share a timeline that industry can expect for

Stages 2 - 4? There is no timeline yet established.

Can USPTO share your desired timelines for a full solution pilot to launch and to be completed for any awarded contracts?

The USPTO has a goal to award this contract in the 4th quarter of FY26 or the 1st quarter of FY27.

Can USPTO share your desired timelines for a full solution pilot to launch and to be completed for any awarded contracts?

The USPTO has a goal to award this contract in the 4th quarter of FY26 or the 1st quarter of FY27.

Per RFI Section VI Table 3, vii, USPTO describes vendors establishing a sandbox for evaluation. For Stage 2 demos, what type of data and/or source integration(s) should Industry expect they would need to feature in a sandbox preview for evaluation?

Depends on the solution and vendors should focus on using publically available date for demos. USPTO source integration will not be available for demos.

Per Section IV Fraud Identification, Suppression, and Defeat, Requirement

3, USPTO's RFI states a requirement to "automate validation of an attorneys’ credentials with state bar associations." Can the Government confirm that USPTO currently maintains integration with state bar association data sources?

USPTO does not maintain integration with any state bar association data sources.

Per RFI Section IV, Unsupervised AI: Uncovering "Bad Law", Requirement

1, can the Government clarify if you already have examples of a) good and b) known-to-be-fraudulent submission and specimens that vendors could use as training data? Trademarks will provide sample data.

Can the Government provide the anticipated volume of submissions that a solution would need to process?

1a) New applications annually: 700K

1b) Post-registrations annually: 300K