SECTION A – SOLICITATION/CONTRACT FORM

Request for Proposal 7571TE26R00004

SECTION B – SUPPLIES OR SERVICES, AND PRICES/COSTS

Section B.1 – Project Overview

The Department of Health and Human Services (HHS) seeks to conduct an Advanced AI Power User Pilot to evaluate, baseline, and operationalize advanced commercial artificial intelligence (AI) capabilities in support of future enterprise-wide adoption and acquisition decisions. The pilot will provide HHS with practical experience using advanced large language model (LLM) technologies, advanced features, agentic capabilities, APIs, administrative controls, reporting tools, and integration pathways within a secure enterprise environment.

The primary objective of the pilot is to generate operational evidence that will enable HHS to establish enterprise AI governance, determine enterprise demand, assess scalability, evaluate security and authorization requirements, develop future acquisition strategies, and formulate sustainable enterprise operating models for AI adoption. The pilot will support the evaluation of both mature AI capabilities and emerging frontier capabilities that require real-world testing before HHS can determine appropriate enterprise licensing, pricing, consumption, and governance approaches.

Through this effort, HHS intends to:

• Establish operational baselines for advanced AI models, features, tools, and services used by HHS power users.

• Evaluate the feasibility of maintaining commercial-parity access to rapidly evolving AI technologies while meeting Federal security, privacy, records management, accessibility, and governance requirements.

• Assess integration, customization, interoperability, and enterprise deployment requirements associated with advanced AI capabilities.

• Develop enterprise attribution, reporting, allocation, and AI consumption measurement methodologies.

• Validate security, authorization, and FedRAMP 20x-aligned implementation pathways for advanced AI capabilities.

• Support development of enterprise AI governance processes, use-case inventories, risk management approaches, and operational controls.

• Generate recommendations to inform future HHS enterprise acquisitions, including potential Blanket Purchase Agreements (BPAs), Enterprise License Agreements (ELAs), and other enterprise-wide AI solutions.

The desired end state is the establishment of a scalable, secure, and sustainable enterprise AI operating model that enables HHS users to access and leverage advanced commercial AI capabilities with minimal delay relative to commercial availability, while maintaining appropriate Federal safeguards and governance controls. The pilot will provide the operational data, lessons learned, and enterprise recommendations necessary to support future Department-wide AI modernization initiatives and acquisition strategies.

This effort is intended to inform future enterprise AI investments and support HHS's strategic objective of responsibly integrating advanced AI capabilities into mission, programmatic, scientific, research, and administrative operations across the Department.

B.2 Contract Type

The Government intends to award several Firm-Fixed-Price (FFP) contracts as a result of this solicitation. Offerors shall submit fixed prices for all Contract Line Item Numbers (CLINs) identified in Section B3. The Government anticipates that the Contractor will assume full responsibility for all costs associated with performance of the contract requirements, except as otherwise expressly provided in the contract.

The anticipated contract type is based on the Government's determination that the requirement can be sufficiently defined and that performance risks can be reasonably estimated. Accordingly, offerors are expected to propose prices that reflect all labor, materials, equipment, travel (if applicable), overhead, general and administrative expenses, profit, and any other costs necessary to perform the requirements of the contract.

B.3 Contract Structure

CLIN Description Pricing treatment

0001 - Base Exploratory Frontier AI Entitlement for up to [1,000] authorized portable HHS power users.

FFP

0002 - Base Enterprise-Wide Access Entitlement FFP

OneGov Pricing is preferred

0003 - Base

(OPTIONAL

TASK)

Enterprise Workforce Adoption and Operating Model Baselining

FFP

OneGov Pricing is preferred

0004 - Base

(OPTIONAL

TASK)

Frontier Entitlement Unit Quantity Expansion.

Increases the authorized portable-user quantity from the base cohort up to a maximum of 10,000 authorized portable users for the applicable individual LLM.

1001 – OP1

(OPTIONAL

TASK)

Option Period 1 continuation of Exploratory Frontier AI Entitlement for the ordered user quantity and approved pilot scope.

1002 – OP1

(OPTIONAL

TASK)

Option Period 1 continuation or refresh of Enterprise- Wide Access Entitlement, if exercised.

FFP

OneGov Pricing is preferred

1003 – OP1

(OPTIONAL

TASK)

Option Period 1 continuation or refresh of Enterprise Workforce Adoption and Operating Model Baselining, if exercised.

FFP

OneGov Pricing is preferred

1004 – OP1

(OPTIONAL

TASK)

Frontier Entitlement Unit Quantity Expansion.

Increases the authorized portable-user quantity from the

2001 – OP2

(OPTIONAL

TASK)

Option Period 2 continuation of Exploratory Frontier AI Entitlement for the ordered user quantity and approved pilot scope.

FFP

2002 – OP2

(OPTIONAL

TASK)

Option Period 2 continuation or refresh of Enterprise- Wide Access Entitlement, if exercised.

FFP

OneGov Pricing is preferred

2003 – OP2

(OPTIONAL

TASK)

Option Period 2 continuation or refresh of Enterprise Workforce Adoption and Operating Model Baselining, if exercised.

OneGov Pricing is preferred

2004 – OP2

(OPTIONAL

TASK)

Frontier Entitlement Unit Quantity Expansion.

Increases the authorized portable-user quantity from the

3001 - Option to Extend

(OPTIONAL

TASK)

Option to Extend. Continuation of Exploratory Frontier AI Entitlement for the ordered user quantity and approved pilot scope.

FFP

3002 - Option to Extend

(OPTIONAL

TASK)

Option to Extend. Continuation or refresh of Enterprise- Wide Access Entitlement, if exercised.

FFP

3003 - Option to Extend

(OPTIONAL

TASK)

Option to Extend. Continuation or refresh of Enterprise Workforce Adoption and Operating Model Baselining, if exercised.

SECTION C – PERFORMANCE WORK STATEMENT / STATEMENT OF

OBJECTIVES

C.1 Statement of Objectives

The Government has provided a Statement of Objectives (SOO) as Attachment 1 to communicate the desired mission outcomes and performance objectives for this acquisition. Consistent with the acquisition of commercial services, the SOO is intended to provide Offerors maximum flexibility to propose innovative, commercially available solutions, methodologies, and approaches that best satisfy the Government's objectives.

Offerors are responsible for proposing the specific solution, implementation approach, and supporting services necessary to achieve the objectives identified in Attachment 1.

SECTION D – PACKAGING AND MARKING

D.1 PACKAGING AND MARKING

All deliverables shall be delivered to the Contracting Officer’s Representative (COR) identified in Section G and shall be marked as identified in the resultant contract.

SECTION E – INSPECTION AND ACCEPTANCE

Pursuant to the appropriate inspection clause, all work described in Section C to be delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the Contracting Officer’s Representative (COR), who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

Technical Monitoring

Performance of the work under this order shall be subject to the technical monitoring of the COR. The term “Technical Monitoring” is defined to include, without limitation, the following:

Technical directions to the Contractor that redirect the contract effort, shift work emphasis between work areas or assignments, require pursuit of certain lines of inquiry, fill in details, or otherwise serve to accomplish the contractual scope of work.

Providing information to the Contractor for assistance in the interpretation of drawings, specifications, or technical portions of the work description.

Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the Contractor to the Government under the contract.

Technical direction must be within the general scope of the work stated in the contract. The COR does not have authority to and may not issue any technical direction which:

o Constitutes any assignment of additional work outside the general scope of the contract;

o Constitutes a change as defined in the contract clause titled, “Changes”;

o In any manner causes an increase in the total contract cost or the time required for contract performance; or o Changes any of the expressed terms, conditions, or specifications of the contract.

All technical directions shall be issued in writing by the COR or shall be confirmed by him/her in writing with five (5) working days after issuance.

The Contractor shall proceed promptly with the performance of technical directions duly issued by the Project Officer in the manner prescribed within his authority under this provision.

If, in the opinion of the Contractor, any instruction or direction issued by the COR is within one of the categories as defined in (i) through (iv) above, the Contractor shall not proceed, but shall notify the Contracting Officer in writing within five (5) working days after the receipt of any such instruction or direction and shall request the Contracting Officer to modify the contract accordingly. Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of this article and does not constitute a change under the Changes Clause of the contract.

The Contractor shall thereupon proceed immediately with the direction given. A failure of the parties to agree upon the nature of the instruction or direction or upon the contract action to be taken with respect thereto shall be subject to the provisions of the contract clause titled, “Disputes."

SECTION F – DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

Base Period: July 15, 2026 through January 14, 2027

Option Period 1: January 15, 2027 through July 14, 2027

Option Period 2: July 15, 2027 through January 14, 2028

Transition Out Option (180 days): January 15, 2028 (Est) through

July 14, 2028 (Est)

F.2 PLACE OF PERFORMANCE

The work to be performed under this contract will be performed at the Contractor's facilities with any necessary ad hoc meetings held at HHS Headquarters or the local Washington, D.C. area.

F.3 Type of Contract: Firm Fixed Price.

F.4 Work Hours and Recognized Holidays:

The contractor is responsible for conducting business, between the hours of 7:00AM – 5:30PM Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the Government facility is not closed for the above reasons. Deliverables due on a Saturday, Sunday, or Federal holiday shall be due on the following business day. A listing of the applicable Federal holidays can be found at: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

F.5 Deliverables

The Contractor shall furnish the items required under this contract in accordance with the reporting instructions and delivery schedule set forth in the Performance Work Statement and Attachment 2 - Deliverables.

SECTION G – CONTRACT ADMINISTRATION DATA

G.1 AUTHORITIES OF GOVERNMENT PERSONNEL

Notwithstanding the Contractor’s responsibility for total management during the performance of this contract, the administration of the contract will require coordination between the Government and the Contractor. The following individuals will be the Government’s points of contact during performance of the contract.

Contracting Officer

Note: Department of Health and Human Services Contracting Officer is the only individual authorized to modify this contract.

Office of Mission Acquisition Solutions (OMAS) U.S. Department of Health and Human Services (HHS)

Contracting Officer's Representative (COR)

Office of the Chief Information Officer (OCIO) U.S. Department of Health and Human Services (HHS) https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/ https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

G.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR) AUTHORITY

(a) Performance of work under this contract must be subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing.

The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(b) Technical direction must be within the scope of the specification(s)/work statement.

The Contracting Officer's Representative does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

(2) Constitutes a change as defined in the clause entitled "Changes";

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

(d) The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officers, Representative. If, in the opinion of the contractor, any direction of the Contracting Officers, Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

G.3 INVOICES

Unless otherwise specified in an individual order the Contractor will submit invoices as follows. Electronic Invoicing and Payment Requirements - Invoice Processing Platform

(IPP).

All Invoice submissions for goods and or services delivered to facilitate payments must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 included in commercial items contracts.

G.4 Government Furnished Property

As necessary for the execution of the PWS, the Government will provide the contractor with Government Furnished Property (GFP) (e.g. laptops) as needed when contract is awarded.

If activities are to be performed on a Government site, the Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment. The Government will provide utilities in the facility that will be available for the contractor’s use in performance of tasks outlined in the PWS. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment. The Government will provide if applicable access to, scanners fax machines, printers, lighting and sound, etc. The Government will provide Standard Operating Procedures and Policies.

G.5 Government Furnished Information

The Government anticipates furnishing information necessary to support the Contractor's performance of the requirements identified in the Statement of Objectives (SOO).

Government-Furnished Information (GFI) will be provided as determined necessary by the Contracting Officer and/or the Contracting Officer's Representative (COR), and will be consistent with the scope, objectives, and performance requirements described in the SOO. The Contractor shall use all Government-Furnished Information solely for the performance of this contract and in accordance with all applicable security, privacy, and data protection requirements.

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 Purpose

This solicitation is for the acquisition, deployment, operation, support, enhancement, and maintenance of Artificial Intelligence (AI) capabilities. Compliance with the requirements of this Section H is a material requirement of contract award, performance, option exercise, and payment.

H.2 Definitions

As used in this Section --

American AI Systems means AI systems developed and produced in the United States (Ref.

Office of Management and Budget (OMB) Memorandum M-25-22).

Artificial Intelligence (AI) System has the same meaning as defined in the Advancing American AI Act, section 7223(4) of Pub. L. 117-263.

Contractor means the entity that enters into the direct contract with HHS (i.e., prime contractor).

Custom Development means any design of or modifications, customizations, configurations, or enhancements to AI Systems or associated implementations or workflows, and any related work product or deliverables, in each case developed specifically for the Government under this contract, including any modifications, customizations, configurations, or enhancements to AI Systems, or models as a result of model training or fine-tuning. Custom Development excludes any background intellectual property existing prior to entry into this contract or developed independently by such Contractor or Service Provider without use of or reference to the Government’s confidential information or design specifications during the term of this contract.

Data has the same meaning as defined in 44 U.S.C. §3502(16) and must, without limiting the generality of the foregoing, specifically include Data Inputs and Data Outputs.

Data Inputs means all data, information, personally identifiable information (PII), or content submitted to the AI System by, or created for, the Government, including but not limited to user prompts, queries, instructions, system prompts, source data, documents, knowledge bases, and any other information or content submitted to the AI System by or on behalf of the Government.

Data Outputs means all data, information, PII, any improvements, enhancements, corrections, annotations, or other modifications made to Data Inputs, or content generated by the AI System in the performance of this contract, including but not limited to responses, results, analyses, anonymized data, derivative data, metadata, logs, synthetic data, and any other output or action produced by the AI System. This definition specifically excludes technical system-level data that contains no government data or government usage context, such as performance metrics, token counts, and processing times.

Government Data means Data Inputs and Data Outputs.

Government means any entity authorized to obtain procurement services through GSA pursuant to 40 U.S.C. § § 501, 502.

Large Language Model (LLM) means a generative AI model trained on vast, diverse datasets that enable the model to generate natural-language responses to user prompts (Ref.

Executive Order 14319 Section 2).

Personally Identifiable Information (PII) has the same meaning as defined in OMB Circular No. A-130.

Service Provider means an entity that directly or indirectly provides, operates, or licenses an AI system but is not a party to the contract. Service Providers may or may not be subcontractors.

H.3 AI Compliance and Risk Mitigation Plan

(a) The Contractor shall submit and maintain an AI Compliance and Risk Management Plan.

(b) The Plan shall address:

(1) AI governance and oversight;

(2) Risk management methodology;

(3) Data management and data provenance;

(4) Privacy and civil rights protections;

(5) Cybersecurity controls;

(6) Bias testing and mitigation;

(7) Model testing and validation;

(8) Human oversight procedures;

(9) Incident response procedures;

(10) Continuous monitoring activities;

(11) Model update and change management controls;

(12) Data portability and transition planning.

(c) The Government reserves the right to approve, reject, or require modification of the Plan.

H.4 Large Language Model (LLM) Requirements

(a) The Contractor shall provide documentation demonstrating compliance with applicable Federal AI requirements;

(b) The Contractor shall disclose safeguards used to reduce hallucinations, misinformation, prompt injection, and unauthorized disclosure of Government information;

(c) AI-generated content shall be identifiable to users when appropriate;

(d) The Government reserves the right to conduct independent testing of truthfulness, reliability, and operational performance.

H.5 Commercial Parity

The Government requires continuous alignment between the Contractor's commercial platform offerings and those made available to the Government. The Contractor shall align with commercial releases, identify parity gaps affecting Government access, and support rapid implementation planning to minimize lag between commercial and Government availability. Parity shall encompass all user experience surfaces including web, desktop applications (coding and collaborative work), CLI, and API access delivered through a unified authentication experience (e.g. Entra ID OAuth/OIDC). All access modalities shall support short-lived token authentication; long-lived tokens are not permitted. The Contractor shall provide release documentation and identify and escalate blockers to Government availability. The Contractor must maintain a commercial parity release plan with target resolution dates.

H.6 Data Rights

All data collected by the Contractor or provided to the Contractor in the performance of this contract are the property of the Government. The Government retains all rights to the data used and all derivative works developed by the Contractor. The Contractor agrees that during performance of the contract and for a period of six (6) years after the completion of performance of this contract, the Contractor, including all divisions thereof, and any affiliate of the Contractor, any joint venture involving the Contractor, any entity into or with which it may subsequently merge or affiliate, or any other successor or assign of the

Contractor, shall not supply information or material received from this contract, to the public or to any firm participating in or having a known prospective interest in the subject matter areas for which the sensitive information such as the name or mission of the government agency/department that provided the data was initially submitted.

All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. The right does not abrogate any other Government rights under the applicable Data Rights clause(s).

License Grant to Government. The Contractor grants to the Government an irrevocable, royalty-free, non-exclusive license to use the AI System for the duration of this contract for any lawful Government purpose. This license includes the right to:

(i) Operate and access the AI System through agreed-upon methods;

(ii) Input Data Inputs and receive Data Outputs. The AI System must not refuse to produce data outputs or conduct analyses based on the Contractor’s or Service Provider’s discretionary policies. This requirement must not be construed to require retraining of the model or alteration of model weights;

(iii) Allow authorized Government personnel and contractors to use the AI System;

and

(iv) Integrate the AI System with Government systems as necessary for any lawful Government purpose.

H.7 Government Data Protection

All Government data provided to or generated by the Contractor under this contract remains the exclusive property of the Government.

The Contractor shall ensure that no Government data is retained within artificial intelligence systems beyond the period necessary to perform the contracted services and shall certify, upon request, that such data has not been incorporated into any training datasets or retained model artifacts.

The Contractor shall not use, disclose, or permit the use of Government data, including but not limited to Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), Protected Health Information (PHI), or other non-public Government information, for the purpose of training, fine-tuning, improving, or validating any artificial intelligence, machine learning, or large language model, whether proprietary or third-party, without the prior written approval of the Contracting Officer.

Any approved use shall be subject to data minimization, security, and privacy safeguards consistent with applicable federal laws, regulations, and policies.

The Contractor and Service Provider must implement and maintain appropriate technical and organizational measures to ensure that all such Government Data is logically segregated from the Data of any non-Government customer or client, and is not commingled with Data of other customers or clients and provides adequate defense in depth through access controls, policy enforcement points, labeling, and/or encryption mechanisms and must perform continuous monitoring to protect against unauthorized access by external and internal threat actors, third parties, or disclosure resulting from human or machine error.

Additionally, the Contractor and Service Provider must implement "eyes off" Data handling procedures that restrict human review of Government Data except as strictly necessary to provide the AI System to the Government or respond to incidents (including ensuring that any human access to Government Data must be logged, justified, and limited to the minimum necessary for system functionality) and such access be transparently logged and visible to the Government.

H.8 Model Training Restrictions

The use of Government data for the purpose of training Artificial Intelligence/Machine Learning (AI/ML) models and systems is prohibited without explicit written authorization from the ordering activity contracting officer. Definition: Government data means any information, (including metadata), document, media, or machine-readable material regardless of physical form or characteristics that is created or obtained by the Government, or a contractor on behalf of the Government, in the course of official Government business.

H.9 Responsible AI Requirements

(a) The Contractor shall maintain an AI Risk Management Program aligned with the NIST AI Risk Management Framework.

(b) The contractor shall disclose whether the AI system has been modified or configured to comply with any non-U.S. federal government or commercial compliance or regulatory framework no later than thirty (30) days after award, unless requested earlier by the contracting officer.

(c) The Contractor shall identify, assess, monitor, and mitigate risks relating to:

(1) Bias and discrimination;

(2) Hallucinations and factual inaccuracies;

(3) Model drift;

(4) Adversarial manipulation;

(5) Privacy violations;

(6) Cybersecurity vulnerabilities;

(7) Reliability failures.

(d) AI systems shall not support unlawful discrimination or violate applicable Federal civil rights laws.

Contractor shall provide for the following:

Explainability - The Contractor shall ensure that AI system outputs are sufficiently explainable to enable Government personnel to understand, evaluate, and appropriately use the results. At a minimum, the Contractor shall provide documentation describing the AI system’s purpose, methodology, key factors influencing outputs, known limitations, and circumstances in which outputs may be unreliable. Upon request, the Contractor shall provide information sufficient for the Government to understand the basis for material AI-generated recommendations, predictions, classifications, or generated content. Explainability documentation shall be maintained throughout contract performance and updated whenever material changes are made to the AI system.

Human Oversight - Provide a means for the Government to implement human oversight, intervention, and traceability. If the AI system uses intermediary processing such as reasoning, retrieval, or agentic processes, the AI system must summarize intermediary steps from data input to data output, and make this information accessible though data output, audit trail, and as applicable the user interface. At minimum, the AI system must include:

(i) Summarized intermediate processing actions and decision points;

(ii) Model routing decisions with accompanying rationale; and

(iii) Data retrieval methods employed (e.g., Retrieval-Augmented Generation

(RAG), web search), including complete source attribution including direct links and relevant excerpts from materials used in response generation.

Bias mitigation - The Contractor must make commercial efforts to ensure the AI system:

(i) Is developed and monitored in accordance with the following Unbiased AI Principles:

a. The AI system must be truthful in responding to user prompts seeking factual information or analysis. The AI system must prioritize historical accuracy, scientific inquiry, and objectivity and must acknowledge uncertainty where reliable information is incomplete or contradictory.

b. The AI system must be a neutral, nonpartisan tool that does not manipulate responses in favor of ideological dogmas such as Diversity, Equity, Inclusion. The Contractor must not intentionally encode partisan or ideological judgments into the AI Systems Data Outputs.

Transparency - The Contractor shall provide documentation sufficient to ensure visibility into AI capabilities, including:

(i) Model/system descriptions (model cards or equivalent)

(ii) Data provenance (sources and limitations)

(iii) Performance characteristics and limitations

(iv) Data handling practices

(v) Model usage

(vi) Security controls

(vii) Explainability for outputs where applicable

Consistent with H.8, the Government reserves the right to audit AI use practices upon reasonable notice.

H.10 Security Requirements

I. INFORMATION AND PHYSICAL ACCESS SECURITY

1. ORDER OF PRECEDENCE - INFORMATION SECURITY AND PRIVACY REQUIREMENTS

(a) In the event of any inconsistency or conflict between the terms and conditions of this solicitation and the information security and privacy requirements set forth in the Performance Work Statement (PWS), the following order of precedence shall apply:

• Federal statutes and regulations (including, but not limited to, FISMA, HIPAA, the Privacy Act, and applicable OMB guidance);

• This contract’s clauses (including HHSAR and FAR provisions);

• The Performance Work Statement (PWS);

• Other contract attachments, exhibits, or incorporated documents.

(b) Notwithstanding paragraph (a), **where information security or privacy requirements are concerned, the more stringent requirement shall govern**, including but not limited to requirements related to:

• Incident reporting timelines and procedures;

• Encryption standards (including FIPS 140 validation);

• System authorization (ATO) and continuous monitoring;

• Protection of PII, PHI, and Controlled Unclassified Information (CUI);

• Vulnerability management and remediation timelines;

• Data location, access, and safeguarding requirements.

(c) The Contractor shall comply with all applicable HHS information security and privacy policies, and associated standards, whether expressly stated in the contract or incorporated by reference.

(d) In the event of ambiguity or uncertainty regarding applicable information security or privacy requirements, the Contractor shall seek written direction from the Contracting Officer. Pending such direction, the Contractor shall apply the most stringent requirement.

(e) The Contractor shall ensure that all subcontractors and other lower-tier entities comply with the requirements of this clause.

2. INFORMATION SECURITY AND PRIVACY REQUIREMENTS

(a) In addition to the requirements contained elsewhere in this solicitation, Offerors shall comply with the information security and privacy requirements set forth in Attachment 3, "Information Security and Privacy Requirements." The requirements contained in Attachment 3 are incorporated by reference into this solicitation and shall apply to any resultant contract. Offerors shall consider these requirements in preparing their technical and price proposals.

H.11 FedRAMP Requirements

Any hosting environment required under the PWS shall maintain a current FedRAMP Authorization at the security impact level specified by the Government.

The Contractor shall ensure that all cloud services used to process, store, or transmit Government information remain within the authorized boundary and continue to satisfy all applicable FedRAMP security requirements during the period of performance. The Contractor shall promptly notify the Contracting Officer of any material changes to the authorization status or security posture that may affect contract performance.

H.12 Continuous Monitoring

The Contractor shall maintain documentation sufficient to demonstrate compliance with all AI-related requirements of this contract, including data handling practices, model usage, and security controls.

The Government reserves the right to audit the Contractor’s AI use practices related to contract performance upon reasonable notice.

The Contractor shall implement continuous improvement processes to enhance detection and mitigation of performance, trustworthiness, bias, and/or systems generating illegal or prohibited content, including regular evaluation of system outputs (excluding Data Outputs) against verified factual sources.

The Contractor shall implement, when requested by the Government, and to the maximum extent possible, OMB directives related to AI Systems that are issued during the contract performance period.

The Government reserves the right to conduct automated assessments of the AI system, as deployed and configured for government users, at any time using its own benchmarks.

These evaluations may assess bias, truthfulness, safety, unsolicited ideological content, and other factors determined by the Government in order to facilitate evaluations.

The Contractor must provide tools and interfaces that enable the Government to run its benchmarks in an automated fashion to test the production AI system and identify any material gaps.

The Government may provide such results to the Contractor or Service Provider to support remediation efforts. All benchmarks, test data, and methodologies developed or used by the Government for such assessments are considered Government Data. The Government is under no obligation to disclose or provide access to the underlying data, methodologies, or systems.

In the event of non-compliance, the Government retains the tight to suspend use of the AI System until performance issues are satisfactorily addressed. Additionally, the Contractor may be liable for reasonable decommissioning costs if the agency terminates this contract for cause for failure to comply with the Unbiased AI Principles described in Section H.4.

H.13 Privacy Requirements

To the extent the Contractor or Service Provider has available tools, they must provide tools to enable the Government to implement appropriate Government-configurable controls, including but not limited to automated detection mechanisms and clear user notifications to manage, prevent, and reject the entry or persistence of PII within the AI System.

H.14 Change Management

(a) The Contractor shall provide written notification at least thirty (30) calendar days before implementing material model changes.

(b) Material changes include:

(1) Foundation model replacement;

(2) Significant retraining;

(3) New AI functionality;

(4) Material performance changes.

(c) The Contractor must use reasonable effort to provide the Government with comprehensive concurrent access to any successor model (and all associated documentation) for a minimum evaluation period of thirty (30) calendar days for major versions, and (15) calendar days for minor versions, prior to discontinuing or replacing any existing model currently in use under this contract.

(d) The Contractor must notify the Government within seven (7) calendar days of identifying any AI service change that materially increases output bias or decreases safety guardrails or behavioral constraints impacting lawful usage or the performance or truthfulness of outputs. The notification must describe the change, its purpose, the evaluation approach used and any new limitations, trade-offs, or potential negative impacts identified.

H.15 Incident Reporting

The Contractor shall report any actual or suspected cybersecurity, privacy, data protection, model integrity, or AI safety incident (as defined by the Federal Information Security Modernization Act of 2014 in 44 U.S.C. § 3552(b)(2)) within seventy-two (72) hours of discovery, and provide daily status updates to all points of contact until resolved.

Such notification must include, to the extent known at the time:

(1) Nature and scope of the incident;

(2) Data potentially affected;

(3) Immediate remediation steps taken;

(4) Timeline for full resolution; and

(5) Measures to prevent recurrence

Where FedRAMP incident communication and response procedures conflict with contractual requirements, the FedRAMP procedures must apply.

The Contractor and Service Provider must preserve all relevant logs, forensic images, and incident artifacts for a minimum of 90 calendar days from a security incident involving Government Data to support follow-on investigation activity by law enforcement entities.

H.16 Feedback Reporting

The Contractor shall provide and maintain a mechanism for Government users to report concerns, errors, inaccuracies, unexpected behavior, bias, or other issues associated with AI-generated outputs. The Contractor shall review reported feedback, track resolution actions, and provide summaries of significant issues and corrective actions to the

Contracting Officer upon request. The Contractor shall promptly notify the Contracting Officer of any recurring or systemic issues that could materially affect the accuracy, reliability, fairness, or intended use of the AI system.

H.17 Organizational Conflict of Interest

The Contractor shall identify, disclose, and mitigate any actual, potential, or apparent organizational conflicts of interest related to the development, training, testing, validation, operation, evaluation, auditing, or oversight of AI systems used under this contract. The Contractor shall not permit personnel, business units, affiliates, subcontractors, data providers, model developers, or other entities with a financial, commercial, competitive, or operational interest in the AI system's performance or outcomes to perform independent validation, verification, audit, or assessment activities unless expressly approved in writing by the Contracting Officer. The Contractor shall promptly disclose any conflict that could impair objectivity, introduce bias, affect the integrity of AI outputs, influence evaluation results, or otherwise compromise the Government's ability to independently assess system performance. The Government reserves the right to require mitigation measures, independent review, recusal of conflicted parties, or other actions necessary to protect the integrity and objectivity of the AI system and related contract performance.

H.18 Transition Support

(a) The Contractor shall provide export capabilities using open, machine-readable formats.

(b) Upon contract expiration or termination, the Contractor shall provide all Government Data, outputs, metadata, audit logs, model documentation, and transition support necessary to migrate to a successor solution.

(c) The Contractor shall not employ contractual, technical, licensing, or operational mechanisms that create vendor lock-in.

SECTION I – CONTRACT CLAUSES

Federal Acquisition Regulations (FAR) Provisions and Clauses:

FULL TEXT PROVISIONS:

FAR 52.203-2 Certificate of Independent Price Determination (Apr 1985)

(a) The offeror certifies that-

(1) The prices in this offer have been arrived at independently, without, for the purpose of restricting competition, any consultation, communication, or agreement with any other offeror or competitor relating to-

(i) Those prices;

(ii) The intention to submit an offer; or

(iii) The methods or factors used to calculate the prices offered.

(2) The prices in this offer have not been and will not be knowingly disclosed by the offeror, directly or indirectly, to any other offeror or competitor before bid opening (in the case of a sealed bid solicitation) or contract award (in the case of a negotiated solicitation) unless otherwise required by law; and

(3) No attempt has been made or will be made by the offeror to induce any other concern to submit or not to submit an offer for the purpose of restricting competition.

(b) Each signature on the offer is considered to be a certification by the signatory that the signatory-

(1) Is the person in the offeror’s organization responsible for determining the prices being offered in this bid or proposal, and that the signatory has not participated and will not participate in any action contrary to paragraphs (a)(1) through (a)(3) of this provision; or

(2)

(i) Has been authorized, in writing, to act as agent for the following principals in certifying that those principals have not participated, and will not participate in any action contrary to paragraphs (a)(1) through (a)(3) of this provision ____________ [insert full name of person(s) in the offeror’s organization responsible for determining the prices offered in this bid or proposal, and the title of his or her position in the offeror’s organization];

(ii) As an authorized agent, does certify that the principals named in subdivision (b)(2)(i) of this provision have not participated, and will not participate, in any action contrary to paragraphs (a)(1) through (a)(3) of this provision; and

(iii) As an agent, has not personally participated, and will not participate, in any action contrary to paragraphs (a)(1) through (a)(3) of this provision.

(c) If the offeror deletes or modifies subparagraph (a)(2) above, the offeror must furnish with its offer a signed statement setting forth in detail the circumstances of the disclosure.

(End of provision)

FAR 52.217-4 Evaluation of Options Exercised at Time of Contract Award

Except when it is determined in accordance with FAR 17.202(b) not to be in the Government’s best interests, the Government will evaluate the total price for the basic requirement together with any option(s) exercised at the time of award.

(End of provision)

FAR 52.217-5 Evaluation of Options

Except when it is determined in accordance with FAR 17.202(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s).

(End of provision)

FAR 52.217-6 Option for Increased Quantity.

The Government may increase the quantity of supplies called for in the Schedule at the unit price specified. The Contracting Officer may exercise the option by written notice to the Contractor within 1 day. Delivery of the added items shall continue at the same rate as the like items called for under the contract, unless the parties otherwise agree.

(End of provision)

FAR 52.217-7 Option for Increased Quantity-Separately Priced Line Item.

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 1 day.

(End of provision)

FULL TEXT CLAUSES:

FAR 52.217-8 – Option to Extend Services (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 1 day.

(End of clause)

FAR 52.217-9 Option to Extend the Term of the Contract.

(a) The Government may extend the term of this contract by written notice to the Contractor within 1 day; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 1 day before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 24 months.

(End of clause)

FAR 52.237-3 - Continuity of Services (JAN 1991)

(a) The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to-

(1) Furnish phase-in training; and

(2) Exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

(b) The Contractor shall, upon the Contracting Officer’s written notice, (1) furnish phase-in, phase-out services for up to 90 days after this contract expires and (2) negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the Contracting Officer’s approval. The Contractor shall provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

(c) The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this contract. The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

(d) The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e., costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations) and a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract.

(End of clause)

FAR 52.252-2 -- Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52

(End of clause)

FAR 52.252-5 Authorized Deviations in Provisions (NOV 2020)

(a) The use in this solicitation of any Federal Acquisition Regulation (48 CFR Chapter

1) provision with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the provision.

(b) The use in this solicitation of any Health and Human Services Acquisition Regulations (48 CFR Chapter 3) provision with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

FAR 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of “(DEVIATION)” after the date of the clause.

(b) The use in this solicitation or contract of any Health and Human Services Acquisition Regulations (48 CFR Chapter 3) clause with an authorized deviation is indicated by the addition of “(DEVIATION)” after the name of the regulation.

CLAUSES INCORPORATED BY REFERENCE:

FAR 52.203-3, Gratuities (APR 1984)

FAR 52.203-5 Covenant Against Contingent Fees (MAY 2014)

FAR 52.203-6, Restrictions on Subcontractor Sales to the Government (Alternate I)

(NOV 2021)

FAR…