Government Question Response.pdf

Government Response

Solicitation 7571TE26R00004. HHS AI Power User Advanced Models and Features Pilot.

Date: July 9, 2026

Duplicative inquiries may have been consolidated in the interest of document brevity. Any omitted question is represented by an analogous query below, containing the corresponding Government determination. Where necessary, questions have been summarily edited for length and clarity without modifying the underlying premise or substantive intent of the request.

Contract and Submission Logistics

1. Would an additional two weeks [from July 14] for the due date be possible?

a. Government response: The Government is unable to extend the due date further. An extension has previously been granted, shifting the due date from July 2 to July 14.

This requirement is structured as a short-duration pilot intended to evaluate rapid access to advanced AI capabilities, commercial parity, release alignment, security and authorization pathways, usage baselining, and enterprise feasibility.

2. Please confirm the exact quote due date and local time, the submission method (email address or portal), any file size limit, acceptable file formats (for example PDF or Microsoft Word), and the number of copies required. Please confirm the required minimum font, minimum font size, page size (US Letter assumed), margins, and line spacing for narrative volumes.

a. Please refer to SAM.gov for submission deadline and submission method. Submissions are made to the Contracting Officer via email. Microsoft Word or PDF is acceptable. File size is not limited, but the page limits remain in effect.

b. Narrative volumes shall use 8.5 x 11-inch pages, one-inch margins, and a minimum 11-point font. Tables, figures, graphics, headers, footers, and footnotes may use a smaller font if legible, but shall not be smaller than 9-point font.

3. Section L.2 states page limits apply to narrative pages and that cover pages, tables of contents, required representations and certifications, pricing schedules, roadmaps, other artifacts, and completed Government templates do not count. Please confirm that tables, figures, and graphics embedded within a narrative volume also do not count against that volume's page limit, or if they do count, please confirm the minimum readable font size allowed inside tables and graphics.

a. Tables, figures, and graphics embedded within a narrative volume count against that volume’s page limit unless expressly excluded. Completed Government-provided templates, pricing schedules, deployment options, commercial parity roadmaps, ATO artifacts, and other artifacts expressly excluded by Attachment 4 do not count against the applicable narrative page limit.

Tables and graphics must be readable and may not use font smaller than 9-point.

4. Please confirm whether the Deployment Options and Commercial Parity Roadmap items in Volume II, which are marked as no page limit, may be submitted as separate appendices or attachments.

a. Deployment Options and the Commercial Parity Roadmap may be submitted as separate appendices or attachments and will not count against the Volume II page limit, provided they are clearly labeled and cross-referenced in the quote. Attachment 4 identifies Deployment Options and Commercial Parity Roadmap as no-page-limit items.

Past Performance and Incumbency

5. Is there an incumbent for this requirement? And if so, what is the previous contract number and incumbent vendor?

a. There is no previous contract for this requirement. This is a new requirement, does not have previous contract information, and has no incumbent.

6. Please identify any existing user provisioning, single sign-on, identity, or administrative configurations that a successor would be expected to inherit or replicate.

a. Please read the solicitation. Specifically, read the Section L and M of the solicitation for instructions and evaluation criteria/methodology and basis for award.

7. Will corporate experience or past performance be evaluated? If so, under which factor, and what content, format, and page allowance apply?

a. Please read the solicitation. Specifically, read Section L and M of the solicitation for instructions and evaluation criteria/methodology and basis for award.

8. If past performance is evaluated, will the Government accept Contractor Performance Assessment Reporting System (CPARS) records in lieu of a past performance questionnaire, in order to reduce the burden on customer points of contact?

a. Please read the solicitation. Specifically, read Section L and M of the solicitation for instructions and evaluation criteria/methodology and basis for award.

9. If a past performance questionnaire is required, please provide the questionnaire template, the submission method, and the due date, and confirm whether the questionnaire may be sent directly by the reference to the Contracting Officer.

a. Please read the solicitation. Specifically, read Section L and M of the solicitation for instructions and evaluation criteria/methodology and basis for award. No questionnaire is currently required but may be required if requested.

10. Please confirm the relevancy criteria (scope, size, and recency) the Government will use to assess submitted past performance.

a. Please read the solicitation. Specifically, read Section L and M of the solicitation for instructions and evaluation criteria/methodology and basis for award.

Eligibility and Teaming

11. The SAM.gov notice lists NAICS 518210 and indicates no set-aside. Is award limited to the GSA OneGov channel or another specific ordering vehicle? If a specific vehicle is required, please identify it. Can you confirm that this requirement is an open market award?

a. No set-aside has been selected for this requirement and may be procured via Open Market. The Government encourages the use of OneGov but does not require it.

12. Is a systems integrator or authorized reseller that is not the first-party model developer eligible to quote, provided it satisfies the Provider Reach-back and Authoritative Access requirements of Volume II and Section L.4?

a. A systems integrator, authorized reseller, marketplace provider, or other intermediary may submit a quote if it can meet all solicitation requirements, including Provider Reach-back and Authoritative Access, commercial parity support, security and authorization support, pricing requirements, Government data protections, and enterprise risk disclosure requirements.

The Government will evaluate the Quoter’s demonstrated ability to provide timely, direct, and authoritative access to the organizations responsible for product strategy, roadmap, engineering, security, authorization, operations, release management, commercial parity, and enterprise implementation support.

This is tied directly to the pilot’s purpose: the Government is not merely buying access to an AI tool; it is generating operational evidence, commercial-parity analysis, release-alignment strategies, enterprise feasibility determinations, authorization pathways, governance recommendations, attribution methodologies, and future acquisition recommendations.

13. Are teaming arrangements and subcontracting permitted for this requirement? If so, are there any limitations on subcontracting percentage, workshare, or on the role a subcontractor may perform relative to the model provider?

a. The contractor may submit under a teaming arrangement or prime/subcontractor relationship.

14. Will the Government evaluate the prime, the proposed model provider, and material subcontractors collectively when assessing Provider Reach-back, Commercial Parity, and Security and Authorization posture?

a. Yes. The Government will evaluate the proposed solution as a whole, including the prime Quoter, proposed model provider, platform operator, cloud provider, material subcontractors, suppliers, resellers, etc, and any other entity material to successful performance. The prime is the proposed accountable contract holder thus is key to assessing their approach and proposed resourcing, execution, and success viability to fulfill all Government objectives/requirements.

15. If a prime submits with the model provider as a subcontractor or supplier, may the prime rely on the model provider's FedRAMP authorization, HIPAA or BAA posture, and commercial parity evidence to satisfy Volumes II, III, and IV?

a. The Prime Contractor is NOT a pass-through to a model provider and the Prime Contractor’s role must be EXPLICIT and detailed in and across the entirety of the work and associated submission. Model provider information may be used as supporting documentation and is NOT sufficient for reuse and submission as a Prime contractor’s information, UNLESS the Prime Contractor IS the Model Provider.

The prime Contractor is responsible for contract performance. While a model provider’s FedRAMP authorization may be relied on as supporting documentation, the Prime Contractor is responsible and accountable for explicitly detailing their role across all facets of their approach in fulfilling the Government’s requirements, providing the Prime’s evidence applies to the proposed capability, product surface, deployment pattern, security boundary, data types, and period of performance.

Model Provider documentation may serve as supporting evidence of underlying capability but may NOT be repackaged or resubmitted as Prime Contractor Work Product unless the Model Provider IS the Prime Contractor directly submitting in response to the solicitation. Where a Prime uses a model provider as a subcontractor, the prime must provide independent analysis demonstrating substantive operational responsibility across authorization management, commercial parity assessment, enterprise integration, security oversight, and release planning – DISTINCT from simply implementing model provider standard practices. Model provider materials are supporting documentation only; they do NOT satisfy the Prime’s independent contract obligations. Again, if the prime IS the model provider (first-party developer/operator), the prime may submit its own standard documentation directly.

16. U.S. Entity Statement: Could HHS please revise Compliance Element 2 so that, for commercial SaaS/API services where the quoter is not delivering manufactured end products, standalone hardware, supplies, or construction materials, the quoter may satisfy the pass/fail requirement by submitting a U.S. entity statement instead of TAA/BAA end-product certifications? A U.S.

entity / ownership statement better fits commercial SaaS/API services than a manufactured end-product country-of-origin certification.

Partially addressed by previous responses

Prior Q&A reference: Prior Q&A Q10 / Compliance Element 2

Government response: Related to prior Q&A. Supplemental clarification: The Government will evaluate TAA/BAA information and certifications as applicable. For commercial SaaS/API services that do not include delivery of manufactured end products, standalone hardware, supplies, or construction materials, Quoters may explain why traditional end-product country-of-origin certification is not applicable and may submit a U.S. entity / ownership statement and service description. If a quote includes separately delivered supplies, hardware, equipment, construction materials, or other end products, applicable TAA/BAA information shall be provided for those items. The Government may clarify Compliance Element 2 to distinguish commercial SaaS/API services from separately delivered supplies or end products.

Scope, Models, and Features

17. Volume I requires identification of the Proposed Individual LLM or Model Family. Must a single quote propose exactly one model family, or may a quote propose multiple model families? If multiple, will each be evaluated and potentially awarded separately?

a. The vendor may submit for multiple model families. The Government may issue the award(s) that best fits the Governments’ needs and limit administrative burden.

18. Will the Government award multiple contracts, one per Individual LLM or Model Family, as suggested by the definitions in Attachment 1?

a. The Government may issue one, several, or no awards in response to this solicitation. A Quoter may propose multiple Individual LLMs or Model Families. If more than one model family is proposed, the Quoter shall clearly identify the proposed PWS, pricing, security posture, deployment options, commercial parity roadmap, provider reach-back model, assumptions, and dependencies applicable to each proposed model family.

19. Please confirm the specific advanced features that must be included in the base pilot bundle under CLIN 0001 versus those the Government considers optional or roadmap items.

a. The Government is not prescribing a closed list of mandatory advanced features beyond the SOO requirements. CLIN 0001 is intended to support an Exploratory Frontier AI Entitlement for up to [1,000] authorized portable HHS power users and includes advanced models, advanced features, agentic capabilities, APIs, administrative controls, reporting functions, integration paths, onboarding, enablement, and pilot support necessary to establish operational baselines for frontier AI capabilities.

Quoters shall identify which advanced models, features, tools, APIs, connectors, applications, agentic capabilities, coding capabilities, research capabilities, and administrative controls are included, excluded, limited, preview-only, roadmap/future, boundary-dependent, or available only through another product surface.

This approach supports the SOO’s purpose of generating operational evidence regarding what can be enabled immediately, what requires configuration or integration, what requires security or authorization work, and what should inform future HHS enterprise AI acquisitions.

20. The solicitation references awards and optional quantities for an “individual LLM,” “Model

Family,” “platform,” or “AI service grouping.” Please define those individual terms. Please confirm that a quoter may propose a commercial AI service grouping such as Perplexity Pro and Perplexity Max, where the offered service includes advanced research tools and execution environments powered by multiple frontier models, rather than anchoring the quote to only one named LLM or model family (e.g. Anthropic Opus, OpenAI GPT, etc.).

a. Please read Section L and M of the solicitation. The Government may issue one, several, or no awards in response to this solicitation. A Quoter may propose multiple

Individual LLMs or Model Families. If more than one model family is proposed, the Quoter shall clearly identify the proposed PWS, pricing, security posture, deployment options, commercial parity roadmap, provider reach-back model, assumptions, and dependencies applicable to each proposed model family.

21. LLM Explainability Limitations: Section H.9 requires AI system outputs to be "sufficiently explainable to enable Government personnel to understand, evaluate, and appropriately use results," including "the basis for material AI-generated recommendations, predictions, classifications, or generated content." Token-level or neuron-level explainability is not technically feasible for frontier LLMs, nor is it a commercial AI industry standard. The Government should revise H.9 to confirm that system-level documentation (model cards, system cards, published technical reports, etc.) satisfies the explainability requirement, rather than requiring output-level causal explanations that are beyond the current state of the art.

Previously addressed. Clarification: token-level, neuron-level, hidden-chain-of-thought, model-weight, or proprietary internal causal explanations are not required.

22. Third-Party Model Release Schedules: Section H.14 requires 30 calendar days' written notice before implementing "foundation model replacement, significant retraining, [or] new AI functionality" and concurrent access to successor models for 30 days (major) or 15 days (minor). For third-party models, the cloud platform provider does not typically control the model developer's release schedule, retraining cadence, or versioning decisions. The Government should revise H.14 to require notice "as soon as commercially and limit the concurrent access requirement to model versions within the contractor's direct control, recognizing that the contractor cannot compel a third-party model developer to maintain deprecated model versions indefinitely.

Previously addressed. Clarification: notice and successor-model access are required to the extent commercially available, technically feasible, and within the Contractor's or service provider's control.

23. Model Card and Documentation Standards: Section H.9 requires the contractor to provide

"model/system descriptions (model cards or equivalent), data provenance (sources and limitations), [and] performance characteristics and limitations." Third-party foundation model developers control what information they disclose publicly. Training data composition, model architecture details, and internal evaluation methodologies are typically proprietary trade secrets that model developers do not share with their distribution partners. The Government should revise H.9 to confirm that commercially available, publicly published model documentation (model cards, system cards, technical reports, and safety evaluations published by the model developer) satisfies this requirement.

Previously addressed. Clarification: commercially available or publicly available model cards, system cards, technical reports, safety evaluations, product documentation, trust documentation, and equivalent materials may satisfy the requirement where those materials are the provider's standard documentation.

24. Intermediary Processing and Agentic Observability: Section H.9 requires that if the AI system uses "intermediary processing (reasoning, retrieval, or agentic processes), it must summarize intermediary steps from data input to data output," including "model routing decisions with accompanying rationale." For multi-model architectures, the internal reasoning chains of third-party models are not exposed to the platform provider; they are proprietary to the model developer. The Government should revise H.9 to confirm that system-level observability (which model was invoked, what inputs were provided, and what outputs were returned) satisfies this requirement.

Previously addressed. Clarification: system-level observability is acceptable where internal model reasoning is not exposed.

25. Incidental Enablement vs. Standalone Training: Can HHS clarify the boundary between

"incidental" enablement and standalone training services? Specifically, is there a cost or hours threshold (e.g., percentage of total CLIN value) above which proposed training/enablement would be considered non-incidental and therefore out of scope?

The Government does not establish a fixed cost or hour threshold for distinguishing incidental enablement from standalone training services. Training, office hours, workshops, user guidance, onboarding, and enablement activities are allowable when directly related to pilot execution, adoption, usage baselining, commercial parity, security/authorization support, reporting, or achievement of applicable CLIN objectives. The Government is not seeking a standalone training-services contract.

Quoters should describe the scope, purpose, cadence, and relationship of proposed enablement activities to the applicable CLIN objectives.

26. Change Management: Does HHS intend for quoters to price these enablement activities separately under their representative CLINs, or should they be bundled into the FFP CLIN 0002 rate with no separate line item? Who within HHS will own day-to-day cohort management? Can HHS clarify what "stakeholder engagement" specifically means in this context? Does HHS have a target adoption rate or engagement benchmark in mind? Does HHS currently have a named Change Management Lead, Training Lead, etc.? Is CLIN 0003 intended to fund the change management and adoption workstream separately? What is HHS's intent if CLIN 0003 is not exercised? H.14 governs notification timelines for model changes, not workforce change management. When a material model change triggers the 90-day notice under H.14, does HHS expect the contractor to proactively initiate user-facing communication and retrain for power users? Does HHS expect the contractor to develop and execute a formal communication plan?

Who are the named stakeholders on the HHS side beyond the COR? Can HHS clarify on what a successful stakeholder engagement model looks like? Does HHS have or plan to designate AI Champions?

The Government anticipates centralized coordination through the COR and designated Government points of contact. HHS may also designate OpDiv or StaffDiv points of contact to support cohort nomination, onboarding, communications, access management, and issue escalation. Quoters shall propose an onboarding and cohort-management approach that can operate with a centralized Government lead and designated OpDiv/StaffDiv contacts. The Government will provide final points of contact after award.

Stakeholder engagement includes engagement with the COR, program leadership, OCIO, CAIO or AI governance stakeholders, security, privacy, records, accessibility stakeholders, acquisition stakeholders, OpDiv or StaffDiv points of contact, and pilot users as appropriate. Quoters may propose a tiered engagement model, including executive-level briefings, working-level implementation meetings, technical/security meetings, and user-facing enablement activities.

The Government is not prescribing a target adoption rate or engagement benchmark at award. The purpose of the pilot is to establish baselines for adoption, utilization, support needs, enterprise feasibility, and future acquisition planning. Quoters should propose metrics and methods for measuring adoption, engagement, usage, user feedback, and cohort participation during performance.

The Government may designate executive sponsors, change-management points of contact, training or communications points of contact, AI champions, and OpDiv/StaffDiv representatives after award. Quoters should propose an approach that supports Government-designated roles where available and can assist HHS in establishing appropriate coordination structures during pilot kickoff and execution.

See previous responses to Pricing and CLIN Structure- specifically response to question item 45 for information on CLIN 0003 intent.

Related to prior Q&A. Supplemental clarification: H.14 is primarily a Government-facing technical, security, authorization, and change-management notice requirement. It does not automatically require user-facing communications or retraining for every material model change. However, where a material model change affects user workflows, feature availability, access, safety behavior, reporting, or pilot execution, the Contractor shall coordinate with the Government regarding appropriate user-facing communications, enablement materials, release notes, or office hours as part of the pilot support approach.

Quoters should propose a communication approach for the pilot cohort, including onboarding announcements, feature-release communications, enablement messaging, issue communications, and engagement cadence. The Government may provide internal communication channels, distribution lists, intranet locations, Teams spaces, or OpDiv/StaffDiv communication pathways after award. Quoters should assume that communications to HHS users will be coordinated with and approved by the Government.

The Government will identify required Government stakeholders and points of contact after award. The Contractor should expect to coordinate with the COR, OCIO, CAIO or AI governance stakeholders, security, privacy, records, accessibility, acquisition, and designated OpDiv/StaffDiv points of contact as applicable. If some points of contact are not identified at kickoff, the Contractor may support HHS in identifying and establishing appropriate stakeholder relationships as part of the pilot execution approach.

The Government expects a stakeholder engagement model sufficient to support successful pilot execution, rapid issue resolution, commercial parity tracking, usage baselining, security/authorization coordination, and enterprise feasibility analysis.

Quoters may propose a cadence that includes executive briefings, working-level implementation meetings, technical/security meetings, and user enablement sessions.

The Government will finalize cadence after award based on the awarded PWS and Government stakeholder availability.

The Government may designate AI champions or change agents within participating OpDivs or StaffDivs. If such roles are not fully identified before pilot kickoff, the Contractor may provide enablement support to help HHS establish a champions network or equivalent user-support structure. Such support shall remain tied to pilot execution, adoption, usage baselining, and enterprise operating-model development, and shall not convert the requirement into a standalone training-services contract.

Pricing and CLIN Structure

27. Please confirm the base period of performance length and start assumption, and confirm that each option period (OP1 and OP2) is six months as indicated in the CLIN table.

a. Section F identifies the base period as July 15, 2026 through January 14, 2027, Option Period 1 as January 15, 2027 through July 14, 2027, and Option Period 2 as July 15, 2027 through January 14, 2028. Section F also identifies a 180-day transition-out option. This anticipated period of performance will adjust based on extensions provided and when the Government is able to make award(s) but the performance period(s) durations will remain the same. The Government anticipates effective award date by August 1, 2026.

28. Please confirm the authorized portable user quantity to be priced for the base CLIN 0001. The Statement of Objectives shows a bracketed value of 1,000. Please confirm 1,000 as the base quantity and identify the specific expansion bands to be separately priced up to the 10,000 maximum.

a. The base CLIN 0001 quantity to be priced is 1,000 authorized portable HHS power users, unless otherwise proposed additional capacity value by the Quoter. Section B identifies CLIN 0001 as an Exploratory Frontier AI Entitlement for up to [1,000] authorized portable HHS power users.

CLIN 0004 provides optional Frontier Entitlement Unit Quantity Expansion up to a maximum of 10,000 authorized portable users for the applicable Individual LLM. Unless a Quoter’s propose higher volume of authorized portable HHS power users. Quoters should clearly price the proposed entitlement unit quantity for the entitlement expansion (such as increments or quantity bands up to the 10,000 or more if a Quoter chooses to propose expansion to an unlimited entitlement).

29. Please confirm whether CLIN 0002 (Enterprise-Wide Access Entitlement) and CLIN 0003 (Enterprise Workforce Adoption and Operating Model Baselining) are required in the base quote or are separately priced options that may be proposed at the Quoter's discretion.

a. Quoters shall propose the applicable CLINS which align with their approach to fulfilling the Government’s Statement of Objectives and requirements.

30. Please define the usage envelope, fair-use assumptions, and any capacity or rate limits the Government expects to apply, so that an inclusive firm fixed price can be established without hidden consumption triggers.

a. See Section L of the solicitation. The Government is not prescribing a universal commercial usage envelope, fair-use model, or capacity model; Quoters shall propose and disclose all applicable usage assumptions, fair-use controls, safety controls, abuse-prevention controls, rate limits, throttling conditions, capacity limitations, excluded capabilities, and other commercial constraints applicable to the proposed offering. Fair-use and rate limit disclosures are for abuse prevention (bot traffic, credential sharing, DoS style load) and NOT a backdoor for cost based capability throttling.

CLIN 0001 - All advanced, emerging, and frontier capabilities are included in CLIN 0001 by default. This is an emerging and frontier capability pilot. The contractor shall provide its full commercial advanced capabilities set – all advanced models, advanced features, agentic capabilities, APIs, tools, integrations, administrative controls, reporting functions and newly released frontier capabilities available in the contractor’s commercial offering. The Government does not expect a curated or limited subset.

Capabilities newly released commercially during the period of performance are likewise expected to become available to HHS pilot users consistent with SOO Objective 1 (commercial parity) and Objective 10 (release alignment).

Capability scope and price is independent of consumption volume. CLIN 0001 is a firm fixed price entitlement structured specifically to let authorized power users freely explore and utilize advanced capabilities so that HHS can baseline actual demand – not to meter, ration, or restrict access against a budget. Native consumption units (tokens, credits, AMUs, request, messages, searches, API calls, or equivalent) are reporting and baselining inputs only. They shall not be separately invoiced, shall not trigger overages charges to the Government, and shall not be used as an undisclosed cap on access.

Accordingly, no capability may be withheld, throttled, or deprioritized on the basis of consumption volume or cost.

The contractor shall clearly identify in its proposal any advanced, emerging, or frontier capability that is excluded from the base offering, and the specific reason for exclusion (e.g. security boundary incompatibility, authorization dependency, or not available in the contractor’s current commercial offering). This information shall be reflected in the Feature and Model Availability Matrix (Deliverable D2), due within 15 business days of award and refreshed monthly.

HHS prioritization requests during the performance period. Because all available and emerging capabilities are already within scope, HHS requests during the performance period address prioritization, acceleration of enablement, or clarification of deployment status – not the addition of anything new. Such requests reflect operating division-specific focus areas (e.g. legal, domain-specialized, or mission-critical capabilities) or acceleration of capabilities initially staged as preview or limited release. HHS shall communicate such requests in writing to the COR. Within 5 business days, the contractor shall confirm current deployment status and either provide an enablement timeline or identify the specific technical constraint (security boundary or authorization pathway) preventing acceleration.

No additional cost, ever. All feasible prioritization and acceleration requests shall be accommodated at no additional cost under CLIN 0001, consistent with its FFP structure and the purpose of this pilot. Resource availability and consumption volume are not a basis for declining a request. Where a request cannot be accommodated, the sole permissible grounds are genuine technical constraints, which the contractor shall clearly explain, together with a proposed workaround or alternative timeline within the existing contract scope.

No reduction in committed service level. Prioritizing any capability shall not reduce commercial parity, reporting cadence, support responsiveness, or access to any other committed capability.

Illustration. If a legal research capability is available in the contractor’s commercial offering but stated for preview release in Month 6, and HHS requests it in Month 3, the contractor accelerates enablement and deploys it to HHS pilot users at no additional cost, regardless of resulting consumption. If acceleration is prevented by a genuine technical constraint, for example an outstanding authorization dependency, the contractor sates the constraint plainly and proposes the earliest feasible alternative timeline within scope.

CLIN 0002 - Enterprise-wide access entitlement:

• No overage costs either: “without consumption-based invoicing, overage charges, replenishment charges, provider-native unit exhaustion charges, or additional usage-based charges.” Same no-cost principle as CLIN 0001.

• But Scope is different. This is “established” capabilities, not “all commercial capabilities” by default. Covered capabilities are “identified in the contractor’s proposal and accepted by the Government”. The contractor proposes what’s covered; Government accepts or negotiates. Exclusions must be identified too.

• So: No cost applies, but “everything is in scope by default” does not, CLIN 0002 is the non-advanced, contractor proposed/Government accepted scope not a blanket inclusion like CLIN 0001.

CLIN 0003 – Enterprise Workforce Adoption and Operating Model Baselining (Optional)

• Separately priced FFP entitlement for AI that does not yet have an enterprise footprint at HHS, requiring onramp etc.

• Explicitly for providers that have not yet deployed an enterprise scale offering at HHS.

• Structurally distinct purpose, it is set up / onramp / security foundations with adoption. An LLM using CLIN 0003 would not be proposing CLIN 0002.

CLIN 0004 – Frontier Entitlement Unit Quantity Expansion

• This is literally CLIN 0001, scaled to more users. Not a different capability set, it is a user count option.

• Objective 12 governs this directly: “The contractor shall not reduce commercial parity, feature availability, reporting , support, security evidence, or administrative controls for users added under a quantity option unless the limitation is disclosed in the offer and accepted by the Government.

• So CLIN 0004 inherits the CLIN 0001 logic, same capabilities, same no-cost principle, just more users (up to 10,000 incremental users suggested but Quoters may propose an enterprise wide entitlement offer similar to CLIN 0002. Enterprise wide entitlement offerings priced favorably for Government adoption are encouraged.)

Note on Favorably Priced Entitlement FFP Offerings:

1. Mutual Immaturity Rational – The FFP, no-coverage structure across these CLINS is not a stylistic preference. It reflects that both Government attribution maturity and provider metering/reporting maturity are currently insufficient to support a metered structure. A Quoter proposing metered or consumption-based pricing under these conditions would be knowingly exploiting that asymmetry.

2. Internal Data Findings – The Government had to cross-walk existing enterprise scale AI usage data with internal HHS sources to even get minimal attribution insight, and found that usage does not reconcile across tools, For example, AI-assisted activity occurred on repositories with no corresponding review trail, and gaps existed in the Government’s ability to attribute and gain transparency into AI-assisted work product across organizational, ownership, and lifecycle dimensions. None of this is explainable from the existing enterprise scale AI footprint reporting as it stands, and accordingly ties directly back to SOO Objectives 7 and 13 for Federal Workforce Attribution and other key SOO objective requirements.

3. Pricing Expectation – Quoters with an existing HHS enterprise scale footprint are expected to price similarly to OneGov terms, not at a premium or on actuals. An existing footprint is not a basis for higher pricing and is the contrary, it is the basis for the Government’s most favorable available pricing, given he Quoter’s already-amortized deployment costs and significant immaturity.

4. CLIN Boundary Clarity – Quoters shall explicitly classify coding, repo-task, agentic, and tool-execution workloads must be explicitly classified by CLIN (0001, 0002, both or neither) in the proposal and locked at award. Unclassified usage defaults to CLIN 0002 at no additional cost. This prevents a Quoter from pricing “unlimited enterprise” access assuming such workloads are excluded, or from including them to win on price and later reclassifying them as “frontier” once deployed at volume.

31. Please confirm whether a Government-provided pricing template or spreadsheet exists for the CLIN and quantity band layout, and if so, please provide it and confirm it is mandatory.

a. Quoters should read the solicitation and follow the instructions provided. No pricing template has been provided; the CLIN and quantity band layout has been supplied.

32. Please confirm whether the wrap-around services (onboarding, enablement, adoption baselining, governance support, usage and adoption reporting, release alignment, and security support) are to be priced as firm fixed price deliverables, and whether any labor basis of estimate is requested to support that price.

a. Onboarding, enablement, adoption baselining, governance support, usage and adoption reporting, release alignment, security support, and related pilot support activities shall be included in the applicable FFP CLIN unless separately identified and accepted by the Government.

The Government does not require a labor basis of estimate unless expressly requested.

Quoters should provide supporting pricing detail sufficient to demonstrate price reasonableness, understanding of the requirements, and consistency with the proposed PWS.

33. Please confirm whether travel and other direct costs, if any, are included within the firm fixed price or handled separately, and identify the expected place or places of performance and any required on-site presence.

a. Travel and ODCs are not anticipated for this requirement. Any travel or ODCs not included in the FFP must be separately identified, justified, and accepted by the Government.

34. Option to Extend CLIN: To support complete and consistent pricing, could HHS please confirm whether the Option to Extend period requires a CLIN 3004 for Frontier Entitlement Unit Quantity Expansion corresponding to CLINs 0004, 1004, and 2004, or whether the omission of CLIN 3004 was intentional and offerors should not submit separate pricing for that item?

Please see response to previous question “please define the usage envelope...”

CLINS beginning with 1xxx and 2xxx are the same series of CLIN structure for the optional performance periods.

35. Fair-Use Threshold: While CLIN 0001 is designed to allow authorized power users to freely explore advanced frontier capabilities without the Government having to meter or ration usage at the individual level, a single power user could run an unoptimized script that wastefully consumes millions of tokens in a single day. To protect the pilot from extreme right-tail outlier waste and to keep Firm-Fixed-Pricing highly competitive, will the Government establish or accept a reasonable "fair-use" daily or monthly token/request consumption threshold and/or API rate limit (e.g., requests per minute) per authorized power user under CLIN 0001?

Please see response to previous question “please define the usage envelope...”

Emphasizing here the following language from that response:

Note on Favorably Priced Entitlement FFP Offerings:

1. Mutual Immaturity Rational – The FFP, no-coverage structure across these CLINS is not a stylistic preference. It reflects that both Government attribution maturity and provider metering/reporting maturity are currently insufficient to support a metered structure. A Quoter proposing metered or consumption-based pricing under these conditions would be knowingly exploiting that asymmetry.

2. Internal Data Findings – The Government had to cross-walk existing enterprise scale AI usage data with internal HHS sources to even get minimal attribution insight, and found that usage does not reconcile across tools, For example, AI-assisted activity occurred on repositories with no corresponding review trail, and gaps existed in the Government’s ability to attribute and gain transparency into AI-assisted work product across organizational, ownership, and lifecycle dimensions.

None of this is explainable from the existing enterprise scale AI footprint reporting as it stands, and accordingly ties directly back to SOO Objectives 7 and 13 for Federal Workforce Attribution and other key SOO objective requirements.

3. Pricing Expectation – Quoters with an existing HHS enterprise scale footprint are expected to price similarly to OneGov terms, not at a premium or on actuals. An existing footprint is not a basis for higher pricing and is the contrary, it is the basis for the Government’s most favorable available pricing, given he Quoter’s already-amortized deployment costs and significant immaturity.

4. CLIN Boundary Clarity – Quoters shall explicitly classify coding, repo-task, agentic, and tool-execution workloads must be explicitly classified by CLIN (0001, 0002, both or neither) in the proposal and locked at award. Unclassified usage defaults to CLIN 0002 at no additional cost. This prevents a Quoter from pricing “unlimited enterprise” access assuming such workloads are excluded, or from including them to win on price and later reclassifying them as “frontier” once deployed at volume.

The Government will NOT accept provider-native units to operate as undisclosed caps, hidden throttles, or billing triggers. Given the intent of the pilot and intention for maturity progression, Quoters may propose customizable controls designed to prevent abuse, waste, safety issues, runaway automation, or extreme right-tail outlier consumption, provided such controls are transparent, commercially reasonable, and consistent with the pilot's objective to allow authorized power users to explore frontier capabilities without individual-level Government rationing.

Security, Authorization, and Data Handling

36. Attachment 3 requires a FIPS 140-3 validated encryption solution for all sensitive federal data in transit and at rest. Under FedRAMP 20x Moderate, FIPS 140-3 validation is a recommended (“should”) indicator, not a mandatory control. The Offeror encrypts data at rest with AES-256 and data in transit with TLS 1.2 or higher. Please confirm that this satisfies the Attachment 3 encryption requirement. Please confirm that a FIPS 140-3 validated module is not required for award or for performance.

a. Quoters shall identify the encryption approach for the proposed solution, including the cryptographic modules, services, key-management services, validation satus, data stores, product surfaces, and security boundary to which the encryption approach applies.

37. If the Government does require FIPS 140-3 validation, please confirm that the requirement may be met at the cloud infrastructure layer. Specifically, please confirm that a FIPS 140-3 validated key management service, using customer-managed encryption keys provided by the underlying cloud platform, satisfies the requirement.

a. A FIPS 140-3 validated key-management service or cryptographic module at the cloud infrastructure or platform layer may satisfy the requirement where that service protects HHS data in transit or at rest within the proposed and accepted security boundary.

Quoters shall identify the cloud service, key-management service, validation status, key ownership model, whether keys are customer-managed or provider-managed, how the keys protect HHS data, and whether the approach applies to all proposed product surfaces, data stores, logs, backups, and reporting surfaces.

38. Attachment 3 requires the Contractor to report all suspected and confirmed security and privacy incidents to the HHS IRT, CO, and COR within one (1) hour. This one-hour clock for all suspected incidents cannot be met in practice and creates legal risk. Section H.15 of this same solicitation states a seventy-two (72) hour reporting timeline and states that FedRAMP procedures govern where the two conflict. Please confirm that the seventy-two (72) hour timeline in H.15 governs. Please confirm that the one (1) hour timeline in Attachment 3 does not apply, and that incident reporting follows FedRAMP and US-CERT procedures.

a. The Government does not confirm that the one-hour requirement in Attachment 3 is inapplicable. Attachment 3 in an objective intended for the Contractor to report suspected and confirmed information security and privacy incidents and breaches as soon as possible and without unreasonable delay, no later than one hour, to the identified Government stakeholders.

The one-hour requirement is intended as an initial notice requirement for reportable suspected or confirmed incidents or breaches that affect, or are reasonably likely to affect, HHS data, HHS users, HHS systems, Federal customer data, or the confidentiality, integrity, or availability of in-scope services. The initial notice may be preliminary and may be supplemented as additional information becomes available.

Where H.15, FedRAMP procedures, or other applicable incident reporting requirements provide additional reporting, follow-up, or coordination timelines, the Contractor shall comply with those requirements as applicable. The Government may issue a clarification or amendment to harmonize the incident-reporting language and distinguish initial notice from follow-up reporting.

39. Attachment 3 requires the Contractor to respond to every HHS CSIRC Indicator of Compromise within 24 hours, positive or negative. Read strictly, this requires continuously staffed, around-the-clock monitoring. Please confirm that the Offeror may meet this requirement by acknowledging and responding to each Indicator of Compromise within 24 hours through its standard FedRAMP continuous monitoring and ticketing process. Please confirm that continuously staffed monitoring (24 hours per day, 7 days per week) is not required.

a. The Contractor may meet this requirement through standard FedRAMP-aligned continuous monitoring, incident response, and ticketing processes, provided the Contractor acknowledges and responds to HHS CSIRC Indicators of Compromise within the required timeframe.

Attachment 3 requires the Contractor to respond to all HHS CSIRC Indicators of Compromise within 24 hours, whether the response is positive or negative. The solicitation does not require dedicated continuously staffed 24x7 monitoring solely by virtue of this provision, unless such monitoring is otherwise required by the proposed solution, applicable security boundary, incident-response posture, service-level approach, or accepted PWS.

40. H.11 requires that all cloud services used to process, store, or transmit Government information satisfy all applicable FedRAMP security requirements during the period of performance. Read literally, this requires a completed FedRAMP authorization at award rather than a pathway to one. Please confirm that an Offeror with an in-process FedRAMP 20x Moderate authorization satisfies H.11, provided the Offeror delivers a defined milestone schedule and supports agency assessment and authorization during the base period. Please confirm that a completed FedRAMP authorization is not required at quote submission or at award.

a. A completed FedRAMP authorization is not required for every proposed capability, product surface, model, feature, or deployment option at quote submission or award unless expressly required for the proposed capability, data type, deployment pattern, or security boundary.

The SOO requires a FedRAMP 20x-aligned pathway, including Key Security Indicator mapping, machine-readable or automation-supporting evidence, persistent-validation approach, continuous monitoring evidence, significant-change logic, and agency ATO support artifacts. The SOO also requires disclosure of gaps, authorization dependencies, security-boundary issues, required customization, and target availability dates where a model or feature cannot be made available to HHS at commercial parity.

41. Attachment 3 requires remediation of critical vulnerabilities within 30 days and of high, medium, and low vulnerabilities within 60 days. FedRAMP 20x requires fast remediation only for vulnerabilities that are exploitable and reachable, and allows up to approximately 192 days for other findings. Please confirm that vulnerability management under the FedRAMP 20x Key Security Indicators satisfies the Attachment 3 remediation requirement. Specifically, please confirm that the Offeror may prioritize exploitable and reachable vulnerabilities and track all other findings on a documented remediation plan.

a. The Contractor shall comply with the vulnerability management requirements applicable to the awarded solution, security boundary, data type, and authorization posture. Where a FedRAMP 20x-aligned pathway is proposed, the Quoter shall describe how its vulnerability detection, prioritization, mitigation, remediation, POA&M, and reporting approach satisfies the applicable FedRAMP 20x-aligned security approach and HHS requirements.

42. Attachment 3 requires the Contractor to store all information within the security authorization boundary, including data at rest and data backup, within the Continental United States, “when applicable.” Please confirm that storing Government data at rest and in backup in a commercial cloud region located in the Continental United States satisfies this requirement. Please confirm that a dedicated Government-only cloud region is not required. Please also state what “when applicable” means in this requirement.

a. For purposes of this requirement, “when applicable” means when the Contractor stores, processes, transmits, backs up, logs, or otherwise handles HHS data, Federal customer data, or in-scope metadata within the contracted service. The Quoter shall identify any data, logs, telemetry, support records, backups, subprocessors, administrative surfaces, or processing activities that occur outside CONUS or outside the proposed authorization boundary.

43. Attachment 3 requires that all Contractor and subcontractor employees obtain a background investigation commensurate with position sensitivity under 5 CFR Parts 1400 and 731.