TEGE AI Assistor RFI Questions and Responses.pdf

1. Governance and Compliance Baseline. The RFI states that solutions must provide "secure, explainable, and governed AI outputs." Can the Government clarify which governance frameworks and policies the eventual solution will be expected to demonstrate conformance with, specifically IRM 10.24.1 (IRS Policy for AI Governance), OMB Memoranda M-25-21 and M-25-22, and the NIST AI Risk Management Framework? In addition, will vendors be expected to support the accountable agency official's AI Use Case Inventory documentation, risk assessment, and PCLIA obligations?

The IRS anticipates that any future solution would be expected to comply with all applicable Federal laws, regulations, policies, and IRS requirements. The purpose of this RFI is to better understand industry capabilities.

2. High-Impact Designation. Given that the contemplated use case involves analysis of taxpayer return information protected under IRC § 6103 and may inform compliance determinations affecting plan sponsors and participants, does the Government anticipate this use case being designated high-impact AI under OMB M-25-21? If so, what pre-deployment testing, ongoing monitoring, and human-oversight requirements does the Government expect vendors to address in their responses?

No determination has been made regarding AI classification or applicable oversight requirements.

3. Independent Assurance. Does the Government intend for AI governance functions, including explainability validation, bias and drift monitoring, and audit-ready documentation of AI outputs, to be delivered by the solution provider itself, or is the Government considering independent third-party assessment of the AI system as a separate or complementary capability?

The approach to AI governance and assurance has not been determined. The IRS is seeking industry input on available capabilities and approaches.

4. Acquisition Structure. Does the Government anticipate a single integrated award encompassing the AI solution, systems integration, and governance/assurance functions, or is the Government open to a modular acquisition approach that separates the AI solution from independent assessment and assurance services?

No acquisition strategy has been determined.

5. Small Business Considerations. Will the Government consider small business set-asides, including Service-Disabled Veteran-Owned Small Business (SDVOSB) set-asides or sole-source awards, for all or discrete portions of any resulting requirement, and should small business capability statements address teaming arrangements in their RFI responses?

No determination has been made regarding small business participation or set-asides.

Responses from all interested vendors are encouraged.

1. Small-business / SDVOSB participation: For any requirement resulting from this RFI, will the IRS consider a small-business or SDVOSB set-aside — in whole or in part (for example, reserving the AI-engineering scope) — or is a single unrestricted award anticipated?

The IRS has not made any determination regarding potential set-asides or award structure.

Responses from all interested vendors are encouraged.

2. Teaming vs. single-vendor domain expertise: Would the IRS consider a solution delivered by an AI-engineering firm teamed with retirement-plan/ERISA and actuarial subject-matter experts, or does the IRS expect a single vendor to hold all retirement-plan compliance and actuarial expertise in-house?

Respondents may describe their teaming approach and capabilities. The IRS has not established any requirements regarding teaming arrangements.

3. Solution maturity — COTS vs. configurable: Is the IRS primarily seeking a commercially available product with demonstrated retirement-plan compliance capability today, or is it open to configurable AI platforms tailored to Employee Plans' requirements? How turnkey must the retirement-plan domain capability be at the outset?

The IRS is interested in understanding the range of available solutions. Respondents should describe their solution and its level of maturity

4. Retirement-plan calculations: For the calculations referenced (for example, discrimination, coverage, top-heavy, vesting, allocation, funding, and correction), does the IRS expect the solution to natively perform these, or to integrate with an IRS-provided or third-party validated calculation engine?

Respondents should describe how their solution supports retirement plan calculations, including any native or integrated capabilities.

5. Authoritative rule sources and data: For any pilot or prototype, will the IRS furnish representative (de-identified) plan data and the authoritative rule corpus (Code, Treasury Regulations, Revenue Procedures, Notices, and guidance), or is the vendor expected to source and maintain that corpus?

Government-furnished data and documentation requirements have not been determined.

6. Security boundary: Will the contractor operate within the IRS's existing authorization boundary / ATO, or is an independent FedRAMP authorization expected, and which cloud environment(s) are in scope?

Security and authorization requirements have not been established for this effort.

Compliance Frameworks: Can the Government specify which regulatory frameworks— such as the NIST AI Risk Management Framework (RMF), Executive Order 14110, or agency-level AI safety policies—will serve as the primary compliance baseline for evaluating the "governed" nature of proposed solutions?

Any future solution would be expected to comply with applicable Federal and IRS requirements. Specific requirements have not been established.

Data Sensitivity & Security: Regarding the "secure" ingestion of retirement plan data, should vendors align their technical approaches with specific FISMA impact levels (e.g., Moderate or High) or FIPS 140-3 encryption standards for the handling of unstructured plan data?

Applicable information security requirements have not yet been determined.

Human-in-the-Loop Requirements: To assess the "explainable" component of the AI outputs, does the Government anticipate a requirement for "Human-in-the-Loop" (HITL) checkpoints within the retirement plan calculation and compliance analysis workflow, or is the goal to move toward fully autonomous, system-driven reporting?

Operational requirements, including the checkpoints for and level of human oversight within the workflow, have not been determined.

Legacy Integration & Data Governance: For integration with existing enterprise systems (PegaSystems and Salesforce), are there existing data governance constraints or API-security protocols that vendors must adhere to to ensure that the data pipeline remains secure during the transformation from legacy static formats to dynamic AI-enabled analysis?

Integration requirements have not been finalized. Respondents are encouraged to describe relevant integration capabilities.

1. FedRAMP / FTI. Given the AI Assistor would handle Federal Tax Information (FTI), should responses assume IRS Publication 1075 safeguarding in addition to NIST SP 800- 53, and what FedRAMP impact level (Moderate vs. High) does the IRS anticipate? Is a vendor-hosted FedRAMP-authorized environment acceptable, or must the solution deploy within an existing IRS/Treasury ATO boundary (e.g., agency-provided GovCloud)?

The IRS anticipates that any future solution would be expected to comply with all applicable Federal laws, regulations, policies, and IRS requirements. The purpose of this RFI is to better understand industry capabilities.

2. PegaSystems / Salesforce. Can the IRS share the current PegaSystems and Salesforce environment specifics (versions, hosting), and clarify whether integration is expected through existing/published APIs or whether net-new integration or middleware is in scope?

Integration requirements have not been finalized. Respondents are encouraged to describe relevant integration capabilities.

3. Compliance calculations. Should the AI Assistor perform retirement-plan compliance calculations natively (e.g., coverage and nondiscrimination testing, top-heavy, vesting, DB funding), or interface with existing IRS actuarial/testing tools? Is a reference specification or representative test-case set available?

Respondents should describe how their solution supports retirement plan calculations, including any native or integrated capabilities.

4. Representative data. Will the IRS make representative de-identified or synthetic retirement-plan documents — and/or a document-type taxonomy or data dictionary — available to inform vendors' technical approaches or any future pilot/prototype phase?

Government-furnished data and documentation requirements have not been determined.

5. Acquisition path. What is the anticipated acquisition timeline and contract vehicle for any follow-on solicitation (e.g., a small-business or 8(a) set-aside, GSA MAS, or a GWAC), and does the IRS plan an industry day or one-on-one sessions?

No acquisition strategy has been determined.

Responses from all interested vendors are encouraged.