14-01 RFP 745-26-P33 AI Governance and Monitoring Platform.pdf

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

210.562.6200 | https://uthscsa.edu | https://wp.uthscsa.edu/purchasing/

REQUEST FOR PROPOSAL

OGC Template 0525

REQUEST FOR PROPOSAL

by

The University of Texas Health Science Center at San Antonio for

Selection of a Vendor to Provide

AI Governance and Monitoring Platform

RFP No. 745-26-P33

Submittal Deadline:

3:00 PM – Central Prevailing Time – Friday, April 3, 2026

Issued: 8:00 AM – Central Prevailing Time – Tuesday, March 10, 2026 https://uthscsa.edu/ https://wp.uthscsa.edu/purchasing/

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

TABLE OF CONTENTS

SECTION 1: INTRODUCTION

SECTION 2: NOTICE TO PROPOSER

SECTION 3: SUBMISSION OF PROPOSAL

SECTION 4: TERMS AND CONDITIONS

SECTION 5: SPECIFICATIONS AND ADDITIONAL QUESTIONS

SECTION 6: PRICING AND DELIVERY SCHEDULE

ATTACHMENTS:

APPENDIX ONE: PROPOSAL REQUIREMENTS

A01A – Appendix One, Section One – General Information A01B - Appendix One, Section Two – Execution of Offer A01C – Appendix Three, Section Three – General Questionnaire A01D – Appendix Four, Section Four – Addend Checklist

APPENDIX TWO: SAMPLE AGREEMENT

APPENDIX THREE: HUB SUBCONTRACTING PLAN

APPENDIX FOUR: RISK ASSESSMENT

APPENDIX FIVE: TX-RAMP NOTICE

APPENDIX SIX: POLICY DRIVEN ADOPTION FOR ACCESSIBILITY

(PDAA) VENDOR ASSESSMENT

APPENDIX SEVEN: BUSINESS ASSOICATE AGREEMENT (BAA)

APPENDIX EIGHT: AI PLATFORM REQUIREMENTS

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

SECTION 1

INTRODUCTION

1.1 Description of University

The University of Texas Health Science Center at San Antonio — also called UT Health San Antonio (UTHSA) — has a mission to make lives better through excellence in education, research, health care and community engagement. As the largest academic research institution in South Texas, reflected by an annual research portfolio of approximately $413 million, the university is designated as a Hispanic-Serving Institution by the U.S. Department of Education.

UT Health San Antonio’s professional schools of medicine, nursing, dentistry, health professions, graduate biomedical sciences and public health have graduated more than 43,886 alumni who are leading change, advancing their fields and renewing hope for patients and their families throughout South Texas and the world.

One of 14 UT System institutions, UT Health San Antonio has launched the newest of its six schools, the UT School of Public Health San Antonio. Now enrolling students into its Master of Public Health program, this school’s primary focus will be preparing its graduate students for developing and enacting public health policy that serves, specifically, the communities of South Texas.

Another significant reflection of UT Health San Antonio's phenomenal growth is its $472 million UT Health San Antonio Multispecialty and Research Hospital, which opened in December 2024.

The hospital will deliver specialty surgeries and advanced cancer care while focusing on enhancing access to advanced medical care, specialized oncology services and clinical trials for patients throughout South Texas.

For three years in a row, UT Health San Antonio has made Forbes' list of Best-in-State health services employers, and its schools of medicine, nursing and health professions rank in the nation’s top 50 by U.S. News & World Report.

The university employs a diverse workforce of more than 8,500; administers an annual operating budget of $1.46 billion; and stewards’ clinical practices in medicine, cancer, dentistry, nursing and other health professions that provide more than 2.6 million patient visits each year. It is a primary driver of San Antonio’s $44.1 billion health care and biosciences sector. UT Health San Antonio plans to add more than 1,500 higher-wage jobs over the next five years to serve San Antonio, Bexar County and South Texas.

To learn about the many ways “We make lives better®,” visit UTHealthSA.org.

https://www.uthscsa.edu/ https://uthscsa.edu/?utm_source=uthealthsaorg&utm_medium=pageredirect&utm_campaign=uthealthsa

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

1.2 Background and Special Circumstances

UTHSA is a large academic health and research institution that is committed to advancing education, clinical care, research, and innovation. As Artificial Intelligence (AI), machine learning (ML), and generative AI tools are increasingly adopted across administrative, research, clinical, and academic functions; UTHSA requires a comprehensive framework to ensure AI systems are deployed responsibly, ethically, securely, and in compliance with regulatory and accreditation standards.

UTHSA currently utilizes multiple AI-enabled tools across departments, including generative AI assistants, predictive analytics platforms, research algorithms, and vendor-provided AI modules embedded within enterprise systems (e.g., ERP, EHR, CRM). The rapid adoption of AI technologies – both centrally approved and user-produced – creates governance challenges related to data privacy, cybersecurity, bias mitigation, model transparency, auditability, regulatory compliance, and institutional risk exposure.

This RFP seeks proposals for a comprehensive AI Governance and Monitoring Platform and associated services that will enable UTHSA to establish centralized oversight, risk classification, policy enforcement, performance monitoring, lifecycle management, and audit readiness across all AI use cases. Solutions MUST support healthcare and higher education regulatory environments (e.g., HIPAA, FERPA, FDA considerations, state privacy laws, and emerging AI regulations).

No Guarantee of Volume. UTHSA does not solicit or guarantee any specific amount of compensation, volume, minimum, or maximum amount of Services under this RFP or any contract or agreement resulting from this RFP.

Multi-Award. UTHSA reserves the right to multi-award this RFP.

1.3 Objective of Request for Proposal

The University is soliciting proposals in response to this Request for Proposal RFP 745-26-P33 from qualified proposers to provide operational guidance services (the “Services”) for AI Governance and Monitoring Platform Services are more defined in Section 5 (Scope of Work) of this RFP.

1.4 Group Purchase Authority

Texas law authorizes institutions of higher education (defined by §61.003, Education Code) to use the group purchasing procurement method (ref. §§51.9335, 73.115, and 74.008, Education Code). Additional Texas institutions of higher education may therefore elect to enter into a contract with the successful Proposer under this RFP. In particular, Proposer should note that University is part of The University of Texas System (UT System), which is comprised of fourteen institutions described at http://www.utsystem.edu/institutions. UT System institutions routinely evaluate whether a contract resulting from a procurement conducted by one of the institutions might be suitable for use by another, and if so, this RFP could give rise to additional purchase volumes. As a result, in submitting its proposal, Proposer should consider proposing a pricing model and other commercial terms that take into account the higher volumes and other expanded opportunities that could result from the eventual inclusion of other institutions in the purchase contemplated by this RFP. Any purchases made by other institutions based on this RFP will be the sole responsibility of those institutions.

http://www.statutes.legis.state.tx.us/Docs/ED/htm/ED.61.htm#61.003 http://www.statutes.legis.state.tx.us/Docs/ED/htm/ED.51.htm#51.9335 http://www.statutes.legis.state.tx.us/Docs/ED/htm/ED.73.htm#73.115 http://www.statutes.legis.state.tx.us/Docs/ED/htm/ED.74.htm#74.008 http://www.utsystem.edu/institutions

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

1.5 Public Information

All information, documentation, and other materials submitted in response to this solicitation are considered non-confidential and/or non-proprietary and are subject to public disclosure under the Texas Public Information Act (Texas Government Code, Chapter 552.001, et seq.) after the solicitation is completed.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.552.htm

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

SECTION 2

NOTICE TO PROPOSER

2.1 Submittal Deadline

University will accept proposals submitted in response to this RFP until 3:00 PM Central Prevailing Time, Friday, April 3, 2026 via our e-Procurement Website Euna (formally Bonfire).

2.1.1 When submitting your proposal – follow the directions in Euna.

1. Each document that is required must be submitted individually, completed, and signed (if applicable). DO NOT UPLOAD ALL FILES TOGETHER

2.1.2 If during your submission, you encounter any technical issues – you must contact Euna Support directly for assistance or by calling 1-844-226-3862

1. After contacting Euna, inform the Strategic Sourcing Specialist that you have reached out to Euna due to technical issues.

2.1.3 Euna offers a Help Forum which you can access by clicking here.

2.2 RFP Contact Information and Questions

2.2.1 Interested parties MUST direct questions (ALL QUESTIONS MUST GO THROUGH Euna) about this RFP through Euna Opportunity Q&A.

Located in the Project Details (see below).

https://uthscsa.bonfirehub.com/portal/?tab=openOpportunities https://uthscsa.bonfirehub.com/portal/?tab=openOpportunities https://uthscsa.bonfirehub.com/portal/?tab=openOpportunities mailto:support.bonfire@eunasolutions.com mailto:support.bonfire@eunasolutions.com https://uthscsa.bonfirehub.com/portal/support https://uthscsa.bonfirehub.com/portal/support

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

University instructs interested parties to restrict all contact and questions regarding this RFP to written communications delivered (i) in accordance with this Section on or before 3:00 PM Central Prevailing Time, Friday, March 20, 2026 (Question Deadline), or (ii) if questions relate to Historically Underutilized Businesses, in accordance with Section 2.5.

University will provide responses as soon as practicable following the Question Deadline.

University intends to respond to all timely submitted questions. However, University reserves the right to decline to respond to any question.

If submitting multiple questions, submit them in one submission (not multiple submissions).

2.3 Criteria for Selection

The successful Proposer, if any, selected by University through this RFP will be the Proposer that submits a proposal on or before the Submittal Deadline that is the most advantageous to University. Contractor means the successful Proposer under this RFP.

Proposer is encouraged to propose terms and conditions offering the maximum benefit to University in terms of (1) service, (2) total overall cost, and (3) project management expertise.

The evaluation of proposals and the selection of Contractor will be based on the information provided in the proposal. University may consider additional information if University determines the information is relevant.

University reserves the right to award a Contract for all or any portion of the requirements proposed by reason of this request, award multiple Contracts, or to reject any and all proposals if deemed to be in the best interest of the University and to re-solicit for proposals.

Criteria to be considered by University in evaluating proposals and selecting Contractor, will be these factors:

2.3.1 Threshold Criteria Not Scored

A. Ability of University to comply with laws regarding Historically Underutilized Businesses; and

B. Ability of University to comply with laws regarding purchases from persons with disabilities.

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

2.3.2 Scored Criteria

A. Cost of goods and services (30 Points).

1. Evaluation will consider the proposed fee structure, including contingency models, fixed fees, or hybrid approaches. Including options for a proof of concept period is preferred. Competitive and transparent pricing that aligns payment with performance outcomes is preferred.

B. Reputation of the Proposer and of the Proposer's goods or services (20 Points).

1. Vendors should demonstrate a proven track record with similar institutions and missions. References from comparable institutions, particularly academic universities, academic medical centers or large health systems, are encouraged.

C. Quality of the Proposer's goods or services (20 Points).

1. Proposers must demonstrate quality implementation, training, and ongoing support and services. Risks that could jeopardize obtaining longer term governance and AI monitoring will be taken into consideration.

D. Extent to which the goods or services meet the University's needs (25 Points).

1. Seeking a solution and ongoing support that can support AI governance and monitoring needs while integrating with existing workflows and systems. The proposer should illustrate how their technology, staff expertise, and methodology address our goals for evolving AI governance and the outlined requirements.

E. Proposer’s exceptions to the terms and conditions set forth in Section 4 (5 Points).

1. Vendors should review and either accept or clearly document any exceptions to the University’s standard contractual terms. Minimal exceptions are preferred to expedite contract execution and compliance review.

2.4 Key Events Schedule

Date RFP Issued 8:00 AM Central Prevailing Time, Tuesday, March 10, Question Deadline 3:00 PM Central Prevailing Time, Friday, March 20, 2026 (ref. Section 2.2)

Submittal Deadline 3:00 PM Central Prevailing Time, Friday, April, 3, 2026 (ref. Section 2.1)

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

2.5 Historically Underutilized Businesses

2.5.1 All agencies of the State of Texas are required to make a good faith effort to assist historically underutilized businesses (HUBs) in receiving contract awards. The goal of the HUB program is to promote full and equal business opportunity for all businesses in contracting with state agencies. Pursuant to the HUB program, if under the terms of any agreement or contractual arrangement resulting from this RFP, Contractor subcontracts any Work, then Contractor must make a good faith effort to utilize HUBs certified by the Procurement and Support Services Division of the Texas Comptroller of Public Accounts.

Proposals that fail to comply with the requirements contained in this Section 2.5 will constitute a material failure to comply with advertised specifications and will be rejected by University as non-responsive. Additionally, compliance with good faith effort guidelines is a condition precedent to awarding any agreement or contractual arrangement resulting from this RFP. Proposer acknowledges that, if selected by University, its obligation to make a good faith effort to utilize HUBs when subcontracting any Work will continue throughout the term of all agreements and contractual arrangements resulting from this RFP. Furthermore, any subcontracting of Work by the Proposer is subject to review by University to ensure compliance with the HUB program.

2.5.2 University has reviewed this RFP in accordance with 34 TAC §20.285, and has determined that subcontracting opportunities are probable under this RFP.

2.5.3 A HUB Subcontracting Plan (HSP) is a required part of the proposal. The HSP will be developed and administered in accordance with University’s Policy on Utilization of Historically Underutilized Businesses, attached as APPENDIX THREE.

Each Proposer must complete and return the HSP in accordance with the terms and conditions of this RFP, Including APPENDIX THREE. Proposers that fail to submit the HSP will be considered non-responsive to this RFP as required by §2161.252, Government Code.

Questions regarding the HSP may be directed to:

Contact: Rebecca A. Mendez, HUB Program Manager Phone: 210-562-6300 Email: HUBAdmin@uthscsa.edu

OR

Contact: Mary Minier, HUB Specialist Phone: 210-562-6326 Email: HUBAdmin@uthscsa.edu

Contractor will not be permitted to change its HSP unless: (1) Contractor completes a new HSP in accordance with the terms of APPENDIX THREE, setting forth all modifications requested by Contractor, (2) Contractor provides the modified HSP to University, (3) University approves the modified HSP in writing, and (4) all agreements resulting from this RFP are amended in writing to conform to the modified HSP.

https://texas-sos.appianportalsgov.com/rules-and-meetings?$locale=en_US&interface=VIEW_TAC_SUMMARY&queryAsDate=04%2F22%2F2025&recordId=214411 http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.2161.htm#2161.252 http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.2161.htm#2161.252 mailto:HUBAdmin@uthscsa.edu mailto:HUBAdmin@uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

2.5.4 At the same time Proposer submits its proposal (no later than the Submittal Deadline (ref.

Section 2.1)), Proposer must submit the following HUB materials (HUB Materials):

(a) One (1) complete electronic copy of Proposer’s HSP through the Euna Procurement Portal.

2.5.5 University may offer Proposer an opportunity to seek informal review of its draft HSP by

University’s HUB Office before the Submittal Deadline. If University extends this offer, details will be provided at the Pre-Proposal Conference (ref. Section 2.6) or by other means. Informal review is designed to help address questions Proposer may have about how to complete its HSP properly. Concurrence or comment on Proposer’s draft HSP by University will not constitute formal approval of the HSP and will not eliminate the need for Proposer to submit its final HSP to University as instructed by Section 2.5.

2.6 Vendor Presentation

University reserves the right to hold Vendor Presentation in person at the University of Texas Health Science Center at San Antonio (or virtual). The dates and times to be determined after the first round of evaluations. Not all vendors may be invited to participate in these presentations, all dependent on first round of evaluation scores.

https://uthscsa.bonfirehub.com/portal/?tab=openOpportunities

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

SECTION 3

SUBMISSION OF PROPOSAL

3.1 Submission

Proposals must be received electronically through the University’s online Procurement Portal via Euna, on or before the Submittal Deadline (ref. Section 2.1 of this RFP). Competitive Bids will be listed on the Procurement Portal, and submissions will only be accepted through the portal.

University WILL NOT accept proposals submitted by paper, telephone, facsimile (“FAX”) transmission, or electronic mail (i.e., e-mail) in response to this RFP.

You can register for a free account by clicking here, which will be required when you prepare a submission. As part of the registration process, you may select Commodity Codes to associate with your account. This will open you up for notifications of opportunities matching your chosen codes.

If you encounter technical issues while preparing and/or submitting your proposal – you must contact Euna directly.

3.2 Proposal Validity Period

Each proposal must state that it will remain valid for University’s acceptance for a minimum of two hundred and forty days (240) days after the Submittal Deadline, to allow time for evaluation, selection, and any unforeseen delays

3.3 Terms and Conditions

3.3.1 Proposer must comply with the requirements and specifications contained in this RFP, including the Agreement (ref. APPENDIX TWO) and BAA (ref. APPENDIX SEVEN), the Notice to Proposer (ref. Section 2), Proposal Requirements (ref. APPENDIX ONE) and the Specification and Additional Questions (ref. Section 5). If there is a conflict among the provisions in this RFP, the provisions requiring Proposer to supply the better quality or greater quantity of services will prevail, or if such conflict does not involve quality or quantity, then interpretation will be in the following order of precedence:

A. Specifications and Additional Questions (ref. Section 5).

B. Agreement (ref. APPENDIX TWO).

C. BAA (ref. APPENDIX SEVEN).

D. Proposal Requirements (ref. APPENDIX ONE).

E. Notice to Proposers (ref. Section 2).

https://uthscsa.bonfirehub.com/portal/?tab=openOpportunities mailto:support.bonfire@eunasolutions.com

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

3.4 Submittal Checklist

Proposer is instructed to complete, sign, and return the following documents as a part of its proposal. If Proposer fails to return each of the following items with its proposal, then University may reject the proposal:

3.4.1 Signed and Completed Execution of Offer (ref. Section 2 of APPENDIX ONE).

3.4.2 Signed and Completed Pricing and Delivery Schedule (ref. Section 6).

3.4.3 Responses to Proposer's General Questionnaire (ref. Section 3 of APPENDIX ONE).

3.4.4 Signed and Completed Addenda Checklist (ref. Section 4 of APPENDIX ONE).

3.4.5 Signed and completed General Terms and Conditions (ref. Section 4 of APPENDIX

ONE)

3.4.6 Responses to questions and requests for information in the Specifications and Additional

Questions Section (ref. Section 5).

3.4.7 Signed and completed originals of the HUB Subcontracting Plan or other applicable documents (ref. Section 2.5 and APPENDIX THREE).

3.4.8 Completed Risk Assessment) (ref. APPENDIX FOUR).

3.4.9 Completed and Signed TX-RAMP Notice OR FedRamp (ref APPENDIX FIVE).

3.4.10 Completed Policy Driven Adoption for Accessibility (PDAA) Vendor Assessment (ref

APPENDIX SIX)

3.4.11 Completed Business Associate Agreement (BAA) (ref. APPENDIX SEVEN)

3.4.12 Completed Accessibility Conformance Report (ACR) and/or VPAT (ref 5.2 MINIMUM

REQUIREMENTS).

3.4.13 Completed Vendor Accessibility Dev Service Infor Request (VADSIR) (ref. 5.2 MINIMUM

REQUIREMENTS).

3.4.14 Completed AI Platform Requirements (ref APPENDIX EIGHT).

3.4.15 Detailed Proposer Quote.

3.4.16 Detailed Proof of Concept Alternative (POCA), separate from Proposer Quote.

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

SECTION 4

GENERAL TERMS AND CONDITIONS

See Attached in Euna

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

210.562.6200 | www.uthscsa.edu | https://wp.uthscsa.edu/purchasing/

REQUEST FOR PROPOSAL

5.1 General

Minimum requirements and specifications for Work, as well as certain requests for information to be provided by Proposer as part of its proposal, are set forth below. As indicated in Section 2.3, Contractor means the successful Proposer.

5.2 Minimum Requirements

Each Proposal must include information that clearly indicates that Proposer meets each of the following minimum qualification requirements:

5.2.1 AI Governance and monitoring platform to provide centralized inventory, risk management, policy enforcement and continuous monitoring across the AI life cycle.

5.2.2 Demonstrated experience in AI governance, risk management, and/or GRC platforms.

5.2.3 Proven ability to mature AI governance in similar organizations via a vendor supported governance platform.

5.2.4 Proven ability to expand governance platform quickly to meet new needs and requirements.

5.2.5 Pursuant to 1 TAC §213.38 (b), UT Health requires documentation providing credible evidence that the products to be included in this bid are accessible for use by persons with disabilities.

1. A completed self-assessment using the Policy Driven Adoption for

Accessibility (PDAA) (APPENDIX SIX) maturity model, using the PDAA template provided by the Texas Department of Information Resources.

2. A completed Vendor Accessibility Development Services Information

Request (VADSIR), using the VADSIR template provided by the Texas Department of Information Resources.

3. Other documentation of vendor’s capability or ability to produce accessible products and services, which may include:

a. Vendor’s internal accessibility policy documents,

b. Contractual warranties for accessibility,

c. Accessibility Conformance Reports (ACRs), based on the VPAT or OpenACR formats, for similar products or services previously provided by the vendor,

d. Accessibility testing documentation, and

e. Other examples of prior work results file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu https://texas-sos.appianportalsgov.com/rules-and-meetings?chapter=213&interface=VIEW_TAC&part=10&title=1 https://dir.texas.gov/resource-library-item/policy-driven-adoption-accessibility-pdaa-vendor-assessment-0 https://dir.texas.gov/resource-library-item/policy-driven-adoption-accessibility-pdaa-vendor-assessment-0 https://prod.dir.texas.gov/resource-library-item/vendor-accessibility-dev-services-info-request https://prod.dir.texas.gov/resource-library-item/vendor-accessibility-dev-services-info-request https://www.itic.org/policy/accessibility/vpat https://www.itic.org/policy/accessibility/vpat https://acreditor.section508.gov/

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

5.2.6 Proposer must have, or obtain, a TX-RAMP Level II Certification (APPENDIX FIVE) from DIR (Texas Department of Information Resources) prior to contract execution.

Information on TX-RAMP can be found on the Texas DIR website at:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp Please begin TX-RAMP Certification as soon as possible if proposer is not already certified.

A. Proposer must state if including a cloud-based solution as part of proposal.

5.3 Additional Questions Specific to this RFP

Proposer must submit the following information as part of Proposer’s proposal:

5.3.1 If Proposer takes exception to any terms or conditions set forth in APPENDIX TWO and APPENDIX SEVEN), Proposer must submit a list of the exceptions. The University WILL NOT consider any modifications to the University’s Standard Terms and Conditions AFTER submittal deadline.

5.3.2 UTS165 defines “Information Resources” as any and all computer printouts, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing Web sites, or otherwise capable of receiving, storing, managing, or transmitting Data including, but not limited to, mainframes, servers, Network Infrastructure, personal computers, notebook computers, hand-held computers, personal digital assistant (PDA), pagers, distributed processing systems, network attached and computer controlled medical and laboratory equipment (i.e. embedded technology), telecommunication resources, network environments, telephones, fax machines, printers and service bureaus. Additionally, it is the procedures, equipment, facilities, software, and Data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, and transmit information.

5.3.3 UTS165 defines “Data” as recorded data, regardless of form or media in which it may be recorded, which constitute the original data necessary to support the business of UT System or original observations and methods of a study and the analyses of such original data that are necessary to support research activities and validate research findings.

Data includes, but is not limited to printed records, observations and notes; electronic data; video and audio records, photographs and negatives).

5.3.4 UTHSA has determined that this project will require ALL Proposers to complete the Risk Assessment (Appendix Four). The Risk Assessment will establish specifications, representations, warranties, and agreements related to the EIR IT Security that Proposer is offering to provide to the University. Response to Appendix Four will be incorporated into the Agreement and will be binding on Contractor.

file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

5.4 Scope of Work

The Awarded Proposer shall provide a comprehensive AI Governance and Monitoring solution, to include but not limited to:

- Software

- Implementation Services including training, documentation, and knowledge transfer

- Ongoing support

5.4.1 AI Inventory and Registration Management:

The platform must provide centralized discoverable inventory and lifecycle management of ALL AI systems and use cases across UTHSA, to include but not limited to:

A. AI use case intake and approval workflow.

1. Intake form requiring documentation of applications, training data sources, model type, intended users, and data sensitivity.

2. Configurable workflow engine that facilitates communication and coordinated action among diverse stakeholders.

B. Automated and/or manual AI system registration.

C. Risk classification (e.g., low, moderate, high, critical).

1. Risk scoring logic that flags AI systems using PHI and/or student data for additional review.

2. Support for risk-based AI classification.

D. Model documentation repository.

1. Dashboard showing all active AI tools by department and risk tier.

E. Version tracking and lifecycle status (development, validation, production, retired).

5.4.2 Policy Management and Governance Framework:

Awarded Proposer shall support the development and operationalization of institutional AI policies.

A. The following capabilities are considered REQUIRED:

1. Policy mapping to AI systems.

2. Control validation for AI-specific risks (bias, data leakage, trust, privacy, security) file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

3. Policy attestation and user acknowledgment tracking via structured signoffs, attestation, and approval requirement.

4. Automated enforcement.

B. The following capabilities are suggested:

1. Controls requiring human-in-the-loop review for high-risk AI decisions.

2. Enforcement requiring bias testing documentation prior to production deployment.

3. Mapping institutional AI policy controls to federal and state regulations.

5.4.3 Risk Assessment and Compliance Monitoring:

The platform must enable continuous risk assessment and compliance validation.

1. AI risk assessment templates.

2. Frameworks to classify, assess, and mitigate AI specific risks and content libraries to address regulations.

3. Bias detection and fairness monitoring.

4. Data drift and model performance monitoring.

5. Provide documentation for trust, risk, and security assessments, testing, and validated results, risk and compliance remediation evidence.

6. Provides comprehensive audit trails of actions taken in the platform and automatically logs activities related to the AI life cycle.

7. Provide Regulatory alignment – since we have diverse use cases – like (HIPAA, FERPA, etc.).

1. Ongoing monitoring of predictive analytics models for performance degradation.

2. Alert when model output accuracy drops below predefined threshold.

3. Periodic bias audit reports for admissions or hiring-related AI tools.

file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

5.4.4 Data Privacy and Security Oversight:

Awarded Proposer must support integration with existing institutional security and compliance infrastructure.

1. Integration with IAM systems (e.g., SSO, role-based access).

a. Role-based access controls and SSO integration capability.

2. Logging and activity monitoring.

3. Data classification alignment.

4. Data access control and retention policies.

5. Third-party AI risk evaluation support.

1. Automated notification if AI model accesses restricted PHI datasets.

2. Dashboard showing AI systems interacting with confidential research data.

3. Integration with GRC tools for unified risk view.

4. Vendor risk management integration.

5.4.5 Monitoring of Generative AI and External AI Tools:

Given rapid adoption of generative AI tools, Proposer MUST provide oversight capabilities.

1. Monitoring of enterprise-approved generative AI tools.

2. Shadow AI discovery.

3. Prompt logging and usage analytics.

4. Data loss prevention alignment.

5. Analytics dashboard showing departmental usage trends.

1. Monitoring API usage volume and sensitive data submissions.

file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

2. Alerts for excessive upload of sensitive institutional data into external AI platforms.

5.4.6 Reporting and Executive Dashboards:

Awarded Proposer must provide role-based dashboards and exportable reports.

1. Executive-level risk dashboard.

2. Audit-ready compliance reports.

a. Audit logging and retention for minimum of seven (7) years (configurable).

3. Departmental risk summaries.

4. Customizable reporting.

5. Executive governance summaries.

6. Usage, token, cost tracking for this platform.

5.4.7 Implementation and Training:

Implementation timeline not exceeding nine (9) months.

1. Project Management.

2. Configuration and customization.

3. Integration support.

4. Administrator and end-user training for preparing for the implementation and ongoing training offerings

1. AI Governance Charter template.

2. AI Risk Taxonomy.

3. Implementation roadmap.

4. Go-live and Post-go-live support plan.

5. Governance framework advisory support.

file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

REQUEST FOR PROPOSAL

5.4.8 Ongoing Support and Continuous Improvement:

A. Dedicated account management.

B. Regulatory updated briefings.

C. Platform upgrades.

D. Scalability to support growth in models, users and data

E. Annual risk reassessment support.

F. Updated road maps and with customer driven feedback mechanisms.

G. Optional managed services.

5.4.9 Proof Of Concept Alternative (POCA):

UTHSA request that in your proposed quote to include a POCA quote – separate from the overall quote. The POCA shall include, but not be limited to:

A. Functional requirement fulfillment.

B. System performance and response time.

C. Data accuracy and integrity.

D. Security and compliance validation.

E. User adoption and satisfaction.

F. Reporting and analytics capability.

G. API and Integration

5.5 Group Purchasing Organization (GPO):

If Proposer is part of any GPO, provide the GPO Name, Contract(s) Number, and other pertinent information.

5.6 Add or Delete Services

UTHSA is continuing to grow clinical, research, and educational services, which may require additional service locations or facilities to be added or removed during the term of this agreement.

The agreement that results from this RFP may need to be modified during its term to reflect these locations modifications. Proposer agrees that the University has the right to add or delete services and locations which are available from the Proposer during the effective period of the contract. The University and the Proposer, prior to execution of services, shall mutually agree upon the scope and price, in writing, for any such additional services. In addition, the University has the right to modify, replace, upgrade, or delete services and locations during the effective period of this contract. The University and the Proposer, prior to modification or services shall mutually agree in writing before modifying services. As well as special notice in Section 1.2 Background and Special Circumstances.

file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu

DEPARTMENT OF PURCHASING | HUB PROGRAMS | Mail Code 7962 | 7703 Floyd Curl Drive | San Antonio, Texas 78229-3900

SECTION FOUR

TERMS AND CONDITIONS

SECTION SIX

PRICING AND DELIVERY SCHEDULE

APPENDIX ONE

SECTION 1 – GENERAL INFORMATION

SECTION 2 – EXECUTION OF OFFER

SECTION 3 – GENERAL QUESTIONNAIRE

SECTION 4 – ADDENDA CHECKLIST

APPENDIX TWO

SAMPLE AGREEMENT

APPENDIX THREE

HUB SUBCONTRACTING PLAN

APPENDIX FOUR

RISK ASSESSMENT

APPENDIX FIVE

TX-RAMP NOTICE

APPENDIX SIX

POLICY DRIVEN ADOPTION FOR ACCESSIBILITY (PDAA)

VENDOR ASSESSMENT

APPENDIX SEVEN:

BUSINESS ASSOCIATE AGREEMENT (BAA)

APPENDIX EIGHT

AI PLATFORM REQUIREMENTS

See Attached in Euna file://cfs/links/FS/Purchasing/Z_SHARED%20Management/BIDS/FY2022/1%20RFP%20745-22-PXX%20Master%20File%20February%202022/1_Working%20Documents/1_Draft%20Documents/www.uthscsa.edu